{"id":1646,"date":"2023-09-15T12:41:39","date_gmt":"2023-09-15T12:41:39","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=1646"},"modified":"2023-09-15T15:51:06","modified_gmt":"2023-09-15T15:51:06","slug":"1646","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/1646\/","title":{"rendered":"TightVNC Security Hole"},"content":{"rendered":"

Virtual Network Computing<\/span><\/strong>\u00a0(<\/span>VNC<\/span><\/strong>) is a graphical desktop-sharing system that uses the\u00a0<\/span>Remote Frame Buffer protocol (RFB)<\/span><\/a>\u00a0to remotely control another\u00a0<\/span>computer<\/span><\/a>. It transmits the\u00a0<\/span>keyboard<\/span><\/a>\u00a0and\u00a0<\/span>mouse<\/span><\/a>\u00a0input from one computer to another, relaying the graphical-<\/span>screen<\/span><\/a>\u00a0updates, over a\u00a0<\/span>network<\/span><\/a>.<\/span>[1]<\/sup><\/span><\/a><\/p>\n

VNC servers work on a variety of platforms, allowing you to share screens and keyboards between Windows, Mac, Linux, and Raspberry Pi devices<\/span>. RDP server is proprietary and only works with one operating system. VNC vs RDP performance. RDP provides a better and faster remote connection.<\/span><\/p>\n

There are a number of reasons why people use it.<\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>RDP requires licenses and VNC does not.<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>You can also have multiple sessions on a user<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>You can set it so it will connect to an existing session (which is what a lot folks use it for)<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>It can be used on multiple OS\u2019s including linux; while RDP is just for windows<\/div>\n<\/div>\n<\/div>\n

There are a few VNC tools out there.<\/p>\n

RealVNC<\/span> <\/strong><\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>They have enterprise version<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Requires Licenses<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Has no AD authentication<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Has decent Encryption<\/div>\n<\/div>\n<\/div>\n

UltraVNC<\/span> \u2013 Best one to use.<\/span><\/strong><\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>Has AD authentication<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Has good Encryption<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>AD authentication<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>File transfer inside the VNC connection<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Multiuser connections and Existing<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Loads of features the others don\u2019t have<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Is considered the most secure<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Free for personal and commercial use<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Available through chocolatey package manager<\/div>\n<\/div>\n<\/div>\n

Tight-VNC<\/span> \u2013 Security Hole <\/span><\/strong><\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>Free<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Has encryption but its DES with an 8 character limit<\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>Available through chocolatey package manager<\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

Tight-VNC has their encryption algorithm hardcoded into its software and appears they have NOT<\/strong> updated its encryption standards in years.<\/strong><\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

DES Encryption<\/span> used<\/span><\/p>\n

# This is hardcoded in VNC applications like <\/span>TightVNC<\/span>.<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>magicKey<\/span> =<\/span> [<\/span>byte<\/span>[<\/span>]]<\/span>@<\/span>(<\/span>0xE8<\/span>,<\/span> 0x4A<\/span>,<\/span> 0xD6<\/span>,<\/span> 0x60<\/span>,<\/span> 0xC4<\/span>,<\/span> 0x72<\/span>,<\/span> 0x1A<\/span>,<\/span> 0xE0<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>ansi<\/span> =<\/span> [<\/span>System.Text.Encoding<\/span>]::<\/span>GetEncoding<\/span>(<\/span><\/p>\n

\u00a0 \u00a0 \u00a0 \u00a0 [<\/span>System.Globalization.CultureInfo<\/span>]::CurrentCulture.TextInfo.ANSICodePage)<\/span><\/p>\n

.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$pass<\/span> =<\/span> [<\/span>System.Net.NetworkCredential<\/span>]::<\/span>new(<\/span>”<\/span>,<\/span> $Password<\/span>).Password \u00a0 \u00a0<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>byteCount<\/span> =<\/span> $<\/span>ansi<\/span>.GetByteCount<\/span>(<\/span>$pass<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>if<\/span> (<\/span>$<\/span>byteCount<\/span> –<\/span>gt<\/span> 8<\/span>) {<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$err<\/span> =<\/span> [<\/span>System.Management.Automation.ErrorRecord<\/span>]::new(<\/span><\/p>\n

\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 [<\/span>ArgumentException<\/span>]<\/span>‘Password must not exceed 8 characters’<\/span>,<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>‘<\/span>PasswordTooLong<\/span>‘<\/span>,<\/span><\/p>\n

\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 [<\/span>System.Management.Automation.ErrorCategory<\/span>]::<\/span>InvalidArgument<\/span>,<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$null<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>PSCmdlet<\/span>.WriteError<\/span>(<\/span>$err<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>return<\/span><\/p>\n

