Question
An attacker already has a Meterpreter session (a text command shell) on a compromised Windows host and now wants a graphical desktop. What does deploying TightVNC give them, and how does it differ from that Meterpreter command shell?
Answer
TightVNC provides a full graphical remote desktop — the attacker sees and controls the victim's screen with mouse and keyboard, versus Meterpreter's text command-line.
VNC (Virtual Network Computing) is a remote-desktop protocol that streams the target's screen and relays input back. TightVNC is one popular implementation. Starting from the existing Meterpreter foothold, it escalates the takeover from commands to the whole GUI: the attacker on Kali watches the Windows desktop live and clicks around as the logged-in user.
| Meterpreter shell | TightVNC | |
|---|---|---|
| Interface | text commands | full graphical desktop |
| Feels like | scripting the box | sitting at the box |
| Good for | automation, stealth | anything that needs the GUI |
Legitimately, VNC/RDP are everyday remote-admin tools — the danger is the same capability in the wrong hands once a machine is compromised.
Tip: Shell = puppet strings; VNC = wearing the costume. Both control the victim, one just shows you the screen.
Note saved — thanks!
Question
What is Path MTU Discovery and why must it be dynamic?
Answer
Path MTU Discovery finds the smallest MTU along the route so the source can size packets to avoid drops — and it must adapt because the path (and thus the MTU) can change mid-conversation.
* PMTUD probing loop driven by ICMPv6 Packet Too Big. *
Since routers won't fragment, the source must learn the smallest MTU between itself and the destination (the "path MTU"):
- The source sends packets and, if one is too big, a router replies ICMPv6 "Packet Too Big" with the link's MTU
- The source lowers its packet size accordingly and retries
- It keeps probing until packets reach the destination
It has to be dynamic because routing can change during a session — a new path may have a smaller MTU, so the source must re-discover and adjust on the fly.
Tip: This is exactly why blocking ICMPv6 "Packet Too Big" causes the infamous "PMTU black hole" — connections that hang because the source never learns to send smaller packets.
Go deeper:
Path MTU Discovery (Wikipedia) — ICMPv6 "Packet Too Big", dynamic re-discovery, and the PMTU black-hole failure mode.
RFC 4443 §3.2 — ICMPv6 Packet Too Big — the exact message that drives PMTUD.
Note saved — thanks!