metasploit-cursor-harness: Skill for Cursor

VNC Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Windows targets with VNC: load windows-pentest.

Ports and detection

Port	Service
5900/tcp, 5901/tcp	VNC (RFB protocol)
5800/tcp, 5801/tcp	VNC over HTTP (Java viewer)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/vnc_none_auth",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5900, "THREADS": 5}
)

CLI fallback:

nmap -sV --script vnc-info,vnc-title,realvnc-auth-bypass -p 5900,5901 <target>
nc -vn <target> 5900
# RFB protocol version in banner

Workflow

Task Progress:
- [ ] No-auth and security type check
- [ ] Password brute force
- [ ] RealVNC auth bypass check
- [ ] UltraVNC/TightVNC specifics
- [ ] Offline hash crack
- [ ] Document findings

No-auth access check

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/vnc_none_auth",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 5900}
)

CLI fallback:

vncviewer <target>::5900
nmap --script vnc-info -p 5900 <target>
# SecurityTypes: None = unauthenticated access

Password brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/vnc/vnc_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 5900,
    "PASS_FILE": "/usr/share/wordlists/rockyou.txt",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

hydra -P passwords.txt <target> vnc -t 4 -f
ncrack -P passwords.txt -p 5900 <target>
vncviewer -passwd passwd.txt <target>::5900

VNC passwords max 8 characters, DES-encrypted with fixed key.

RealVNC auth bypass (CVE-2006-2369 class)

Verify VNC version via nmap vnc-info script or msf_run_auxiliary_module vnc_none_auth before attempting bypass. Only affects RealVNC 4.1.0-4.1.1.