VNC

Description

This module searches for VNC passwords stored in the registry and configuration files for various VNC implementations, including RealVNC, TightVNC, TigerVNC, and UltraVNC. The module identifies and decrypts these passwords using the DES algorithm with a fixed key. It covers the following VNC implementations:

• RealVNC: Searches the registry for VNC server proxy credentials.

• TightVNC: Searches the registry for server passwords, control passwords, and view-only passwords.

• TigerVNC: Searches the registry for server passwords.

• UltraVNC: Searches for passwords in configuration files located in specified directories.

For each system output is stored in $pwd\PME\PME\VNC\

Supported Methods

• MSSQL

• SMB

• SessionHunter (WMI)

• WMI

• WinRM

Optional Parameters

Parameter	Value	Description
-ShowOutput	N/A	Displays each target output to the console
-SuccessOnly	N/A	Display only successful results

Usage

# Standard execution
PsMapExec -Username [User] -Password [Pass] -targets [All] -Module VNC -Method [Method] -ShowOutput