#########################################################################################
# VNC Settings
#########################################################################################

[config]
default_port = 5900
protocol     = tcp
categories   = recon, defaultcreds

#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap VNC scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='vnc-info' --stats-every 10s [IP]


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check most common passwords on VNC
tool        = hydra
# No username in VNC
# Use very short wordlist by default because there is 'blacklisting' scheme with timeout
# after 5 unsuccessful attempt...
# Important: Use 1 thread ! Otherwise it triggers the 'blacklisting' timeout too fast
command_1   = hydra -P "[PASSLIST default="services/vnc/vnc-common-passwords-short.txt"]" -s [PORT] -F -v -V -I -t 1 [IP] vnc
context_1   = { 'auth_status': NO_AUTH }
command_2   = hydra -P "[PASSLIST default="services/vnc/vnc-common-passwords-short.txt"]" -s [PORT] -F -v -V -I -t 1 [IP] vnc
context_2   = { 'auth_status': USER_ONLY }


#########################################################################################
# Bruteforce
#########################################################################################
# Bruteforce attack is disabled (only default creds are kept) because:
# VNC Server has a 'blacklisting' scheme that blocks an IP address after five unsuccessful 
# connection attempts. The IP address is initially blocked for ten seconds, but this doubles 
# for each unsuccessful attempt thereafter. 

# [check_bruteforce-creds]
# name        = bruteforce-creds
# category    = bruteforce
# description = Bruteforce VNC password (slow !)
# # tool        = patator
# # command_1   = python2.7 patator.py vnc_login host=[IP] port=[PORT] password=FILE0 0=[WORDLISTSDIR]/passwords/pass-medium.txt -t 1 -x retry:fgrep!='Authentication failure' --max-retries -1 -x quit:code=0
# tool        = hydra
# # Run bruteforce only if no creds found/known
# command_1   = hydra -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -F -v -V -I [IP] vnc
# context_1   = { 'auth_status': NO_AUTH }
# # If a user is known, bruteforce with this account
# command_2   = hydra -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -F -v -V -I [IP] vnc
# context_2   = { 'auth_status': USER_ONLY }

