Browser-in-the-Middle (noVNC)

A Browser-in-the-Middle (BitM) attack involving noVNC leverages the fact that noVNC (or similar types of remote browser solutions) allows remote desktop access through a web browser.

To keep it simple, here are the steps in this type of attack:

1. Adversary preconfigures their noVNC server to have a browser opened and navigated to the desired login portal (e.g. login.microsoftonline.com)

2. Adversary provides the victim with a link to the adversary-controlled noVNC server (though phishing for example)

3. Victim visits the link using their browser to access the adversary-controlled remote desktop and authenticates to the legitimate login portal shown in the browser in the noVNC session.

4. Adversary captures session cookies stored within the browser in the noVNC session once the victim completes the authentication process.

5. Adversary hijacks the victim's access to the noVNC session by removing the victim's access to the noVNC session, allowing the adversary to gain access to the victim's authenticated session.

These noVNC MFA bypass-type attacks allow an adversary to bypass Multi-Factor Authentication protecting user accounts as the victim goes through the full authentication flow within the adversary's remote browser.

https://link.springer.com/article/10.1007/s10207-021-00548-5link.springer.com

Security Research | mr.d0xmrd0x.com

EvilnoVNC

EvilnoVNC is a tool that will set up the required infrastructure within Docker containers to simplify the process of deploying noVNC MFA bypass attacks.

The setup can be found on the EvilnoVNC Github page and is pretty easy to follow. However, do note that the default setup only allows for one noVNC session which means only one victim at a time (we don't want two victims trying to interact with the same remote session).

From my experience, if you run into any issues starting the noVNC server (on port 80 by default), start with the start.sh script for debugging as the output for many of the commands within that script are sent to /dev/null.

GitHub - JoelGMSec/EvilnoVNC: Ready to go Phishing PlatformGitHub

CuddlePhish

CuddlePhish is a tool that allows you to serve noVNC MFA bypass attacks to multiple users at once. It also has built-in functionality to request SSL/TLS certificates and serve the noVNC session(s) on a custom domain.

The README on the CuddlePhish Github page does a good job covering installation and usage of the tool. This is definitely more involved compared to EvilnoVNC but definitely has some extra perks that come with it!

GitHub - fkasler/cuddlephish: Weaponized Browser-in-the-Middle (BitM) for Penetration TestersGitHub