\u00a0 \u00a0 }<\/span><\/p>\n

.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>toEncrypt<\/span> =<\/span> [<\/span>byte<\/span>[]]::<\/span>new(<\/span>8<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$null<\/span> =<\/span> $<\/span>ansi<\/span>.GetBytes<\/span>(<\/span>$pass<\/span>,<\/span> 0<\/span>,<\/span> $<\/span>pass<\/span>.Length<\/span>,<\/span> $<\/span>toEncrypt<\/span>,<\/span> 0<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>$des<\/span> =<\/span> $encryptor<\/span> =<\/span> $null<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>try<\/span> {<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$des<\/span> =<\/span> [<\/span>System.Security.Cryptography.DES<\/span>]::<\/span>Create()<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>des<\/span>.Padding<\/span> =<\/span> ‘None’<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$encryptor<\/span> =<\/span> $<\/span>des<\/span>.CreateEncryptor<\/span>(<\/span>$<\/span>magicKey<\/span>,<\/span> [<\/span>byte<\/span>[]]::new(<\/span>8<\/span>))<\/span><\/p>\n

.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$data<\/span> =<\/span> [<\/span>byte<\/span>[]]::<\/span>new(<\/span>8<\/span>)<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$null<\/span> =<\/span> $<\/span>encryptor<\/span>.TransformBlock<\/span>(<\/span>$<\/span>toEncrypt<\/span>,<\/span> 0<\/span>,<\/span> $<\/span>toEncrypt<\/span>.Length<\/span>,<\/span> $data<\/span>,<\/span> 0<\/span>)<\/span><\/p>\n

.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>,<\/span> $data<\/span><\/p>\n

\u00a0 \u00a0 }<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>finally<\/span> {<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>if<\/span> (<\/span>$encryptor<\/span>) <\/span>{ <\/span>$<\/span>encryptor<\/span>.Dispose<\/span>() }<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>if<\/span> (<\/span>$des<\/span>) <\/span>{ <\/span>$<\/span>des<\/span>.Dispose<\/span>() }<\/span><\/p>\n

\u00a0 \u00a0 }<\/span><\/p>\n

}<\/span><\/p>\n

.<\/span><\/span><\/p>\n

What this means is…IF you are using admin credentials on your machine while using Tight-VNC a hacker<\/strong> that is way better than I… Could gain access to your infrastructure by simply glimpsing the windows registry. Im sure there ways to exploit it.<\/p>\n

I will demonstrate:<\/p>\n

Now you can install Tight-vnc manually or via chocolatey. I used chocolatey and this from a public available repo.<\/strong><\/p>\n

.<\/span><\/span><\/p>\n

<\/p>\n

.<\/span><\/span><\/p>\n

Now lets set the password by right clicking tightvnc<\/strong> icon in the bottom corner and setting the password to an 8 character password, by clicking on change primary password and typing in whatever you like<\/p>\n

\u2018Suck3r00\u2019<\/strong><\/p>\n

.<\/span><\/span><\/p>\n

\"A<\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

Now lets open powershell<\/span> without administrator privileges.<\/strong> Lets say I got in remotely<\/span> <\/strong>and chocolatey is there and I want to check to see if tight-vnc is there.<\/p>\n

.<\/span><\/span><\/p>\n

\"A<\/p>\n

.<\/span><\/span><\/p>\n

As you can see I find this without administrator privilege.<\/strong><\/p>\n

.<\/span><\/span><\/p>\n

Now lets say I was able to view the registry and get the encrypted value for tight-vnc; all I need to do is see for a few seconds.<\/p>\n

<\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

Now there are tools online where you can convert that hexadecimal to binary decimal values<\/strong> long before AI<\/strong> was around. But since I love GPT im going to ask it to convert that for me<\/p>\n

.<\/span><\/span><\/p>\n

<\/p>\n

.<\/span><\/span><\/p>\n

I have script that didn\u2019t take long to put together from digging around for about an hour online. Which im obviously not going to share, BUT if I can do it\u2026\u2026someone with skills could do pretty easy. A professional hacker NO SWEAT.<\/strong><\/p>\n

\"A<\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span>As you can see if you have rolled this out how dangerous it is.<\/p>\n

Having said that I have also written<\/strong> an Ansible Role<\/strong> which will purge tightvnc<\/strong> from your infrastructure and deploy ultravnc<\/strong> which will use encryption and AD authentication. Which the other two currently do NOT do.<\/p>\n

.<\/span><\/span><\/p>\n

Hope you enjoyed getting P0WNed<\/strong>.<\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Virtual Network Computing\u00a0(VNC) is a graphical desktop-sharing system that uses the\u00a0Remote Frame Buffer protocol (RFB)\u00a0to remotely control another\u00a0computer. It transmits the\u00a0keyboard\u00a0and\u00a0mouse\u00a0input from one computer to another, relaying the graphical-screen\u00a0updates, over a\u00a0network.[1] VNC servers work on a variety of platforms, allowing you to share screens and keyboards between Windows, Mac, Linux, and Raspberry Pi devices. RDP server is proprietary and onlyRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[131,137],"tags":[],"class_list":["post-1646","post","type-post","status-publish","format-standard","hentry","category-security","category-windows"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=1646"}],"version-history":[{"count":11,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1646\/revisions"}],"predecessor-version":[{"id":1668,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1646\/revisions\/1668"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=1646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=1646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=1646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}