25 Jun
Forgotten your VNC Server’s password? Here’s an easy way to recover the encrypted VNC server password from your computer.
VNCPwdump by Patrik Karlsson can be used to dump and decrypt the registry key containing the encrypted VNC password in a few different ways.
It supports dumping and decrypting the password by:
- Dumping the current users registry key
- Retrieving it from a NTUSER.DAT file
- Decrypting a command line supplied encrypted password
- Injecting the VNC process and dumping the owners password
Here’s the test I did with RealVNC and VNCPwdump.
After installing the latest RealVNC, I set a password “raymond.cc” in the VNC Server properties.

I then run Command Prompt (cmd), changed to the extracted vncpwdump directory and run the command “vncpwdump -c”
Notice that VNCPwdump only display “raymond.” What happened to the last 2 characters “cc”? Well if you didn’t know, VNC server only accepts a maximum of 8 characters for password. RealVNC Server allows you to enter more than 8 characters but when connecting, you only need to type in the first 8 characters password to connect.
RealVNC’s encrypted password is located at HKEY_CURRENT_USER\Software\RealVNC\WinVNC4 in your Registry.
I’ve tested VNCPwdump with other versions of VNC such as TightVNC, UltraVNC and it doesn’t work. Perhaps VNCPwdump only works with RealVNC eventhough I did not find any information saying so in the author’s website.
[ Download RealVNC ]
[ Download VNCPwdump v1.0.6 ]
Technorati Tags: VNC, realvnc, remote control, remote desktop, password, hack, crack, decrypt, vncpwdump
: Copying this article to your website is strictly NOT allowed. However, if you like this article, you can use the HTML code below to directly link to this article.
Ask Raymond: How To Decrypt MD5 Hashed Strings? How To Crack Windows Account Password Reset or Recover Firefox Master Password How To Find Hidden Passwords in Firefox Bypass Linkbucks, URLCash, UploadJockey and Auto Verify Download Links Free 6 Months ESET NOD32 v4 cfg.xml License by PCGamesHardware MSN Messenger and Hotmail Account Cracker
Have computer technical problems? Get FREE help from Raymond.CC FORUM
15 Responses for "Crack or Decrypt VNC Server encrypted password"
i,m glad
yes, it works)
[...] Crack or Decrypt VNC Server encrypted password [...]
messenger kennw
Some versions of VNC store the password in a different registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default]
“Password”=hex:xx,xx,xx,xx,xx,xx,xx,xx
So just copy the Password key entry from there to this key and it will work fine.
[HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4]
“Password”=hex:xx,xx,xx,xx,xx,xx,xx,xx
Serait il possible de faire cette même chose, mais sans passer par Demarrer > Executer > CMD ?
D:\\vncdump>vncpwdump -c
VNCPwdump v.1.0.6 by patrik@cqure.net
————————————-
ERROR: Found no password for current user
cara muito bom o poste acho que vcs não vão intender nada do que eu escrevi mais parabns!!
Is there any way of doing this with version 4.1.2 of RealVNC? There is no password stored in any of the registry locations above and the tool therefore returns no password
A really great program ! Works fine !
i’m saved =D
i cant make it ..
at the cmd prompt: access is denied..
Please help me..this is for the assignment using vncpwdump.exe..please~
I had kinda same problems like post#7 and post#9.
Solution for Problem #9 (can’t find any password):
I found the hex password in an *.ini within the program’s main directory (in my case …/UltraVNC/ultravnc.ini )
Having the password i used post#5’s great tip and entered the password into the registry via creating a .reg file and pasting in the password from the .ini
Running the script i went into the issue from post#7 (no password found for current user)
Solution for post#7:
I edited the .reg file and changed LOCAL_MACHINe to CURRENT_USER as follows:
[HKEY_CURRENT_USER\SOFTWARE\RealVNC\WinVNC4]
“Password”=hex:xx,xx,xx,xx,xx,xx,xx,xx
(the x representing your password from ini. or anywhere else)
you can also use vncpwdump -k I have used it to dump ultra/real/tight that I have gotted with remote registry to be able to access computers that I had admin rights to, but no documented vnc password.
Leider sind die Sources defekt udn ein download ist nicht mehr möglich. gibt es nicht irgendwo nen mirror? ich such seit stunden
Leave a reply