# Manual VNC Connection and Default Creds

- **URL:** https://hackindex.io/services/vnc/enumeration/manual-vnc-connection-and-default-creds
- **Path:** VNC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/vnc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-01-19

This is for turning “VNC is open” into an actual desktop view, and quickly confirming whether it’s **no-auth**, **VNC password**, or a **TLS or vendor auth** variant that needs different client settings.

## Connect with TigerVNC vncviewer

TigerVNC supports both `host:display` and `host::port`. Use `::port` when you only know `$PORT`.

```bash
vncviewer $TARGET_IP::$PORT
```

If you know the display number instead of a raw port:

```bash
vncviewer $TARGET_IP:0
```

Practical behavior:

- If you immediately land on a desktop, you likely hit **None** auth.
- If you get a password prompt, it’s usually **VNC Authentication**.
- If it errors with security mismatch, force security types.

## Force a compatible security type

When you see errors like “no matching security types”, you’re negotiating the wrong auth scheme. TigerVNC lets you constrain what it attempts via `-SecurityTypes`.

Try plain VNC auth first:

```bash
vncviewer -SecurityTypes VncAuth $TARGET_IP::$PORT
```

If you suspect it’s no-auth but the client is trying something else:

```bash
vncviewer -SecurityTypes None $TARGET_IP::$PORT
```

If the server advertises TLS-wrapped variants (common with VeNCrypt-style setups), these are the usual “just work” attempts in TigerVNC:

```bash
vncviewer -SecurityTypes TLSVnc $TARGET_IP::$PORT
vncviewer -SecurityTypes TLSNone $TARGET_IP::$PORT
```

If you need to keep from kicking off another operator or user session, connect shared:

```bash
vncviewer -Shared $TARGET_IP::$PORT
```

## Non-interactive password input for repeat tries

For quick retry loops, don’t retype passwords in the GUI.

TigerVNC can read credentials from environment variables.

```bash
VNC_PASSWORD="$PASSWORD" vncviewer $TARGET_IP::$PORT
```

TigerVNC also accepts a password file via `-passwd`, and `vncpasswd -f` can generate it.

```bash
vncviewer -passwd <(vncpasswd -f <<<"$PASSWORD") $TARGET_IP::$PORT
```

This avoids writing a password file to disk.

## Default creds in VNC terms

Classic VNC auth is usually **password-only**. Usernames are often irrelevant unless you’re dealing with an enterprise implementation that uses system authentication.

Start with these manual checks (fast, low-noise):

- Empty password
- `$PASSWORD` if you already have a candidate from reuse
- Common weak defaults you see on appliances and lab builds: `admin`, `password`, `123456`, `vnc`, `letmein`

If you get a desktop with **no password prompt**, treat it as a critical finding and move straight to screenshotting and data triage.

## When the server asks for a username

Some deployments (notably RealVNC with “System Authentication”) expect the target’s local or domain credentials, not a separate VNC-only password.

At the prompt, try:

- Local: `.\$USER`
- Domain: `$DOMAIN\$USER`

Then use `$PASSWORD` as the OS password.

## What to do next once you land a desktop

Confirm where you are and what you’re looking at:

- Login screen vs unlocked session
- Domain-joined indicators (hostname, domain wallpaper, mapped drives, Outlook/Teams presence)
- Clipboard and drag-drop behavior varies by server, don’t assume you can exfil via copy-paste

If you only get a login screen, you’ve still got value:

- Hostname and domain on the logon UI
- Usernames in recent logons
- Password policy hints (sometimes visible via errors)

## References

- [TigerVNC vncviewer](https://tigervnc.org/doc/vncviewer.html) - Host syntax :display vs ::port, -SecurityTypes, -passwd, and env vars
- [TigerVNC vncpasswd](https://tigervnc.org/doc/vncpasswd.html) - Generating a password file and using it with vncviewer -passwd
- [Remote Framebuffer (RFB) Registry](https://www.iana.org/assignments/rfb/rfb.xhtml) - Security type identifiers like None, VNC Authentication, TLS, VeNCrypt
- [RealVNC credentials prompt](https://help.realvnc.com/hc/en-us/articles/360004013351-What-username-and-password-do-I-enter-when-I-m-trying-to-connect-to-RealVNC-Server) - Default is local or domain/AD username and password
- [RealVNC System Authentication](https://help.realvnc.com/hc/en-us/articles/360002250097-Setting-up-System-Authentication) - Explains system-credential authentication and domain username formats