Hacker News Reader

I may be missing something obvious, but how does it find VNC servers?

We're using zmap to basically scan 0.0.0.0/0 on ports ranging from 5900 to 5910.

Adresses that have at least one of these open then get passed to a Python script that attempts to connect to those machines and take a screenshot.

The web frontend is built using Go httpd by the way.

Edit: We are able to do this because we're at the 31c3 with an enormeously fast internet connection. The machine this is running on has a 1Gbps connection to the internet.

Are you using the old RealVNC bug that allows the password to be bypassed by ignoring what authentication methods the server advertises and using "none", or only hitting stuff that actually says it supports connecting without a password?

The latter. We didn't know about that bug until now, but we'll probably keep it this way so connections work with any VNC client people might have lying around.

I thought you could possibly be exploiting the bug unintentionally - a hacked together client that just attempts to connect with null auth would do it. Not sure how common that vuln is.

masscan https://www.youtube.com/watch?v=UOWexFaRylM

Reply on news.ycombinator.com