[SOLVED] Browser Station - Access via VNC client

[virtualdj]

I've created a new browser with the Browser Station and it works correctly by connecting to it with a normal browser:



Now I would like - if possible - to access to the browser window using a VNC client directly (from a mobile phone actually) but even from my PC with UltraVNC v1.0.5 I'm not able to connect.

Code: Select all

[~] # netstat -ltnp | grep x11vnc
tcp        0      0 127.0.0.1:37820         0.0.0.0:*               LISTEN      2578/x11vnc

[~] # cat /proc/2578/cmdline | xargs -0 echo
x11vnc -localhost -rfbport 37820 -repeat -shared -display :3519 -xkb -forever -ping 5 -rfbauth /.password2

But trying to connect to my NAS IP on port 3519 with a VNC Client doesn't work, it doesn't ask for a password and it's like having nothing listening there, even though netstat says so.
I've tried TCP port 3519, TCP port 9419 (if ":3519" is a display then TCP=5900+3519), TCP port 37820 (netstat listening port)... nothing.

I looked for another thread about Linux Station here but it doesn't seem to apply to Browser Station.

[virtualdj]

OK, I found that

Code: Select all

-localhost

was limiting the connections from 127.0.0.1 only, but this can be bypassed by forwarding the port using SSH.
Now I've to find a proper VNC client because UltraVNC doesn't seem to support the protocol version ("error reading protocol version").

Connecting locally on the QNAP this is what the server replies:

Code: Select all

[~] # telnet localhost 37820
RFB 003.008

but even forwarding 37820 to 5900 with Putty in this way:



... I'm unable to do read the same with the Windows Telnet.

[virtualdj]

UltraVNC v1.0.5:



RealVNC v6.19:



TightVNC v1.3:



No luck

[virtualdj]

The problem was the VNC server that immediately closed the connection when the port was forwarded using SSH.
If instead I "clone" the TCP port directly on the NAS in this way (37820 => 50000):

Code: Select all

[~] # socat TCP-LISTEN:50000,fork TCP:127.0.0.1:37820

... I can then access it on port 50000 using UltraVNC:



The last problem is what password to type. It seems to be encoded into the /.password2 file:

Code: Select all

[~] # system-docker exec -it $(system-docker ps | awk '/browser-station:/ {print $NF}') cat /.password2 | hexdump
0000000 f89a 965e d8e8 2bab
0000008

but I cannot use that password even after decoding it.

[virtualdj]

Aha! Just after posting I tried to enter the docker image shell and I found another file /.password1 there.
It has the password in clear text!!!

So it is possible to extract the password with:

Code: Select all

[~] # system-docker exec -it $(system-docker ps | awk '/browser-station:/ {print $NF}') cat /.password1
BJeWOX89N/g=

And entering BJeWOX89N/g= into UltraVNC connected to QNAP::50000 results in:



SUCCESS (with copy & paste working too)!!!

[OneCD]

Nice work! That's my TIL

[bugmenot4]

Recent Security vulnerabilities in VNC:
viewtopic.php?f=20&t=147845&p=715902#p715902