Skip to content
HackIndex logo

HackIndex

Manual VNC Connection and Default Creds

2 min read Jan 19, 2026

This is for turning “VNC is open” into an actual desktop view, and quickly confirming whether it’s no-auth, VNC password, or a TLS or vendor auth variant that needs different client settings.

Connect with TigerVNC vncviewer

TigerVNC supports both host:display and host::port. Use ::port when you only know $PORT.

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP::$PORT

If you know the display number instead of a raw port:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:0

Practical behavior:

  • If you immediately land on a desktop, you likely hit None auth.

  • If you get a password prompt, it’s usually VNC Authentication.

  • If it errors with security mismatch, force security types.

Force a compatible security type

When you see errors like “no matching security types”, you’re negotiating the wrong auth scheme. TigerVNC lets you constrain what it attempts via -SecurityTypes.

Try plain VNC auth first:

┌──(kali㉿kali)-[~]
└─$ vncviewer -SecurityTypes VncAuth $TARGET_IP::$PORT

If you suspect it’s no-auth but the client is trying something else:

┌──(kali㉿kali)-[~]
└─$ vncviewer -SecurityTypes None $TARGET_IP::$PORT

If the server advertises TLS-wrapped variants (common with VeNCrypt-style setups), these are the usual “just work” attempts in TigerVNC:

┌──(kali㉿kali)-[~]
└─$ vncviewer -SecurityTypes TLSVnc $TARGET_IP::$PORT
┌──(kali㉿kali)-[~]
└─$ vncviewer -SecurityTypes TLSNone $TARGET_IP::$PORT

If you need to keep from kicking off another operator or user session, connect shared:

┌──(kali㉿kali)-[~]
└─$ vncviewer -Shared $TARGET_IP::$PORT

Non-interactive password input for repeat tries

For quick retry loops, don’t retype passwords in the GUI.

TigerVNC can read credentials from environment variables.

┌──(kali㉿kali)-[~]
└─$ VNC_PASSWORD="$PASSWORD" vncviewer $TARGET_IP::$PORT

TigerVNC also accepts a password file via -passwd, and vncpasswd -f can generate it.

┌──(kali㉿kali)-[~]
└─$ vncviewer -passwd <(vncpasswd -f <<<"$PASSWORD") $TARGET_IP::$PORT

This avoids writing a password file to disk.

Default creds in VNC terms

Classic VNC auth is usually password-only. Usernames are often irrelevant unless you’re dealing with an enterprise implementation that uses system authentication.

Start with these manual checks (fast, low-noise):

  • Empty password

  • $PASSWORD if you already have a candidate from reuse

  • Common weak defaults you see on appliances and lab builds: admin, password, 123456, vnc, letmein

If you get a desktop with no password prompt, treat it as a critical finding and move straight to screenshotting and data triage.

When the server asks for a username

Some deployments (notably RealVNC with “System Authentication”) expect the target’s local or domain credentials, not a separate VNC-only password.

At the prompt, try:

  • Local: .\$USER

  • Domain: $DOMAIN\$USER

Then use $PASSWORD as the OS password.

What to do next once you land a desktop

Confirm where you are and what you’re looking at:

  • Login screen vs unlocked session

  • Domain-joined indicators (hostname, domain wallpaper, mapped drives, Outlook/Teams presence)

  • Clipboard and drag-drop behavior varies by server, don’t assume you can exfil via copy-paste

If you only get a login screen, you’ve still got value:

  • Hostname and domain on the logon UI

  • Usernames in recent logons

  • Password policy hints (sometimes visible via errors)

References