Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix vnc scanner module(s) #16207

Merged
merged 3 commits into from
Mar 22, 2022
Merged

Fix vnc scanner module(s) #16207

merged 3 commits into from
Mar 22, 2022

Conversation

h00die
Copy link
Contributor

@h00die h00die commented Feb 21, 2022

This updates the VNC library and modules to actually work in 2022.

Changes:

  1. cleans up ard_root_pw docs to currents msftidy_doc standards
  2. adds docs for vnc_login
  3. adds docs for vnc_none_auth
  4. msftidy on vnc_none_auth
  5. lowers a print_good to print_status in vnc_none_auth printing the protocol versions. A positive response should be when we found a vulnerable version, not that a successful connection was made to interrogate the service.
  6. Fixes a bug where the vnc client in vnc_none_auth was being created without allow_none and thus it would never actually report back that None was a possibility, thus making the module useless.
  7. print the actual major version instead of just a list of accepted versions... seems like a bug. also add 5 to the list since I'm seeing that in the wild (aka a pentest)
  8. if we don't support any of the authentication types, at least print the ones we were offered so we have an idea what's there
  9. add a bunch of new AuthTypes so we don't just print Unknown
  10. rubocop client and constant libraries

Pre

[*] 1.1.1.1:5900    - 1.1.1.1:5900 - VNC server protocol version: [3, 4].889

Post

[*] 1.1.1.1:5900    - 1.1.1.1:5900 - VNC server protocol version: 3.889

Pre

[*] 1.1.1.1:5900    - 1.1.1.1:5900 - VNC server security types supported: ARD,Unknown,Unknown,Unknown

Post

[*] 1.1.1.1:5900    - 1.1.1.1:5900 - VNC server security types supported: ARD, Apple_33, AppleUnknown_36, MacOSX_35

Pre

[*] 1.1.1.1:5900    - 1.1.1.1:5900 - Handshake failed: Invalid major version number: 5

Post

[*] 1.1.1.1:5900    - 1.1.1.1:5900 - VNC server protocol version: 5.0
[-] 1.1.1.1:5900    - 1.1.1.1:5900 - Auth negotiation failed: No supported authentication method found. All available options: VeNCrypt

Verification

List the steps needed to make sure this thing works

  • check over docs
  • for vnc_none_auth follow the directions in the docs to make a vuln windows/linux server and scan it
  • scan some vnc servers and make sure we're getting some good info instead of basically nothing like before

@h00die
Copy link
Contributor Author

h00die commented Feb 21, 2022

pushing back to draft, seems to be more updates needed here to get this thing working successfully in 2022

@h00die h00die marked this pull request as draft February 21, 2022 14:16
@h00die h00die marked this pull request as ready for review February 23, 2022 11:51
@h00die
Copy link
Contributor Author

h00die commented Feb 23, 2022

this is ready for review now. To be honest, I think vnc_none_auth should be moved to vnc_auth because it actually finds all auths not just none. but this is a LOT of changes already just to make the darn thing work

@h00die
Copy link
Contributor Author

h00die commented Feb 24, 2022

rebased and squashed

@gwillcox-r7
Copy link
Contributor

@h00die Just a heads up I see your other VNC improvements are in the queue, going to grab this one and hopefully move onto the other once this and some other PRs are done, as I imagine getting the VNC modules to work first comes before getting the hash cracking part to work properly 😄

Will let you know if I have any issues getting this set up, but your instructions for the one installation look good, might just want to copy that section over as per my above comment since those docs are going to live independent of one another but the installation seems the same for both from my quick skim.

documentation/modules/auxiliary/scanner/vnc/vnc_login.md Outdated Show resolved Hide resolved
lib/rex/proto/rfb/constants.rb Show resolved Hide resolved
lib/rex/proto/rfb/constants.rb Outdated Show resolved Hide resolved
lib/rex/proto/rfb/constants.rb Show resolved Hide resolved
lib/rex/proto/rfb/client.rb Outdated Show resolved Hide resolved
@gwillcox-r7
Copy link
Contributor

Will go ahead and fix up some of the more minor issues so long, should help assist with easing effort to implement these changes.

@gwillcox-r7
Copy link
Contributor

Will proceed with testing for this PR then go ahead and land it.

@adfoster-r7 adfoster-r7 mentioned this pull request Mar 22, 2022
7 tasks
@gwillcox-r7
Copy link
Contributor

gwillcox-r7 commented Mar 22, 2022

This seems to be working, will land this now, nice work @h00die!
tigervnc proof

@gwillcox-r7 gwillcox-r7 added the rn-fix release notes fix label Mar 22, 2022
@h00die
Copy link
Contributor Author

h00die commented Mar 22, 2022

thanks! I hope all my frustration in VNC came through loud and clear in this PR since it seems to have splintered and gone closed source since RealVNC took over.

@gwillcox-r7 gwillcox-r7 merged commit 02c616a into rapid7:master Mar 22, 2022
@gwillcox-r7
Copy link
Contributor

Release Notes

The VNC libraries and associated modules have been updated to support more modern versions of VNC and to fix a few bugs so that they will work correctly with new VNC versions.

@h00die h00die deleted the fix_vnc branch March 25, 2022 09:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants