VNC Credential Capture

Beelzebub’s maintained VNC service models the RFB 3.8 authentication handshake. It uses fixed-size framing, transitions between handshake phases, generates a fresh 16-byte challenge, and enables the built-in vnc wire plugin to correlate the client’s encrypted response on the same connection.

Install the Service

Download the example or use the maintained configurations/services/tcp-5900-vnc.yaml file from the repository.

apiVersion: "v1"
protocol: "tcp"
address: ":5900"
description: "VNC Server (RFB Protocol) with VNC Authentication credential capture"
wireEncoding: "latin1"
banner: "RFB 003.008"
framing:
  mode: "fixed"
  fixedSize: 12
wirePlugins:
  - "vnc"
commands:
  - regex: "^RFB 003\\.008\\n$"
    handler: "\x01\x02"
    name: "vnc_security_types"
    nextFraming:
      mode: "fixed"
      fixedSize: 1
  - regex: "(?s)^.{16}$"
    handler: "\x00\x00\x00\x01\x00\x00\x00\x15Authentication failed"
    name: "vnc_auth_response"
    closeAfter: true
  - regex: "(?s)^\\x02$"
    handler: "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    name: "vnc_challenge"
    patches:
      - type: "random"
        offset: 0
        length: 16
    nextFraming:
      mode: "fixed"
      fixedSize: 16
deadlineTimeoutSeconds: 30
serverName: "VNC-LAB-01"

Place the file in the configured services directory and validate before starting the runtime:

beelzebub validate \
  --conf-core ./configurations/beelzebub.yaml \
  --conf-services ./configurations/services/
beelzebub run

Expose port 5900 only inside an authorized test network. If another VNC server already uses that port, change address and connect the client to the selected lab port.

Follow the Handshake

1. Beelzebub sends the RFB 003.008 banner and reads the client’s 12-byte protocol version.
2. vnc_security_types offers VNC Authentication and changes framing to a one-byte security selection.
3. vnc_challenge responds to security type 2, fills a 16-byte handler with cryptographically random bytes, and changes framing to a 16-byte response.
4. The built-in wire plugin retains that challenge by connection ID.
5. vnc_auth_response receives the client response, emits a protocol-correct authentication failure, records correlated metadata, and closes the connection.

The command order is deliberate. The broad 16-byte response expression must remain after any more specific 16-byte handshake messages you add.

Inspect the Event

After a complete attempt, the interaction event includes:

If the connection closes before the response arrives, WireSessionCloser removes the retained challenge and no correlated authentication metadata is produced.

Verify Without Real Credentials

Use a disposable VNC client and a synthetic password created only for this test. Confirm that the client reaches the authentication prompt, receives an authentication failure, and produces one correlated interaction event. Then verify that the event is handled according to your data-retention and access-control policy.

For the underlying framing and plugin contracts, read the binary TCP framework.