Crack Or Decrypt Vnc Server Encrypted Password

17-08-2021 by

12-18-2019, 03:42 PM
Hello everyone,
We wanted to crack a VNC challenge response using hashcat but could not find a complete guide.
Crack or decrypt vnc server encrypted password windows 10

It is intentionally the case that an unconfigured VNC Server will not accept connections. The configuration scenarios in the following sections should give some guidelines as to what will work best for you. Maximum Security. For maximum security, you should configure the VNC server to use an encrypted connection. Note that the stored password is not encrypted securely - anyone who has access to this file can trivially find out the plain-text password, so vncpasswd always sets appropriate permissions (read and write only by the owner.) However, when accessing a VNC desktop, a challenge-response mechanism is used over the wire making it hard for anyone to. Instant support, then VNC Server (in the form of a disposable app) is downloaded just-in-time to remote computers, and does not need to be installed or licensed. In this document, VNC Server is used to indicate the app in either of these ‘modes’, and in addition to “the computer on which VNC Server runs”.

So we started looking into how the VNC challenge response authentication works and here is what we understood:
- The client initiates a connection with the server.
- The server sends a unique/random 16-bytes challenge to the client.
- The client uses DES to encrypt (one round) the challenge with the input password and sends the response.
- The server receives the response and does the same encryption scheme to compare the results.
- The connection is established if it matches.
For info:
It is also known that DES encryption algorithm can only accept keys of 56 bits, since ASCII uses 7 bits long characters the key can be up to 8 characters long maximum. If it is shorter, it will be padded with zeros. This is making the assumption that the traditional VNC protocol is used with DES (some new VNC client may have modified this..).
The issue is that VNC doesn't use the password given by the user as is but performs a transformation first:
- the bits of each byte of the corresponding ascii value are reversed

Vnc Server Free

Crack or decrypt vnc server encrypted password windows 10
Password : 12345678
Ascii values (HEX) : 31 32 33 34 35 36 37 38
Binary values: 00110001 00110010 00110011 ....
Binary reversed: 10001100 01001100 11001100 ....
Reversed (HEX): 8c 4c cc 2c ac 6c ec 1c

So the actual VNC user password used for encryption is : 8c4ccc2cac6cec1c (12345678 in ASCII)

Crack Or Decrypt Vnc Server Encrypted Password Tool


Crack Or Decrypt Vnc Server Encrypted Password Free

John The Ripper has implemented this in the version 1.9.0 Jumbo-1
In order to crack VNC passwords with hashcat we implemented this transformation with a small bash script to create a modified charset of the ascii characters.

Vnc

Crack or decrypt vnc server encrypted password
toHexVNC(){
for ((i=0;i<${#1};i++));
do
ascii2binrev=`echo '${1:$i:1}' | perl -lpe '$_=unpack'B*',$_' | rev`
binrev2hex+=`printf '%02xn' '$((2#$ascii2binrev))'`
done
echo $binrev2hex
}

We are aware that this code could be optimized by using other conversion method (c.f. C++, comparison table,..).
We can now crack it with hashcat using:
- attack 3 (mask attack)
- type 14000 (DES)
- hash format : <cipher>:<plaintext> (in VNC: <response>:<challenge> and NOT <challenge>:<response>)
--> the response and challenge needs to be truncated to 8bytes length (no need to waste resources on the whole 16 bytes and in any case hashcat accepts only 8 bytes of cipher/plaintext).
- reversed charset and option --hex-charset
note : it might be more interesting to generate a custom reversed charset using the function above as the full DES charset of hashcat uses more than the 95 main ascii characters. See 'VNC_allascii.charset' below.
$ ettercap -Tq -r VNC.cap
ettercap 0.7.5.4 copyright 2001-2013 Ettercap Development Team
...
192.168.11.110-5901:$vnc$*a5d62a6cd58f41abe8785a4485811aac*248d3290ce533f028613f092f25834cf
...
$ cat toCrack.txt
248d3290ce533f02:a5d62a6cd58f41ab
$ cat VNC_allascii.charset (all 95 ascii characters transfomed for VNC)
8646c626a666e6169656d636b676f60e8e4ece2eae6eee1e9e5e8242c222a262e2129252d232b272f20a8a4aca2aaa6aea1a9a5a0c8c4ccc2cac6cec1c9c840224a4547ab4d4fabc7edabadebe5cdc3c7c3474fcf43a449414e46406043e
$ hashcat -a 3 -m 14000 toCrack.txt -1 VNC_allascii.charset ?1?1?1?1?1?1?1?1 --hex-charset
#Returns: 8c4ccc2cac6cec1c

The cracked password will be an HEX value and will need to be reversed again to find the password (in ASCII) with the following function:
toAscii(){
for ((i=0;i<${#1};i+=2));
do
hex2binary=`perl -e 'printf '%08bn', 0x'${1:$i:2}'' | rev`
ascii2binrev+=`echo $hex2binary | perl -lpe '$_=pack'B*',$_'`
done
echo $ascii2binrev
}

Which will give the reversed password: 12345678
Some benchmarks:Vnc viewer
Using 2x NVIDIA Quadro P4000 8GB

Crack Or Decrypt Vnc Server Encrypted Password Download

Crack or decrypt vnc server encrypted password windows 10
8 characters long loweralphanumspace -> max. ~2min
8 characters long mixalphanum -> max. ~2.2hours
8 characters long mixalphanumspace -> max. ~2.5hours
8 characters long allascii -> max. ~3days
Hope you'll find this interesting and useful.
Please feel free to give us feedback, thank you.
A&J
  • This topic has 3 replies, 2 voices, and was last updated 1 year, 10 months ago by .

  • With an unencrypted password, we are able to use VNC to connect to all WYSE devices we use (3010/3010/3040).

    We would like to use an encrypted password.

    These are the instructions from the ConfGen Help screen:

    To use AES encryption you have to do the following steps:
    – Enable AdminMode with Admin Name and Password for AES encryption
    – Boot the ThinOS Thin Client and open AdminMode with these credentials
    – You will now see a new button called “AES Encryption”. Click it.
    – Enter your to-be-encrypted string in this dialog
    – Copy the generated encrypted string and either write it down or paste it in any open remote session
    – You can use this string now for all purposes like, AdminMode, User, Passwords, VNC, 802.1x, etc.

    —

    Can we use the same encrypted password for all WYSE’s? Or, must each WYSE have a different encrypted password?

    Thanks,
    Advantech

    The encrypted string could be the same on all clients, of course.

    CG

  • Posts

Install Remote Desktop For Mac Via Homebrew
Lb Link 802.11 N Driver Download Windows 7

Comments are closed.