.

VNC Password Sniffing

<<

hades_a

User avatar

Newbie
Newbie

Posts: 22

Joined: Wed Jun 14, 2006 10:38 am

Post Tue Sep 15, 2009 10:42 pm

VNC Password Sniffing

Hi All,

I need some advice please.

I have conducted a vulnerability assessment on a client's external network and have discovered an open VNC port (both client and web) which one can conect to from any IP on the Internet.

I know that the vulnerability related to VNC is that you can sniff the credentials as they are by default sent in open text (the client is not tunnelling this through SSH).

As far as I know, to sniff the password you would need to either have access to a router between two connections or else interpose yourself in a 'man-in -the-middle'. You would also be able to sniff the traffic if you were plugged into a hub (or switch with promiscuity set accordingly) with either of the end points.

Taking these scenarios into account it would be a highly unlikely that the password could be sniffed if these vectors were suitably protected. Am I missing something here which makes the risk of password sniffing very likely of occuring?

The client does not need to comply to SOX so I cannot use that as leverage in getting him to close this down. I can only plead to his common sense.

Any advice or insight would be much appreciated.

Thanks

Chris
MCSE 2003:Security, Security+, MCITP:EA
<<

Jhaddix

User avatar

Sr. Member
Sr. Member

Posts: 317

Joined: Wed Oct 29, 2008 10:25 pm

Post Wed Sep 16, 2009 3:38 am

Re: VNC Password Sniffing

In reporting voice your finding and give them a link to audit their VNC passwords,
among others you can use an oldie but goodie:

VNCPwdump

VNCPwdump can be used to dump and decrypt the registry key containing the encrypted VNC password in a few different ways.

It supports dumping and decrypting the password by:
- Dumping the current users registry key
- Retrieving it from a NTUSER.DAT file
- Decrypting a command line supplied encrypted password
- Injecting the VNC process and dumping the owners password

CHANGES 1.0.5
- Support for RealVNC 4
- Command line encryption of plaintext password
- Set service and user passwords

CHANGES 1.0.6
- Minor bugfixes
- Support for Windows NT 4
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Wed Sep 16, 2009 7:24 am

Re: VNC Password Sniffing

I've always believe that security is as strong as your weakest link.  How is the physical security?  What about wireless?  If either of those are lacking, it's an entry point to the LAN and you can then sniff whatever you want.  There could be unsecured machines on the LAN that an attacker can compromise and use to sniff passwords.  There are often HVAC, Voice Mail, Key Card Access control machines running very unsecured versions of Windows that are very easily compromised.  When you are explaining your findings, you can try to paint a picture where your VNC issue is just one of the steps on a footpath to a compromised network.

I also usually mention some of the historical vulnerabilities that have existed in VNC, like the authentication bypass one.  I have found that this is pretty good leverage.

Jason, I hadn't seen that tool before.  Thanks!
~~~~~~~~~~~~~~
Ketchup
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Wed Sep 16, 2009 7:37 am

Re: VNC Password Sniffing

Yes, thanks for the information of that tool.  I haven't seen it either.  Very good advice from the previous two posters.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

hades_a

User avatar

Newbie
Newbie

Posts: 22

Joined: Wed Jun 14, 2006 10:38 am

Post Thu Sep 17, 2009 12:33 am

Re: VNC Password Sniffing

Thank you for the advice.

Much appreciated!
MCSE 2003:Security, Security+, MCITP:EA
<<

SynJunkie

Jr. Member
Jr. Member

Posts: 71

Joined: Thu Apr 17, 2008 2:41 pm

Location: UK

Post Sat Sep 19, 2009 4:47 am

Re: VNC Password Sniffing

Cain is also an excellent tool for compromising VNC.

It can either pull the passwords from the registry:

http://www.wonderhowto.com/how-to/video ... in-160725/



Or sniff them off the wire and bruteforce them:

http://www.youtube.com/watch?v=-8SOVQXD3mg

Hope this helps.

Syn
----------------------------------
http://synjunkie.blogspot.com

Return to Network Pen Testing

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software