mirror of
https://github.com/nmap/nmap.git
synced 2025-12-06 04:31:29 +00:00
Check for RealVNC auth bypass even if other auth types are offered
This commit is contained in:
@@ -74,11 +74,21 @@ request in which the client specifies an insecure security type such as
|
||||
socket:send("RFB 003.008\n")
|
||||
status, result = socket:receive_bytes(2)
|
||||
|
||||
if (not status or result ~= "\001\002") then
|
||||
if not status then
|
||||
socket:close()
|
||||
return report:make_output(vuln)
|
||||
end
|
||||
|
||||
local numtypes = result:byte(1)
|
||||
for i=1, numtypes do
|
||||
local sectype = result:byte(i+1)
|
||||
if sectype == 1 then
|
||||
--already supports None auth
|
||||
socket:close()
|
||||
return report:make_output(vuln)
|
||||
end
|
||||
end
|
||||
|
||||
socket:send("\001")
|
||||
status, result = socket:receive_bytes(4)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user