metasploit-framework/lib/rex/proto/rfb/client.rb

# -*- coding: binary -*-

##
#
# RFB protocol support
#
# by Joshua J. Drake <jduck>
#
# Based on:
# vnc_auth_none contributed by Matteo Cantoni <goony[at]nothink.org>
# vnc_auth_login contributed by carstein <carstein.sec[at]gmail.com>
#
# TODO: determine how to detect a view-only session.
##

module Rex
module Proto
module RFB

class Client

	def initialize(sock, opts = {})
		@sock = sock
		@opts = opts

		@banner = nil
		@majver = MajorVersion
		@minver = -1
		@auth_types = []
	end

	def read_error_message
		len = @sock.get_once(4)
		return 'Unknown error' if not len or len.length != 4

		len = len.unpack("N").first
		@sock.get_once(len)
	end

	def handshake
		@banner = @sock.get_once(12)
		if not @banner
			@error = "Unable to obtain banner from server"
			return false
		end

		# RFB Protocol Version 3.3 (1998-01)
		# RFB Protocol Version 3.7 (2003-08)
		# RFB Protocol Version 3.8 (2007-06)

		if @banner =~ /RFB ([0-9]{3})\.([0-9]{3})/
			maj = $1.to_i
			if maj != MajorVersion
				@error = "Invalid major version number: #{maj}"
				return false
			end
		else
			@error = "Invalid RFB banner: #{@banner}"
			return false
		end

		@minver = $2.to_i

		our_ver = "RFB %03d.%03d\n" % [MajorVersion, @minver]
		@sock.put(our_ver)

		true
	end

	def connect(password = nil)
		return false if not handshake
		return false if not authenticate(password)
		return false if not send_client_init
		true
	end

	def send_client_init
		if @opts[:exclusive]
			@sock.put("\x00") # do share.
		else
			@sock.put("\x01") # do share.
		end
	end

	def authenticate(password = nil)
		type = negotiate_authentication
		return false if not type

		# Authenticate.
		case type
		when AuthType::None
			# Nothing here.

		when AuthType::VNC
			return false if not negotiate_vnc_auth(password)

		end

		# Handle reading the security result message
		result = @sock.get_once(4)
		if not result
			@error = "Unable to read auth result"
			return false
		end

		result = result.unpack('N').first
		case result
		when 0
			return true

		when 1
			if @minver >= 8
				msg = read_error_message
				@error = "Authentication failed: #{msg}"
			else
				@error = "Authentication failed"
			end
		when 2
			@error = "Too many authentication attempts"
		else
			@error = "Unknown authentication result: #{result}"
		end

		false
	end

	def negotiate_authentication
		# Authentication type negotiation is protocol version specific.
		if @minver < 7
			buf = @sock.get_once(4)
			if not buf
				@error = "Unable to obtain requested authentication method"
				return nil
			end
			@auth_types = buf.unpack('N')
			if not @auth_types or @auth_types.first == 0
				msg = read_error_message
				@error = "No authentication types available: #{msg}"
				return nil
			end
		else
			buf = @sock.get_once(1)
			if not buf
				@error = "Unable to obtain supported authentication method count"
				return nil
			end

			# first byte is number of security types
			num_types = buf.unpack("C").first
			if (num_types == 0)
				msg = read_error_message
				@error = "No authentication types available: #{msg}"
				return nil
			end

			buf = @sock.get_once(num_types)
			if not buf or buf.length != num_types
				@error = "Unable to read authentication types"
				return nil
			end

			@auth_types = buf.unpack("C*")
		end

		if not @auth_types or @auth_types.length < 1
			@error = "No authentication types found"
			return nil
		end

		# Select the one we prefer
		selected = nil
		selected ||= AuthType::None if @opts[:allow_none] and @auth_types.include? AuthType::None
		selected ||= AuthType::VNC if @auth_types.include? AuthType::VNC

		if not selected
			@error = "No supported authentication method found."
			return nil
		end

		# For 3.7 and later, clients must state which security-type to use
		@sock.put([selected].pack('C')) if @minver >= 7

		selected
	end

	def negotiate_vnc_auth(password = nil)
		challenge = @sock.get_once(16)
		if not challenge or challenge.length != 16
			@error = "Unable to obtain VNC challenge"
			return false
		end

		response = Cipher.encrypt(challenge, password)
		@sock.put(response)

		true
	end

	attr_reader :error, :majver, :minver, :auth_types
	attr_reader :view_only
end

end
end
end