Remote Keyboard Desktop version 1.0.1 contains a critical remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the target Windows system remotely. The exploit leverages the application's WebSocket interface, which listens on port 8080, to send crafted keyboard events that simulate user input. By sending a sequence of key presses, the attacker can invoke the Windows Run dialog and execute a malicious payload hosted on a remote SMB share. The exploit uses the Windows rundll32.exe utility to load and execute a DLL payload from the attacker's SMB server. The provided exploit code is written in Python 3 and uses the websocket-client library to connect to the target's WebSocket server. It sends keyboard events encoded as JSON messages to simulate typing the command to run the payload. The payload itself is generated using msfvenom to create a reverse shell DLL, which connects back to the attacker’s machine, providing full remote shell access. The exploit requires no authentication or user interaction beyond the vulnerable service running and listening on the target machine. The vulnerability arises because the Remote Keyboard Desktop application accepts and processes WebSocket messages that control keyboard input without proper authentication or input validation, allowing an attacker to remotely control the keyboard and execute arbitrary commands. No official patches or vendor mitigations are currently available, and no known exploits have been observed in the wild yet. The vulnerability affects Windows 10 Pro Build 19045 as tested, but likely impacts other Windows versions where the software is installed. The attack surface includes any exposed Remote Keyboard Desktop WebSocket interface, typically on port 8080. The exploit requires the attacker to host a malicious payload on an SMB share accessible to the victim machine, which is then executed via rundll32.exe. This attack vector can bypass many traditional defenses since it simulates legitimate keyboard input over a WebSocket connection.

For European organizations, this vulnerability poses a significant risk due to the potential for full system compromise via remote code execution. Attackers can gain unauthorized remote shell access, enabling data theft, lateral movement, installation of persistent malware, ransomware deployment, or disruption of critical services. Organizations using Remote Keyboard Desktop for remote control or accessibility purposes may have this service exposed internally or externally, increasing the attack surface. The ability to execute arbitrary code without authentication means that any exposed instance is vulnerable to automated scanning and exploitation once the exploit code becomes widely available. This could lead to breaches of sensitive personal data protected under GDPR, intellectual property theft, and operational downtime. Critical infrastructure, healthcare, finance, and government sectors in Europe could be targeted due to the strategic value of such systems. The lack of patches and the presence of public exploit code heighten the urgency for mitigation. The attack’s reliance on SMB shares may be mitigated in segmented networks but remains a concern in environments with lax network segmentation or SMB exposure. Overall, the vulnerability threatens confidentiality, integrity, and availability of affected systems and could facilitate large-scale cyberattacks against European enterprises.

1. Immediately identify and inventory all instances of Remote Keyboard Desktop 1.0.1 within the organization’s network. 2. Restrict network access to the WebSocket port (default 8080) using firewall rules, allowing only trusted hosts or internal management networks. 3. Disable or uninstall Remote Keyboard Desktop if it is not essential. 4. If the application must be used, isolate it in a segmented network zone with no SMB access to untrusted hosts. 5. Monitor network traffic for unusual SMB connections or WebSocket activity to detect exploitation attempts. 6. Employ endpoint detection and response (EDR) solutions to detect execution of rundll32.exe with suspicious remote DLL paths. 7. Implement strict SMB share access controls and disable SMBv1 where possible to reduce SMB attack surface. 8. Educate IT staff about this vulnerability and the risks of exposing remote control services without authentication. 9. Regularly update and patch all software components and monitor vendor channels for any forthcoming patches or mitigations. 10. Consider deploying network intrusion detection systems (NIDS) with signatures for this exploit’s WebSocket traffic patterns. These measures go beyond generic advice by focusing on network segmentation, access control, and behavioral monitoring specific to the attack vector used.