rabbithole_vnc.py

"""
Fill in ACCESS_TOKEN with your own value. Grab it from dev tools, watching the request to wss://hole.rabbit.tech/loginSession

Then you can connect a regular VNC client to localhost:5969 (it will take a few seconds to connect)
"""

import aiohttp
import asyncio

ACCESS_TOKEN = "blah"
VNC_PORT = 5969

async def get_vnc_url(session: aiohttp.ClientSession):
	ws = await session.ws_connect("wss://hole.rabbit.tech/loginSession?appId=uber")
	print("[*] loginSession wss connected")
	await ws.send_json({"init": {
		"accessToken": ACCESS_TOKEN,
		"viewportConfig": {
			"viewportWidth": 1512,
			"viewportHeight": 586
		}
	}})
	res = await ws.receive_json()
	print(res)
	return ws, res["webReady"]["noVncUrl"]

async def ws_to_tcp(ws: aiohttp.ClientWebSocketResponse, tcp_writer: asyncio.StreamWriter):
	while True:
		try:
			data = await ws.receive_bytes()
		except TypeError as e:
			raise EOFError(f"ws receive error ({e})")
		#print(f"[*] ws  -> tcp: {len(msg.data)} bytes")
		tcp_writer.write(data)
		await tcp_writer.drain()

async def tcp_to_ws(tcp_reader: asyncio.StreamReader, ws: aiohttp.ClientWebSocketResponse):
	while not tcp_reader.at_eof():
		data = await tcp_reader.read(1024)
		#print(f"[*] tcp -> ws : {len(data)} bytes")
		await ws.send_bytes(data)
	raise EOFError("tcp reader eof")

async def ws_forwarder(tcp_reader: asyncio.StreamReader, tcp_writer: asyncio.StreamWriter):
	peername = tcp_writer.get_extra_info("peername")
	print(f"[+] Accepted TCP connection from {peername}")
	async with aiohttp.ClientSession() as session:
		ws_inner, vnc_wss = await get_vnc_url(session)
		async with session.ws_connect(vnc_wss) as ws:
			print(f"[+] WS connection opened. Forwarding from {peername} to {vnc_wss}")
			try:
				await asyncio.gather(
					ws_to_tcp(ws, tcp_writer),
					tcp_to_ws(tcp_reader, ws)
				)
			except Exception as e:
				print(e)
				print("[*] Closing connection.")
		await ws_inner.close()
	tcp_writer.close()
	await tcp_writer.wait_closed()

async def main():
	server = await asyncio.start_server(ws_forwarder, "127.0.0.1", VNC_PORT)

	addrs = ", ".join(str(sock.getsockname()) for sock in server.sockets)
	print(f"[+] Serving on {addrs}")

	async with server:
		await server.serve_forever()

asyncio.run(main())