VNCcrack is a fast offline password cracker for VNC passwords. By sniffing a VNC challenge-response sequence off the network (typically when VNC is used without a decent cryptographic wrapper like SSH or SSL), you can recover the password fairly easily and quickly by letting VNCcrack pound on it. Once you've got someone's VNC password... well, that should be fairly obvious, I guess.
VNCcrack is not a 'real' password cracker like John the Ripper or L0phtCrack; it's basically a proof of concept that is nonetheless fairly usable for its intended purpose. It certainly could be faster, but it is quite usable as-is: I measure it at testing 300,000 passwords per second on a 1.4 GHz Athlon.
You can download a tarball with VNCcrack 1.0.0, along with a PGP signature: tarball / sig.
The signature is generated using my primary personal PGP key, which you can get here.