---
description: December 5, 2022
---

# \[Day 5] Brute-Forcing

Instead of using usernames for ssh attacks in hydra, the service vnc does not require username information. `hydra -P /usr/share/wordlists/rockyou.txt vnc://<IP>`

## Flags

### Use Hydra to find the VNC password of the target with IP address \<IP>. What is the password?

1q2w3e4r

### Using a VNC client on the AttackBox, connect to the target of IP address \<IP>. What is the flag written on the target’s screen?

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FFyqIp93C8YT83nvUfjNB%2Fimage.png?alt=media\&token=8ae4fa04-54d3-48a5-86d3-8580495421df)

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FRrRcHbDrxG5WbP1HALnI%2Fimage.png?alt=media\&token=45abc100-3643-4461-b65b-1ec2f9ae9e74)

THM{I\_SEE\_YOUR\_SCREEN}
