- This topic has 5 replies, 5 voices, and was last updated 11 years, 5 months ago by
SynJunkie.
-
AuthorPosts
-
-
September 16, 2009 at 3:42 am #4268
hades_a
ParticipantHi All,
I need some advice please.
I have conducted a vulnerability assessment on a client’s external network and have discovered an open VNC port (both client and web) which one can conect to from any IP on the Internet.
I know that the vulnerability related to VNC is that you can sniff the credentials as they are by default sent in open text (the client is not tunnelling this through SSH).
As far as I know, to sniff the password you would need to either have access to a router between two connections or else interpose yourself in a ‘man-in -the-middle’. You would also be able to sniff the traffic if you were plugged into a hub (or switch with promiscuity set accordingly) with either of the end points.
Taking these scenarios into account it would be a highly unlikely that the password could be sniffed if these vectors were suitably protected. Am I missing something here which makes the risk of password sniffing very likely of occuring?
The client does not need to comply to SOX so I cannot use that as leverage in getting him to close this down. I can only plead to his common sense.
Any advice or insight would be much appreciated.
Thanks
Chris
-
September 16, 2009 at 8:38 am #27083
Jhaddix
ParticipantIn reporting voice your finding and give them a link to audit their VNC passwords,
among others you can use an oldie but goodie:VNCPwdump
VNCPwdump can be used to dump and decrypt the registry key containing the encrypted VNC password in a few different ways.
It supports dumping and decrypting the password by:
– Dumping the current users registry key
– Retrieving it from a NTUSER.DAT file
– Decrypting a command line supplied encrypted password
– Injecting the VNC process and dumping the owners passwordCHANGES 1.0.5
– Support for RealVNC 4
– Command line encryption of plaintext password
– Set service and user passwordsCHANGES 1.0.6
– Minor bugfixes
– Support for Windows NT 4 -
September 16, 2009 at 12:24 pm #27084
Ketchup
ParticipantI’ve always believe that security is as strong as your weakest link. How is the physical security? What about wireless? If either of those are lacking, it’s an entry point to the LAN and you can then sniff whatever you want. There could be unsecured machines on the LAN that an attacker can compromise and use to sniff passwords. There are often HVAC, Voice Mail, Key Card Access control machines running very unsecured versions of Windows that are very easily compromised. When you are explaining your findings, you can try to paint a picture where your VNC issue is just one of the steps on a footpath to a compromised network.
I also usually mention some of the historical vulnerabilities that have existed in VNC, like the authentication bypass one. I have found that this is pretty good leverage.
Jason, I hadn’t seen that tool before. Thanks!
-
September 16, 2009 at 12:37 pm #27085
Dengar13
ParticipantYes, thanks for the information of that tool. I haven’t seen it either. Very good advice from the previous two posters.
-
September 17, 2009 at 5:33 am #27086
hades_a
ParticipantThank you for the advice.
Much appreciated!
-
September 19, 2009 at 9:47 am #27087
SynJunkie
ParticipantCain is also an excellent tool for compromising VNC.
It can either pull the passwords from the registry:
http://www.wonderhowto.com/how-to/video/how-to-decode-vnc-passwords-with-cain-160725/
Or sniff them off the wire and bruteforce them:
http://www.youtube.com/watch?v=-8SOVQXD3mg
Hope this helps.
Syn
-
-
AuthorPosts
- You must be logged in to reply to this topic.