注册
登录
| 关键词： current nbsp blocked QuadPart vncServer hostname next 时间 blacklist entry |
formytest vnc所有帐号登陆的时候（含(winvnc /ultravnc/realvnc)）： 1.加入ip到一个列表（黑名单），并记录时间，在这个时间上＋10s钟作为下一次连接拒绝时间。 2.登陆次数限制，如果失败超过5次，则加入黑名党，再等10s后才能登陆。 请看下面代码： void vncServer::AddAuthHostsBlacklist(const char *machine) { omni_mutex_lock l(m_clientsLock); // -=- Is the specified host blacklisted? vncServer::BlacklistEntry *current = m_blacklist; // Get the current time as a 64-bit value SYSTEMTIME systime; FILETIME ftime; LARGE_INTEGER now; GetSystemTime(&systime); SystemTimeToFileTime(&systime, &ftime); now.LowPart=ftime.dwLowDateTime;now.HighPart=ftime.dwHighDateTime; now.QuadPart /= 10000000; // Convert it into seconds while (current) { // Is this the entry we're interested in? if (_stricmp(current->_machineName, machine) == 0) { // If the host is already blocked then ignore if (current->_blocked) return; // Set the RefTime & failureCount current->_lastRefTime.QuadPart = now.QuadPart + 10; current->_failureCount++; if (current->_failureCount > 5) current->_blocked = TRUE; 判定函数代码： while (current) { // Has the blacklist entry timed out? if ((now.QuadPart - current->_lastRefTime.QuadPart) > 0) {////当前时间超过隔离时间？即如果10s钟后 // Yes. Is it a "blocked" entry? if (current->_blocked) { // Yes, so unblock it & re-set the reference time current->_blocked = FALSE; ///超过10s，解除黑名单 current->_lastRefTime.QuadPart = now.QuadPart + 10; } else { // No, so remove it if (previous) previous->_next = current->_next; else m_blacklist = current->_next; vncServer::BlacklistEntry *next = current->_next; free(current->_machineName); delete current; current = next; continue; } } // Is this the entry we're interested in? if ((_stricmp(current->_machineName, hostname) == 0) &&/////比较是否再黑名单里面 (current->_blocked)) { // Machine is blocked, so just reject it vnclog.Print(LL_CONNERR, VNCLOG("client %s rejected due to blacklist entry\n"), hostname); return vncServer::aqrReject; } previous = current; current = current->_next; } // Has a hostname been specified? if (hostname == 0) { vnclog.Print(LL_INTWARN, VNCLOG("verify failed - null hostname\n")); return vncServer::aqrReject; } ＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝ 以上原因决定了vnc弱口令扫描的特点： 1.密码最多只能超过5次出错，然后就会被锁定，需要10s钟解锁。 2.出错超过5次后每猜解一个密码，都会被锁定，所以后面的密码猜解非常慢（每一个隔10s）。 最近在研究对： msql/mysql/3389/vnc/oracle弱口令的集成扫描工具开发。 请及时关注我的blog: http://hi.baidu.com/it_security |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
