1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
local creds = require "creds"
local shortport = require "shortport"
local stdnse = require "stdnse"
local vnc = require "vnc"
description = [[
Tries to log into a VNC server and get its desktop name. Uses credentials
discovered by vnc-brute, or None authentication types. If
<code>realvnc-auth-bypass</code> was run and returned VULNERABLE, this script
will use that vulnerability to bypass authentication.
]]
author = "Daniel Miller"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"intrusive", "discovery"}
---
-- @see vnc-brute.nse
-- @see realvnc-auth-bypass.nse
--
-- @output
-- | vnc-title:
-- | name: LibVNCServer
-- | geometry: 800 x 600
-- |_ color_depth: 24
--
-- @xmloutput
-- <elem key="name">QEMU (instance-00000002)</elem>
-- <elem key="geometry">1024 x 768</elem>
-- <elem key="color_depth">24</elem>
dependencies = {"vnc-brute", "realvnc-auth-bypass"}
portrule = shortport.port_or_service( {5900, 5901, 5902} , "vnc", "tcp", "open")
local function fail(err) return stdnse.format_output(false, err) end
action = function(host, port)
local v = vnc.VNC:new( host, port )
local status, data
local result = stdnse.output_table()
status, data = v:connect()
if ( not(status) ) then return fail(data) end
status, data = v:handshake()
if ( not(status) ) then return fail(data) end
-- If this doesn't work, start over.
status = false
local reg = host.registry["realvnc-auth-bypass"]
if reg and reg[port.number] then
stdnse.debug1("Trying RealVNC Auth Bypass")
-- Force None auth type and try to init to exploit
v:sendSecType(vnc.VNC.sectypes.NONE)
status, data = v:login_none()
if status then
status, data = v:client_init(true)
if not status then
stdnse.debug1("RealVNC Auth Bypass failed.")
end
end
if not status then
-- clean up and start over
v:disconnect()
status, data = v:connect()
if not status then return fail(data) end
status, data = v:handshake()
if not status then return fail(data) end
-- Be sure to let the regular login stuff have a try
status = false
end
end
if not status then
local c = creds.Credentials:new(creds.ALL_DATA, host, port)
local tried = 0
for cred in c:getCredentials(creds.State.VALID + creds.State.PARAM) do
tried = tried + 1
stdnse.debug1("Trying creds: %s:%s", cred.user, cred.pass)
status, data = v:login(cred.user, cred.pass)
if status then
break
end
end
if tried < 1 then
--worth trying a None-type login
stdnse.debug1("Trying empty creds, for None security type")
status, data = v:login("", "")
end
if not status then
return fail(("Couldn't log in: %s"):format(data))
end
status, data = v:client_init(true)
end
if status then
local out = stdnse.output_table()
out.name = data.name
out.geometry = ("%d x %d"):format(data.width, data.height)
out.color_depth = data.depth
return out
end
end
|
