TailVNC — covert VNC access via Tailscale with Windows Session 0 isolation bypass

A remote administration and post‑exploitation tool for Windows that embeds a full‑featured VNC server and a Tailscale node into a single binary. TailVNC provides persistent desktop access without exposing ports to the external network, using the encrypted Tailscale or Headscale mesh.

Features: 📍 Built‑in Tailscale/Headscale integration via tsnet with no external dependencies 📍 Windows Session 0 isolation bypass via CreateProcessAsUser and IPC-proxy 📍 Dynamic desktop tracking (Winlogon, UAC, lock screen) 📍 Ctrl+Alt+Del injection via sas.dll!SendSAS 📍 Bidirectional clipboard sync 📍 Embeds keys and passwords at build time, no config files required

Compared to SockTail and traditional VNC solutions (UltraVNC, TightVNC), TailVNC requires no open ports and uses WireGuard encryption by default, but is limited to the Windows platform and lacks GUI configuration.

📎 Tool: https://github.com/wh0amitz/TailVNC

💬 Discuss