Network Security Tools

Probing for VNC Servers

Virtual Network Computing (VNC) software allows you to remotely control another host via the network. For example, if you are running the server component of VNC on a Windows XP machine, you can access the desktop of the machine remotely from a Linux host running a VNC client. For more information about VNC, visit http://www.realvnc.com/.

The VNC server runs on port 5901 by default. If port 5901 is not available, the server attempts to bind to the next consecutive port, and so on. When the client connects to the VNC server, the server will first output a banner string beginning with RFB. To test this, use the telnet client to connect directly to the TCP port being used by the VNC server:

[bash]$ telnet 192.168.1.1 5901
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
RFB 003.007

The vnc.nasl plug-in aims to detect VNC servers on the remote host:

# # This script was written by Patrick Naubert # This is version 2.0 of this script. # # Modified by Georges Dagousset <[e-mail]> : # - warning with the version # - detection of other version # - default port for single test # # See the Nessus Scripts License for details # if(description) { script_id(10342); script_version ("$Revision: 1.2 $"); # script_cve_id("CVE-MAP-NOMATCH"); name["english"] = "Check for VNC"; name["francais"] = "Check for VNC"; script_name(english:name["english"], francais:name["francais"]); desc["english"] = " The remote server is running VNC. VNC ...