Skip to content
HackIndex.io

VNC Session Hijacking – Stealing Active Sessions

3 min read Created Mar 12, 2026 Last updated Mar 12, 2026

VNC session hijacking abuses cases where multiple clients can connect to the same session, or where the distinction between view-only and full-control passwords is absent or misconfigured. Unlike RDP which creates isolated sessions per user, a VNC server shares one desktop among all connected clients by default. If you can connect, you share full control with any authenticated user already present.

VNC session hijacking via shared desktop

When a VNC server has no view-only password (or the view-only password is the same as the full-control password), any client that connects gets keyboard and mouse input. If a user is already working in the session, you connect alongside them and have equal control. No session isolation exists.

Connect with your cracked or extracted password:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

You are now in the same session as the active user. Take control immediately: move the mouse, type commands. The user sees your actions, so act quickly if stealth matters.

Checking for Shared Session Vulnerability

Nmap reveals the security configuration:

┌──(kali㉿kali)-[~]
└─$ nmap -p 5900 --script vnc-info $TARGET_IP

If only one password type is listed and no view-only restriction is noted in the server configuration, shared access is likely active.

Hash Capture from VNC Traffic - Challenge-Response

When you cannot connect directly, capture a VNC authentication attempt from the network using Wireshark or tcpdump and crack it offline. VNC challenge-response uses a 16-byte DES challenge encrypted with the password as the key. Capture it by sniffing during a legitimate authentication attempt.

Set up a packet capture:

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i eth0 -w vnc-capture.pcap tcp port 5900

Open the capture in Wireshark and filter for VNC:

vnc

Follow the TCP stream. Look for:

  • VNC Authentication: confirms RFB auth in use

  • 16-byte server challenge

  • 16-byte client response

Extract the challenge and response hex values. Crack with VNCrack:

┌──(kali㉿kali)-[~]
└─$ ./vncrack -c <challenge_hex> -r <response_hex> -w /usr/share/wordlists/rockyou.txt

MITM Capture with Ettercap

If you are on the same network segment as the VNC client and server, ARP spoof to intercept the authentication:

┌──(kali㉿kali)-[~]
└─$ sudo ettercap -T -i eth0 -M arp:remote /$TARGET_IP// /$GATEWAY_IP//
┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i eth0 -w vnc-capture.pcap tcp port 5900

Capture the challenge-response exchange and crack offline with VNCrack as above.

View-Only Password Bypass

Some VNC servers set a weak or blank view-only password while the full-control password is strong. If you can connect with the view-only password but want full control, check the server version: older VNC implementations have bugs in how they enforce view-only mode. TightVNC and some RealVNC versions allow keyboard injection through view-only sessions on certain builds.

Test by connecting with the view-only credential and attempting to type in a terminal window visible on the desktop. If input registers, view-only mode is not enforced.

References