# VNC

> VNC remote desktop protocol testing covering auth probing, version fingerprinting, brute force, session hijacking, hash decryption, and post-access lateral movement and persistence via reverse callbacks

- **URL:** https://hackindex.io/services/vnc
- **Type:** Service
- **Default ports:** 5900, 5901, 5902, 5903
- **Tags:** vnc, remote-desktop, graphical, network, authentication, windows
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

VNC (Virtual Network Computing) provides graphical remote desktop access and typically runs on **TCP port 5900** and above (display :0 = 5900, :1 = 5901, etc.). Nmap identifies it as `vnc`. Common implementations include TightVNC, RealVNC, TigerVNC, and UltraVNC.

VNC authentication often relies on a single shared password rather than per-user credentials. Many installations use weak or default passwords, and some are configured with no authentication at all. VNC traffic is unencrypted by default, making it possible to intercept session data on a shared network. The VNC authentication challenge-response can also be captured and cracked offline.

Use `nmap --script vnc-info` to check the VNC version and authentication requirements. Test for no-auth access with `vncviewer`. Brute-force the password with `hydra` or `crowbar`. If the encrypted password file is accessible (often `~/.vnc/passwd`), it uses a known fixed DES key and can be decrypted directly.

## Phases

- [Enumeration](https://hackindex.io/services/vnc/enumeration.md): VNC discovery, auth probing, version fingerprinting, default creds (3 guides)
- [Exploitation](https://hackindex.io/services/vnc/exploitation.md): Brute force, bypass auth, hijack sessions, and decrypt VNC hashes (6 guides)
- [Persistence](https://hackindex.io/services/vnc/persistence.md): Guides on maintaining access via reverse VNC callbacks (1 guides)