Skip to content
HackIndex.io
VNC
Service

VNC

VNC remote desktop protocol testing covering auth probing, version fingerprinting, brute force, session hijacking, hash decryption, and post-access lateral movement and persistence via reverse callbacks

:5900 :5901 :5902 :5903 10 guides 3 phases
1 min read Created: Dec 28, 2025 Updated: Jul 14, 2026

VNC (Virtual Network Computing) provides graphical remote desktop access and typically runs on TCP port 5900 and above (display :0 = 5900, :1 = 5901, etc.). Nmap identifies it as vnc. Common implementations include TightVNC, RealVNC, TigerVNC, and UltraVNC.

VNC authentication often relies on a single shared password rather than per-user credentials. Many installations use weak or default passwords, and some are configured with no authentication at all. VNC traffic is unencrypted by default, making it possible to intercept session data on a shared network. The VNC authentication challenge-response can also be captured and cracked offline.

Use nmap --script vnc-info to check the VNC version and authentication requirements. Test for no-auth access with vncviewer. Brute-force the password with hydra or crowbar. If the encrypted password file is accessible (often ~/.vnc/passwd), it uses a known fixed DES key and can be decrypted directly.

Enumeration

VNC discovery, auth probing, version fingerprinting, default creds

3

Exploitation

Brute force, bypass auth, hijack sessions, and decrypt VNC hashes

6
VNC Password Hash Extraction and Decryption

VNC Password Hash Extraction and Decryption

Covers extracting stored VNC password hashes from registry/config files and decrypting them using DES-based algorithms to recover plaintext credentials during exploitation.

Mar 12, 2026 • 2 min read

Persistence

Guides on maintaining access via reverse VNC callbacks

1