pentesting-vnc

name	pentesting-vnc
description	Testing VNC remote desktop services using the Remote Frame Buffer (RFB) protocol during authorized engagements. VNC commonly listens on 5900/5901 (and web clients on 5800/5801). Covers RFB fingerprinting, no-auth / RealVNC auth-bypass detection with nmap NSE and Metasploit, password brute force, decrypting the weak 3DES-stored ~/.vnc/passwd, and gaining graphical desktop control.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","vnc","rfb","remote-desktop","brute-force"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting VNC (port 5900/5901)

When to Use

• During authorized assessments when a VNC port is open (5800/5801 web, 5900/5901 RFB, or 5900+display)
• When testing for unauthenticated ("None" auth) VNC access to a desktop
• When testing for the RealVNC authentication bypass
• When you recover a ~/.vnc/passwd file and need to decrypt the stored password
• When validating weak/default VNC passwords via brute force

Quick Enumeration

# RFB version, auth types, and known bypasses
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p <PORT> <IP>
# vnc-info reports the RFB protocol version and supported security types
# vnc-title grabs the desktop title; realvnc-auth-bypass flags the bypass

# Check for "None" (no authentication) security type
msf> use auxiliary/scanner/vnc/vnc_none_auth

# Shodan-style discovery
# port:5900 RFB

Critical: Checks Most Often Missed

1. None / no authentication — many VNC servers expose security type "None", granting full desktop control with zero credentials. Confirm with vnc_none_auth and connect directly.
2. RealVNC auth bypass — older RealVNC versions accept a null/insecure security type negotiation, bypassing the password entirely. Flagged by realvnc-auth-bypass.
3. Weak 3DES-stored password — ~/.vnc/passwd stores the VNC password encrypted with a fixed, long-reversed 3DES key. If you can read the file, you can recover the cleartext with vncpwd.
4. 8-character password truncation — VNC passwords are limited to 8 characters, making them weak to brute force; mind the limit when supplying a wordlist.
5. Web client (5800/5801) — a Java/HTTP VNC client may be exposed separately from the RFB port and can leak version/host info.

How to CONFIRM: no-auth is confirmed when auxiliary/scanner/vnc/vnc_none_auth reports the host accepts the None type, or vncviewer <IP>::5901 connects without prompting for a password. A bypass is confirmed when realvnc-auth-bypass returns VULNERABLE.

Workflow

Step 1: Enumerate (RFB version, auth types, title)

nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p 5900,5901 <IP>