5800,5801,5900,5901 - Pentesting VNC
Basic Information
Virtual Network Computing (VNC) uses the Remote Framebuffer (RFB) protocol to display and control a remote graphical interface. The client receives framebuffer updates and sends keyboard and pointer events to the server.[1]
RFB is registered on TCP port 5900.[1] VNC deployments commonly map displays to 5900 + display_number and optional web viewers to 5800 + display_number, so ports 5800, 5801, 5900, and 5901 are useful enumeration targets.[2]
PORT STATE SERVICE
5900/tcp open vncEnumeration
Nmap can collect RFB protocol and desktop-title information, and Metasploit can check whether a server accepts the None authentication type.[4][5]
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p <PORT> <IP>
msf> use auxiliary/scanner/vnc/vnc_none_authBrute force
Connect with a VNC viewer
vncviewer [-passwd passwd.txt] <IP>::5901Recovering stored VNC passwords
Some VNC implementations store a password in ~/.vnc/passwd.[3]
The legacy VNC password-file format uses DES with a fixed, publicly known key and truncates passwords to eight characters. The vncpwd utility can recover the plaintext from this format.[1][3]
make
vncpwd <vnc password file>An archived Windows-compatible copy is attached here for convenience. It includes vncpwd.exe and the C source. The program accepts either a .vnc file or an encrypted password in raw or hexadecimal form, and the Windows build can also enumerate supported stored passwords from the registry:[3]
vncpwd.exe <file.vnc-or-encrypted-password>Shodan
port:5900 RFB