forked from fnmsd/awvs_script_decode
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathvnc_audit.script
More file actions
120 lines (112 loc) · 3.82 KB
/
Copy pathvnc_audit.script
File metadata and controls
120 lines (112 loc) · 3.82 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
#include string_helpers.inc;
#include reporting_helpers.inc;
// test for realvnc 4.1.1 auth bypass
// get auth string
function GetAuthTypeString(auth){
var res = "";
switch (auth) {
case 0: res = "Connection refused"; break;
case 1: res = "No authentication required"; break;
case 2: res = "VNC authentication"; break;
case 5: res = "RA2 authentication"; break;
case 6: res = "RA2ne authentication"; break;
case 16: res = "Tight authentication"; break;
case 17: res = "Ultra authentication"; break;
case 18: res = "TLS authentication"; break;
default : res = "Unknown authentication";
}
return res;
}
// start
if (IsPortOpen(5900)){
socket = new TSocket("TCP");
socket.Host = ScanHost;
socket.Port = 5900;
socket.Timeout = 5;
socket.Connect();
if (socket.IsConnected) {
// receive server version
server_version_str = socket.ReceiveBytes(12);
trace(server_version_str);
srv_version = server_version_str.match(/^RFB\s([0-9]+)\.([0-9]+)/);
if (srv_version && srv_version.length > 1) {
// get major and minor version
//trace(srv_version[1]);
//trace(srv_version[2]);
srv_major = parseInt(srv_version[1], 10);
srv_minor = parseInt(srv_version[2], 10);
//trace(srv_major);
//trace(srv_minor);
// ignore older versions
if (srv_major < 3 && srv_minor < 7) terminate();
// send client version (same as server)
socket.send(server_version_str);
// read auth types
authCount = socket.ReceiveBytes(1);
authCount = authCount.getByteAt(0);
//trace(authCount);
if (authCount > 0) {
authTypes = new Array();
for (var i=0; i<authCount; i++) {
auth = socket.ReceiveBytes(1);
auth = auth.getByteAt(0);
authTypes.push(auth);
}
if (authTypes.length > 0) {
authTypesStr = "";
auth_required = 1;
// auth types
for (var i=0; i<authTypes.length; i++) {
if (authTypes[i] == 0 || authTypes[i] == 1) {
auth_required = 0;
}
//trace(authTypes[i]);
authTypesStr += GetAuthTypeString(authTypes[i]);
}
if (authTypesStr.length > 0) {
trace("KBASE - VNC server version : " + srv_major + "." + srv_minor + "\r\n");
trace("KBASE - Authentication types: \r\n" + authTypesStr);
KBase("VNC server running", "A VNC server is running on TCP port 5900. [break]Supported authentication types: [pre]" + authTypesStr + "[/pre]");
}
if (auth_required == 0) {
var report_no_auth = 1;
// don't report if auth type = 0 (connection refused)
for (var i=0; i<authTypes.length; i++) {
if (authTypes[i] == 0) {
report_no_auth = 0;
}
}
if (report_no_auth) {
trace("no authentication required! - create an alert here");
ReportItem("VNC_no_auth.xml", "The VNC server is running on TCP port 5900.");
}
terminate();
};
// auth required
trace("test for realvnc 4.1.1 auth bypass");
socket.send(strFromRawData(0x01));
if (srv_minor < 8) {
socket.send(strFromRawData(0x01));
data = socket.Receive(true);
if (data.length >= 24) {
// extra validation
retLength = data.getLongAt(20);
if ((retLength + 24) == data.length) {
trace("realvnc 4.1.1 auth bypass vulnerable!");
ReportItem("VNC_realvnc_auth_bypass.xml", "The VNC server is running on TCP port 5900.");
}
}
}
else {
response = socket.ReceiveBytes(4);
if (response.length && response == strFromLong(0)) {
trace("realvnc 4.1.1 auth bypass vulnerable!");
ReportItem("VNC_realvnc_auth_bypass.xml", "The VNC server is running on TCP port 5900.");
}
}
}
}
}
socket.Close();
}
}