(Damn Vulnerable Windows XP: Lesson 5)

{ How to setup the UltraVNC 1.0.2 }

Section 0. Background Information

What is Damn Vulnerable Windows XP?
- This is a Windows XP Virtual Machine that provides a practice environment to conduct ethical penetration testing, vulnerability assessment, exploitation and forensics investigation.
- The Microsoft Software License Terms for the IE VMs are included in the release notes.
- By downloading and using this software, you agree to these license terms.
What is the UltraVNC?
- UltraVNC (sometimes written uVNC) is an open source remote administration utility for Microsoft Windows that uses the VNC protocol to control another computer remotely over a network connection.
- http://www.uvnc.com/products/uvnc-server.html
What is the UltraVNC 1.0.2 Remote Exploit?
- The CVE Vulnerability number is CVE-2008-0610.
- Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for UltraVNC 1.0.2 and 1.0.4 before 01252008, when in LISTENING mode or when using the DSM plugin, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a modified size value.
Implementing the CVE-2011-0609 with UltraVNC
- The following lesson will show you how to configure UltraVNC.
- The Post-Requisite Lesson will show you how to illustrate the exploit.
Pre-Requisite
- Damn Vulnerable Windows XP: Lesson 1: How to create a Damn Vulnerable Windows XP Machine
Post-Requisite
- Metasploit: Lesson 15: Illustrate the UltraVNC 1.0.2 Remote Exploit
Lab Notes
- In this lab we will do the following:
  1. Download UltraVNC 1.0.2
  2. Install UltraVNC 1.0.2
Legal Disclaimer
- As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
- In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
- In addition, this is a teaching website that does not condone malicious behavior of any kind.
- You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
- © 2015 No content replication of any kind is allowed without express written permission.

Section 1: Log into Damn Vulnerable WXP-SP2

Open VMware Player on your windows machine.
- Instructions:
  1. Click the Start Button
  2. Type "vmware player" in the search box
  3. Click on VMware Player
Edit Virtual Machine Settings
- Instructions:
  1. Click on Damn Vulnerable WXP-SP2
  2. Edit Virtual Machine Settings
- Note:
  - Before beginning a lesson it is necessary to check the following VM settings.
Set Network Adapter
- Instructions:
  1. Click on Network Adapter
  2. Click on the radio button "Bridged: Connected directly to the physical network".
  3. Click the OK Button
Start Up Damn Vulnerable WXP-SP2.
- Instructions:
  1. Start Up your VMware Player
  2. Play virtual machine
Logging into Damn Vulnerable WXP-SP2.
- Instructions:
  1. Click on Administrator
  2. Password: Supply Password
    - (See Note)
  3. Press <Enter> or Click the Arrow
- Note(FYI):
  1. Password was created in (Lab 1, Section 1, Step 8)
Open the Command Prompt
- Instructions:
  1. Click the Start Button
  2. All Programs --> Accessories --> Command Prompt
Obtain Damn Vulnerable WXP-SP2's IP Address
- Instructions:
  1. ipconfig
  2. Record Your IP Address
- Note(FYI):
  - In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.1.116.
  - This is the IP Address of the Victim Machine.

Section 2: Install UltraVNC 102

Open Firefox
- Instructions:
  1. Click the Start Button
  2. All Programs --> Mozilla Firefox
Download UltraVNC 102 (Part 1)
- Instructions:
  1. Navigate to the following URL
    - https://www.exploit-db.com/apps/d22cf28dda2896149e57542f8b7f015b-UltraVNC-102-Setup.exe
  2. Click the Save File Radio Button
Download UltraVNC 102 (Part 2)
- Instructions:
  1. Navigate to Desktop --> My Documents --> Downloads
  2. Click the Save Button
Open Download Folder
- Instructions:
  1. Tools --> Downloads
  2. Right Click on UltraVNC-102-Setup.exe
  3. Click on Open Containing Folder
Open UltraVNC-102-Setup.exe
- Instructions:
  1. Right Click on *UltraVNC-102-Setup.exe
  2. Click Open
Open File - Security Warning
- Instructions:
  1. Click the Run Button
Setup Language
- Instructions:
  1. Select English
  2. Click the OK Button
Setup - UltraVNC
- Instructions:
  1. Click the Next Button
Setup - UltraVNC (License Agreement)
- Instructions:
  1. Click the I accept the agreement radio button
  2. Click the Next Button
Setup - UltraVNC (Information)
- Instructions:
  1. Click the Next Button
Setup - UltraVNC (Select Destination Location)
- Instructions:
  1. Take the default location
    - C:\Program Files\UltraVNC
  2. Click the Next Button
Setup - UltraVNC (Select Components)
- Instructions:
  1. Select Full installation
  2. Make sure all boxes are checked
  3. Click the Next Button
Setup - UltraVNC (Select Start Menu Folder)
- Instructions:
  1. Take the Default
    - UltraVNC
  2. Click the Next Button
Setup - UltraVNC (Select Additional Tasks)
- Instructions:
  1. Make sure all boxes are unchecked
  2. Click the Next Button
Setup - UltraVNC (Select Additional Tasks)
- Instructions:
  1. Click the Install Button
Setup - UltraVNC (Information)
- Instructions:
  1. Click the Next Button
Setup - UltraVNC (Finish)
- Instructions:
  1. Click the Finish Button

Section 3: Proof of Lab

Open the Command Prompt
- Instructions:
  1. Click the Start Button
  2. All Programs --> Accessories --> Command Prompt
Proof of Lab
- Instructions:
  1. dir "C:\Program Files" | find /i "ultravnc"
  2. date /t
  3. echo "Your Name"
    - Put in your actual name in place of "Your Name"
    - e.g., echo "John Gray"
- Proof of Lab Instructions
  1. Press the <Ctrl> and <Alt> key at the same time.
  2. Press the <PrtScn> key.
  3. Paste into a word document
  4. Upload to Moodle