# VNC Session Hijacking – Stealing Active Sessions

- **URL:** https://hackindex.io/services/vnc/exploitation/session-hijacking
- **Path:** VNC > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/vnc/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-03-12

VNC session hijacking abuses cases where multiple clients can connect to the same session, or where the distinction between view-only and full-control passwords is absent or misconfigured. Unlike RDP which creates isolated sessions per user, a VNC server shares one desktop among all connected clients by default. If you can connect, you share full control with any authenticated user already present.

## VNC session hijacking via shared desktop

When a VNC server has no view-only password (or the view-only password is the same as the full-control password), any client that connects gets keyboard and mouse input. If a user is already working in the session, you connect alongside them and have equal control. No session isolation exists.

Connect with your cracked or extracted password:

```bash
vncviewer $TARGET_IP:5900
```

You are now in the same session as the active user. Take control immediately: move the mouse, type commands. The user sees your actions, so act quickly if stealth matters.

## Checking for Shared Session Vulnerability

Nmap reveals the security configuration:

```bash
nmap -p 5900 --script vnc-info $TARGET_IP
```

If only one password type is listed and no view-only restriction is noted in the server configuration, shared access is likely active.

## Hash Capture from VNC Traffic - Challenge-Response

When you cannot connect directly, capture a VNC authentication attempt from the network using Wireshark or tcpdump and crack it offline. VNC challenge-response uses a 16-byte DES challenge encrypted with the password as the key. Capture it by sniffing during a legitimate authentication attempt.

Set up a packet capture:

```bash
sudo tcpdump -i eth0 -w vnc-capture.pcap tcp port 5900
```

Open the capture in Wireshark and filter for VNC:

```
vnc
```

Follow the TCP stream. Look for:

- `VNC Authentication`: confirms RFB auth in use
- 16-byte server challenge
- 16-byte client response

Extract the challenge and response hex values. Crack with VNCrack:

```bash
./vncrack -c <challenge_hex> -r <response_hex> -w /usr/share/wordlists/rockyou.txt
```

> [!WARNING]
> This may be restricted in exams such as OSCP. Responder-style poisoning to force authentication is not allowed on the OSCP exam. Passive capture is fine. Verify exam rules before use.

## MITM Capture with Ettercap

If you are on the same network segment as the VNC client and server, ARP spoof to intercept the authentication:

```bash
sudo ettercap -T -i eth0 -M arp:remote /$TARGET_IP// /$GATEWAY_IP//
sudo tcpdump -i eth0 -w vnc-capture.pcap tcp port 5900
```

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

Capture the challenge-response exchange and crack offline with VNCrack as above.

## View-Only Password Bypass

Some VNC servers set a weak or blank view-only password while the full-control password is strong. If you can connect with the view-only password but want full control, check the server version: older VNC implementations have bugs in how they enforce view-only mode. TightVNC and some RealVNC versions allow keyboard injection through view-only sessions on certain builds.

Test by connecting with the view-only credential and attempting to type in a terminal window visible on the desktop. If input registers, view-only mode is not enforced.

## References

- [VNCrack](http://www.phenoelit.org/vncrack/) - Phenoelit Challenge-response offline cracking tool for VNC authentication captures.