How to extract a hash (VNC, SSH2 or SMB) from a WireShark capture file

[SopalajoArrierez]

Which version of Ettercap are you using?

This is my version:
ettercap 0.7.4.1 copyright 2001-2011 ALoR & NaGA

Parsing VNC packets is supported by Ettercap (I fixed the VNC dissector some time back but I might have missed something).

Mmm... I am capturing a connection to VNC4Server at Ubuntu and EtterCap yields many data, but not the password.

Can you share some .pcap files?

Here you have:

https://docs.google.com/file/d/0Bzu9KpPO...sp=sharing

it is an ettercap capture:

Code:

sudo ettercap -T -w dump.cap /192.168.11.113/ // output: -l logfile.eci -i eth1

Chomsky (computer one with IP 192.168.11.113 running Windows XP, RealVNC Viewer) connects to ThreepWood (computer two running Ubuntu 12.04, VNC4Server) using password "12345678". Real VNCViewer tells there is no encryption in this connection.
This is the output of EtterLog:

Code:

luis@ThreepWood:~/Temporal/Ettercap$ sudo etterlog Chomsky-ThreepWood-VNC-NoEncryption.eci

etterlog NG-0.7.4.2 copyright 2001-2005 ALoR & NaGA

Log file version    : NG-0.7.4.2
Timestamp           : Wed Mar 20 20:35:20 2013
Type                : LOG_INFO

1766 tcp OS fingerprint
7587 mac vendor fingerprint
2183 known services


==================================================
IP address   : 192.168.11.110

MAC address  : 00:1D:60:13:DF:CB
MANUFACTURER :

DISTANCE     : 0
TYPE         : LAN host

FINGERPRINT      : 3908:05B4:40:06:1:1:1:0:A:34
OPERATING SYSTEM : unknown fingerprint (please submit it)
NEAREST ONE IS   : Windows 98 SE

   PORT     : TCP 5901 | vnc-1  [RFB 003.008]


==================================================

==================================================
IP address   : 192.168.11.113

MAC address  : 00:23:54:7F:F2:4F
MANUFACTURER :

DISTANCE     : 1
TYPE         : LAN host

FINGERPRINT      : FFFF:05B4:80:02:1:1:1:0:S:34
OPERATING SYSTEM : unknown fingerprint (please submit it)
NEAREST ONE IS   : Windows 2000


==================================================

As you can see, there is no password guessed at all.

Thanks a lot for your kindly help.