Forgotten your VNC Server’s password? Here’s an easy way to recover the encrypted VNC server password from your computer.
VNCPwdump by Patrik Karlsson can be used to dump and decrypt the registry key containing the encrypted VNC password in a few different ways.
It supports dumping and decrypting the password by:
- Dumping the current users registry key
- Retrieving it from a NTUSER.DAT file
- Decrypting a command line supplied encrypted password
- Injecting the VNC process and dumping the owners password
Here’s the test I did with RealVNC and VNCPwdump.
After installing the latest RealVNC, I set a password “raymond.cc” in the VNC Server properties.
I then run Command Prompt (cmd), changed to the extracted vncpwdump directory and run the command “vncpwdump -c”
Notice that VNCPwdump only display “raymond.” What happened to the last 2 characters “cc”? Well if you didn’t know, VNC server only accepts a maximum of 8 characters for password. RealVNC Server allows you to enter more than 8 characters but when connecting, you only need to type in the first 8 characters password to connect.
RealVNC’s encrypted password is located at HKEY_CURRENT_USER\Software\RealVNC\WinVNC4 in your Registry.
I’ve tested VNCPwdump with other versions of VNC such as TightVNC, UltraVNC and it doesn’t work. Perhaps VNCPwdump only works with RealVNC eventhough I did not find any information saying so in the author’s website.
[ Download RealVNC ]
[ Download VNCPwdump v1.0.6 ]
Related posts:
Thanks Raymond for this tool,
the UltraVNC password contains 1-byte checksum in the end, so in order to decrypt you need to pass the key to this tool without last two symbols. Tested and worked!
There is no need to go through all this trouble unless you are trying to still someones vnc server password. If its your PC just reset the damn password….
Hey guys this doesn’t work on the latest version of RealVNC (v4.5.3). Big Dissappointment. If you have any ideas please post. Thanks!
Good tool!
bt can you use this tool on a remove vnc server?if yes, how do u go about it?
Great programm can bupase allmoust any password. decrupting and crypting for me don’t work. But i’m not realy interested in it.
can someone help me, how to bypass vnc password when we want vnc to others pc
Leider sind die Sources defekt udn ein download ist nicht mehr möglich. gibt es nicht irgendwo nen mirror? ich such seit stunden
you can also use vncpwdump -k I have used it to dump ultra/real/tight that I have gotted with remote registry to be able to access computers that I had admin rights to, but no documented vnc password.
I had kinda same problems like post#7 and post#9.
Solution for Problem #9 (can’t find any password):
I found the hex password in an *.ini within the program’s main directory (in my case …/UltraVNC/ultravnc.ini )
Having the password i used post#5′s great tip and entered the password into the registry via creating a .reg file and pasting in the password from the .ini
Running the script i went into the issue from post#7 (no password found for current user)
Solution for post#7:
I edited the .reg file and changed LOCAL_MACHINe to CURRENT_USER as follows:
[HKEY_CURRENT_USER\SOFTWARE\RealVNC\WinVNC4]
“Password”=hex:xx,xx,xx,xx,xx,xx,xx,xx
(the x representing your password from ini. or anywhere else)
i cant make it ..
at the cmd prompt: access is denied..
Please help me..this is for the assignment using vncpwdump.exe..please~
i’m saved =D
A really great program ! Works fine !
Is there any way of doing this with version 4.1.2 of RealVNC? There is no password stored in any of the registry locations above and the tool therefore returns no password
cara muito bom o poste acho que vcs não vão intender nada do que eu escrevi mais parabns!!
D:\\vncdump>vncpwdump -c
VNCPwdump v.1.0.6 by patrik@cqure.net
————————————-
ERROR: Found no password for current user
Serait il possible de faire cette même chose, mais sans passer par Demarrer > Executer > CMD ?
Some versions of VNC store the password in a different registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default]
“Password”=hex:xx,xx,xx,xx,xx,xx,xx,xx
So just copy the Password key entry from there to this key and it will work fine.
[HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4]
“Password”=hex:xx,xx,xx,xx,xx,xx,xx,xx
messenger kennw
[...] Crack or Decrypt VNC Server encrypted password [...]
yes, it works)
i,m glad