> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/vnc.md).

# VNC

**VNC** is a remote desktop-sharing protocol used to control a system’s GUI remotely.

***

### Common VNC Ports

| Port Range | Description                         |
| ---------- | ----------------------------------- |
| 5900+N     | Default port (`N` = display number) |
| 6000+N     | Sometimes used for X11 forwarding   |

Examples:

* `5900` (Display :0)
* `5901` (Display :1)
* `5902` (Display :2)

***

### Connecting to VNC

* Install Client Tool

```bash
sudo apt install tigervnc-viewer
```

```bash
vncviewer <ip>:5901
```

***

### Nmap NSE Scripts for VNC

Enumerate VNC services and identify potential weaknesses:

```bash
nmap -p 5900-5904 --script=vnc-info,vnc-title,vnc-brute,realvnc-auth-bypass <ip>
```

| Script                | Purpose                                                |
| --------------------- | ------------------------------------------------------ |
| `vnc-info`            | Protocol version, supported authentication types       |
| `vnc-title`           | Window title of remote desktop                         |
| `vnc-brute`           | Attempts VNC password brute-force                      |
| `realvnc-auth-bypass` | Tries to bypass RealVNC authentication (CVE-2006-2369) |

***

### Brute-force with Hydra

Hydra can be used to attempt online brute-force attacks against VNC:

```bash
hydra -P /usr/share/wordlists/rockyou.txt -s 5901 <target-ip> vnc
```

{% hint style="info" %}
Many VNC servers implement a delay between login attempts to slow brute-force attacks.
{% endhint %}

***

### VNC Password (Offline Cracking)

VNC stores passwords in hashed format at:

```bash
~/.vnc/passwd
```

Use the following tool to decrypt:

* **Tool**: [`vncpwd`](https://github.com/jeroennijhof/vncpwd)

#### Steps

```bash
git clone https://github.com/jeroennijhof/vncpwd
cd vncpwd
gcc vncpwd.c -o vncpwd
./vncpwd ~/.vnc/passwd
```