[w00giving '99 #4]: VNC is a software package that permits a user to view a remote desktop in real-time. To protect intruder to access the remote desktop, VNC has a password protection. This encryption is done using 3DES, but this encryption is very poor and can be attacked (through brute-force).
db9eddc3778f64db3cf2e419a90e9b38<!DOCTYPE HTML PUBLIC "html.dtd">
<HTML>
<HEAD><TITLE>[w00giving '99 #4] VNC 3.3.2 R6</TITLE></HEAD>
<BODY>
<PRE>
<A HREF="http://www.roses-labs.com/">http://www.roses-labs.com</A>
Discovered and authored by: Conde Vampiro (Roses Labs)
INTRODUCTION
VNC is a software package that permits a user to view a remote
desktop in real-time. It's a very nice GNU tool that runs on Windows
(9x/NT) and *nix (Linux, BSD).
To protect intruder to access the remote desktop, VNC has a
password protection. This encryption is done using 3DES, but this
encryption is very poor and can be attacked (through brute-force).
PROBLEM ONE
When we install the VNC server on a Windows box, we can find the
password encrypted at the following registry keys (look for "password"):
\HKEY_CURRENT_USER\Software\ORL\WinVNC3
\HKEY_USERS\.DEFAULT\SOftware\ORL\WinVNC3
When we introduce a password of arbitrary length, the VNC server
will encrypt our password, but it will drop (null) all bytes after 8.
This is demonstrated here:
Imput password -> micasaesazul
Key -> 23 82 107 6 35 78 88 7
Encrypted password -> 1f f1 6f 1a cc 34 64 f0
Imput password -> micasaesroja
Key -> 23 82 107 6 35 78 88 7
Encrypted password -> 1f f1 6f 1a cc 34 64 f0
In both cases, the VNC server interpretted the password as
"micasaes." Eight characters is small.
PROBLEM TWO
When the VNC server encrypt a password it always uses the same
fixed key, so the output password are always the same.
For example, if we imput "conde" as password, the output
password is: df 6b 7e e8 94 26 d8 b5.
Imput password -> conde
Key -> 23 82 107 6 35 78 88 7
Encrypted password -> df 6b 7e e8 94 26 d8 b5
Imput password -> 2621
Key -> 23 82 107 6 35 78 88 7
Encrypted password -> 73 05 1d 22 49 b6 05 1c
The VNC server always use this key ("23 82 107 6 35 78 88 7") in
[at least] the current version.
New contributors: Conde Vampiro and Roses Labs (<A HREF="http://www.roses-labs.com/">http://www.roses-labs.com</A>)
</PRE>
<BR><HR><BR>
<CENTER>
<A HREF="http://www.w00w00.org/advisories.html">Back to Advisories</A>
<A HREF="http://www.w00w00.org/">Back to the main page</A>
</CENTER>
</BODY>
</HTML>
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!