Forgotten your VNC Server’s password? Here’s an easy way to recover the encrypted VNC server password from your computer.
VNCPwdump by Patrik Karlsson can be used to dump and decrypt the registry key containing the encrypted VNC password in a few different ways.

It supports dumping and decrypting the password by:
- Dumping the current users registry key
- Retrieving it from a NTUSER.DAT file
- Decrypting a command line supplied encrypted password
- Injecting the VNC process and dumping the owners password

Here’s the test I did with RealVNC and VNCPwdump.

After installing the latest RealVNC, I set a password “raymond.cc” in the VNC Server properties.
Hack VNC Server encrypted password

I then run Command Prompt (cmd), changed to the extracted vncpwdump directory and run the command “vncpwdump -c

Notice that VNCPwdump only display “raymond.” What happened to the last 2 characters “cc”? Well if you didn’t know, VNC server only accepts a maximum of 8 characters for password. RealVNC Server allows you to enter more than 8 characters but when connecting, you only need to type in the first 8 characters password to connect.

RealVNC’s encrypted password is located at HKEY_CURRENT_USER\Software\RealVNC\WinVNC4 in your Registry.

I’ve tested VNCPwdump with other versions of VNC such as TightVNC, UltraVNC and it doesn’t work. Perhaps VNCPwdump only works with RealVNC eventhough I did not find any information saying so in the author’s website.

[ Download RealVNC ]
[ Download VNCPwdump v1.0.6 ]

Technorati Tags: , , , , , , , ,