Lion Cipher Lab
Access an unauthenticated VNC server in your own lab, then lock it down
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Most exposed-service findings are about data: an open database leaks records, an open file share leaks files. An exposed VNC server is a different and often worse category, because VNC is REMOTE DESKTOP — it hands a remote person your actual screen, mouse and keyboard. A VNC server that accepts connections with no authentication is therefore not 'someone can read your data', it is 'someone can sit at your computer', click through whatever is logged in, open a terminal, read email, move money. VNC speaks a protocol called RFB (Remote FrameBuffer), and the very first thing an RFB server does…
What you'll learn
- explaining what VNC and the RFB protocol are, what 'unauthenticated' means for a remote desktop, and why an exposed VNC is a live keyboard and mouse rather than just leaked data
- standing up a self-contained lab inside one Docker container bound to loopback — a VNC server plus the tools to probe it — so the whole exercise touches nothing but your own machine
- reading an RFB handshake to recover a server's offered SECURITY TYPES, and recognising security type 1 (None) as the no-authentication finding, with nmap's vnc-info and with a short hand-written probe
- measuring the exposure before and after a fix: the server offers type 1 (None) before, and type 2 (VNC Authentication) with None withdrawn after
- applying the layered fix — set a VNC password (security type 2), keep the listener on loopback, and reach it only through an SSH tunnel — and configuring each layer yourself
- judgment: why VNC Authentication is itself weak (legacy DES, 8-character effective cap, cleartext transport) so a password alone is not enough, and why the real control is 'never expose 5900; tunnel it'
- recognising exposed remote-desktop services (VNC and its relatives) on a port scan and reasoning about blast radius rather than just noting an open port
Steps in this lab
- What VNC is, and why 'unauthenticated' here means something worse than usual
- Build the self-contained lab: one container, loopback only
- Start the weak server: offer security type None
- Confirm the finding: read the offered security types with nmap
- Optional: read the handshake yourself with a tiny probe
- Apply the fix, layer 1: require VNC Authentication
- Apply the fix, layer 2: keep it on loopback and tunnel over SSH
- When this bites, when it does not, and how a pro treats VNC