When a session selects None or VNC Authentication, subsequent RFB protocol data is unencrypted. An on-path capture can expose framebuffer updates and client input events; the VNC Authentication exchange also exposes the challenge and response for offline candidate testing. Practical reconstruction depends on the encodings, extensions, and completeness of the capture. Do not infer cleartext merely because VeNCrypt is absent: TLS, SASL, RSA-AES, Secure Tunnel, Integrated SSH, and vendor mechanisms may provide other forms of protection.
# capture VNC traffic from an on-path position
tcpdump -i eth0 -w vnc.pcap port 5900
# reconstruct the screen from framebuffer updates, and read input events, in analysis
# (tools and Wireshark dissectors parse RFB framebuffer/keyevent messages)
# extract the auth challenge+response for offline cracking (see password brute force)
Exploitation notes#
- A complete cleartext capture may permit screen reconstruction and recovery of client input events, subject to the negotiated encodings and extensions.
- VNC Authentication challenge-response data permits offline candidate testing, but does not guarantee password recovery.
- The attack needs an on-path position (ARP/DNS/route) or a tap; VNC over a flat LAN is readily intercepted.
- Confirm the selected security type and its effective protection. TLS, VeNCrypt, SASL, RSA-AES, SSH, VPN, or another authenticated encrypted transport may protect the session.