Class: Metasploit::Framework::LoginScanner::VNC

Inherits:
Object
  • Object
show all
Includes:
Base, RexSocket, Tcp::Client
Defined in:
lib/metasploit/framework/login_scanner/vnc.rb

Overview

This is the LoginScanner class for dealing with the VNC RFB protocol. It is responsible for taking a single target, and a list of credentials and attempting them. It then saves the results.

Constant Summary collapse

LIKELY_PORTS =

CONSTANTS

(5900..5910).to_a
LIKELY_SERVICE_NAMES = 
[ 'vnc' ]
PRIVATE_TYPES = 
[ :password ]
REALM_KEY = 
nil
ULTRA_VNC_RETRY_ERROR =

Error indicating retry should occur for UltraVNC

'connection has been rejected'
VNC4_SERVER_RETRY_ERROR =

Error indicating retry should occur for VNC 4 Server

'Too many security failures'
RETRY_ERRORS =

Known retry errors for all supported versions of VNC

[
    ULTRA_VNC_RETRY_ERROR,
    VNC4_SERVER_RETRY_ERROR
]

Instance Attribute Summary

Attributes included from Tcp::Client

#max_send_size, #send_delay, #sock

Instance Method Summary collapse

Methods included from Tcp::Client

#chost, #connect, #cport, #disconnect, #proxies, #rhost, #rport, #set_tcp_evasions, #ssl, #ssl_version

Instance Method Details

#attempt_login(credential) ⇒ Metasploit::Framework::LoginScanner::Result

This method attempts a single login with a single credential against the target

Parameters:

  • credential (Credential) —

    The credential object to attempt to login with

Returns:



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'lib/metasploit/framework/login_scanner/vnc.rb', line 39

def (credential)
  result_options = {
      credential: credential,
      host: host,
      port: port,
      protocol: 'tcp',
      service_name: 'vnc'
  }

  begin
    # Make our initial socket to the target
    disconnect if self.sock
    connect

    # Create our VNC client overtop of the socket
    vnc = Rex::Proto::RFB::Client.new(sock, :allow_none => false)

    if vnc.handshake
      type = vnc.negotiate_authentication
      if type != Rex::Proto::RFB::AuthType::ARD
        credential.public = nil
      end
      if vnc_auth(vnc,type,credential.public,credential.private)
        result_options[:status] = Metasploit::Model::Login::Status::SUCCESSFUL
      else
        result_options.merge!(
          proof: vnc.error,
          status: Metasploit::Model::Login::Status::INCORRECT
        )
      end
    else
      result_options.merge!(
        proof: vnc.error,
        status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
      )
    end
  rescue ::EOFError, Errno::ENOTCONN, Rex::ConnectionError, ::Timeout::Error => e
    result_options.merge!(
        proof: e.message,
        status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
    )
  ensure
    disconnect
  end

  ::Metasploit::Framework::LoginScanner::Result.new(result_options)
end