Skip to content
HackIndex logo

HackIndex

VNC Session Hijacking – Stealing Active Sessions

3 min read Mar 12, 2026

VNC session hijacking abuses cases where multiple clients can connect to the same session, or where the distinction between view-only and full-control passwords is absent or misconfigured. Unlike RDP which creates isolated sessions per user, a VNC server shares one desktop among all connected clients by default. If you can connect, you share full control with any authenticated user already present.

Shared Session Takeover

When a VNC server has no view-only password — or the view-only password is the same as the full-control password — any client that connects gets keyboard and mouse input. If a user is already working in the session, you connect alongside them and have equal control. No session isolation exists.

Connect with your cracked or extracted password:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

You are now in the same session as the active user. Take control immediately — move the mouse, type commands. The user sees your actions, so act quickly if stealth matters.

Checking for Shared Session Vulnerability

Nmap reveals the security configuration:

┌──(kali㉿kali)-[~]
└─$ nmap -p 5900 --script vnc-info $TARGET_IP

If only one password type is listed and no view-only restriction is noted in the server configuration, shared access is likely active.

Hash Capture from VNC Traffic – Challenge-Response

When you cannot connect directly, capture a VNC authentication attempt from the network using Wireshark or tcpdump and crack it offline. VNC challenge-response uses a 16-byte DES challenge encrypted with the password as the key. Capture it by sniffing during a legitimate authentication attempt.

Set up a packet capture:

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i eth0 -w vnc-capture.pcap tcp port 5900

Open the capture in Wireshark and filter for VNC:

vnc

Follow the TCP stream. Look for:

  • VNC Authentication — confirms RFB auth in use

  • 16-byte server challenge

  • 16-byte client response

Extract the challenge and response hex values. Crack with VNCrack:

┌──(kali㉿kali)-[~]
└─$ ./vncrack -c <challenge_hex> -r <response_hex> -w /usr/share/wordlists/rockyou.txt

MITM Capture with Ettercap

If you are on the same network segment as the VNC client and server, ARP spoof to intercept the authentication:

┌──(kali㉿kali)-[~]
└─$ sudo ettercap -T -i eth0 -M arp:remote /$TARGET_IP// /$GATEWAY_IP//
┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i eth0 -w vnc-capture.pcap tcp port 5900

Capture the challenge-response exchange and crack offline with VNCrack as above.

View-Only Password Bypass

Some VNC servers set a weak or blank view-only password while the full-control password is strong. If you can connect with the view-only password but want full control, check the server version — older VNC implementations have bugs in how they enforce view-only mode. TightVNC and some RealVNC versions allow keyboard injection through view-only sessions on certain builds.

Test by connecting with the view-only credential and attempting to type in a terminal window visible on the desktop. If input registers, view-only mode is not enforced.

References