6 ms·
I may be missing something obvious, but how does it find VNC servers?
by Ecco 12y ago
I may be missing something obvious, but how does it find VNC servers?
- cuu508 12y agomasscan https://www.youtube.com/watch?v=UOWexFaRylM https://www.youtube.com/watch?v=UOWexFaRylM
- deleted 12y ago[deleted]
- srsly-0001 12y agoWe're using zmap to basically scan 0.0.0.0/0 on ports ranging from 5900 to 5910. Adresses that have at least one of these open then get passed to a Python script that attempts to connect to those machines and take a screenshot. The web frontend is built using Go httpd by the way. Edit: We are able to do this because we're at the 31c3 with an enormeously fast internet connection. The machine this is running on has a 1Gbps connection to the internet.
- ryan-c 12y agoAre you using the old RealVNC bug that allows the password to be bypassed by ignoring what authentication methods the server advertises and using "none", or only hitting stuff that actually says it supports connecting without a password?
- srsly-0001 12y agoThe latter. We didn't know about that bug until now, but we'll probably keep it this way so connections work with any VNC client people might have lying around.
- ryan-c 12y agoI thought you could possibly be exploiting the bug unintentionally - a hacked together client that just attempts to connect with null auth would do it. Not sure how common that vuln is.