VNC Password Sniffing

[hades_a]

Hi All,

I need some advice please.

I have conducted a vulnerability assessment on a client’s external network and have discovered an open VNC port (both client and web) which one can conect to from any IP on the Internet.

I know that the vulnerability related to VNC is that you can sniff the credentials as they are by default sent in open text (the client is not tunnelling this through SSH).

As far as I know, to sniff the password you would need to either have access to a router between two connections or else interpose yourself in a ‘man-in -the-middle’. You would also be able to sniff the traffic if you were plugged into a hub (or switch with promiscuity set accordingly) with either of the end points.

Taking these scenarios into account it would be a highly unlikely that the password could be sniffed if these vectors were suitably protected. Am I missing something here which makes the risk of password sniffing very likely of occuring?

The client does not need to comply to SOX so I cannot use that as leverage in getting him to close this down. I can only plead to his common sense.

Any advice or insight would be much appreciated.

Thanks

Chris

[Jhaddix]

In reporting voice your finding and give them a link to audit their VNC passwords,
among others you can use an oldie but goodie:

VNCPwdump

VNCPwdump can be used to dump and decrypt the registry key containing the encrypted VNC password in a few different ways.

It supports dumping and decrypting the password by:
– Dumping the current users registry key
– Retrieving it from a NTUSER.DAT file
– Decrypting a command line supplied encrypted password
– Injecting the VNC process and dumping the owners password

CHANGES 1.0.5
– Support for RealVNC 4
– Command line encryption of plaintext password
– Set service and user passwords

CHANGES 1.0.6
– Minor bugfixes
– Support for Windows NT 4

[Ketchup]

I’ve always believe that security is as strong as your weakest link.  How is the physical security?  What about wireless?  If either of those are lacking, it’s an entry point to the LAN and you can then sniff whatever you want.  There could be unsecured machines on the LAN that an attacker can compromise and use to sniff passwords.  There are often HVAC, Voice Mail, Key Card Access control machines running very unsecured versions of Windows that are very easily compromised.  When you are explaining your findings, you can try to paint a picture where your VNC issue is just one of the steps on a footpath to a compromised network.

I also usually mention some of the historical vulnerabilities that have existed in VNC, like the authentication bypass one.  I have found that this is pretty good leverage.

Jason, I hadn’t seen that tool before.  Thanks!

[Dengar13]

Yes, thanks for the information of that tool.  I haven’t seen it either.  Very good advice from the previous two posters.

[hades_a]

Thank you for the advice.

Much appreciated!

[SynJunkie]

Cain is also an excellent tool for compromising VNC.

It can either pull the passwords from the registry:

http://www.wonderhowto.com/how-to/video/how-to-decode-vnc-passwords-with-cain-160725/

Or sniff them off the wire and bruteforce them:

http://www.youtube.com/watch?v=-8SOVQXD3mg

Hope this helps.

Syn

[Author]

Posts