VNC的爆破

[qianbenhyu]

package Plugins

import (
	"fmt"
	"github.com/mitchellh/go-vnc"
	"github.com/shadow1ng/fscan/common"
	"net"
	"time"
)

func checkvnc(info *common.HostInfo) (err error) {
	//var connected bool
	Host, Port := info.Host, info.Ports
	addr := fmt.Sprintf("%s:%s", Host, Port)
	_, err = net.DialTimeout("tcp", addr, 3*time.Second)
	if err != nil {
		errlog := fmt.Sprintf("[-] VNC %v:%v %v", info.Host, info.Ports, err)
		common.LogError(errlog)
		//defer conn.Close()
		return err
	}
	
	for _, pass := range common.VNCPasswords {
		config := &vnc.ClientConfig{
			Auth: []vnc.ClientAuth{
				&vnc.PasswordAuth{
					Password: pass,
				},
			},
		}

		addr := fmt.Sprintf("%s:%s", Host, Port)
		conn, err := net.DialTimeout("tcp", addr, 5*time.Second)
		if err != nil {
			continue
		}
		defer conn.Close()

		client, err := vnc.Client(conn, config)
		if err != nil {
			continue
		}
		defer client.Close()

		result := fmt.Sprintf("[+] VNC %v:%v  password: %v", Host, Port, pass)
		common.LogSuccess(result)
		//connected = true
		break // 成功连接后退出循环
	}
	
	return err
}

[qianbenhyu]

我实测有个问题是，vnc在错几次之后就提示too many failures，我觉得可以在config.go定义个VNC的字典，不用爆破太多

[shadow1ng]

师傅用的是哪个docker 测试的嘛

[shadow1ng]

师傅用的是哪个docker 测试的嘛

[qianbenhyu]

师傅用的是哪个docker 测试的嘛

我kali起的一个vnc

1. vncpasswd
2. tightvncserver :1 -geometry 1024x768 -depth 24