Abusing Windows VPN for EXFIL
PreviousDetecting malicious OOB: Part -1: Hunting for OOB server - Interact.shNextAnalyzing Nobelium's HTML Dropper - EnvyScout
Last updated
Was this helpful?
Last updated
Was this helpful?
Recently, I came across a section in Windows settings called "VPN Settings". After some digging, I identified that we can "create", "modify" existing VPN settings and "connect" to newly created VPNs.
Obviously, VPNs are used for circumventing network controls. This can be abused to exfiltrate data or create a pivot into network. The following is a small blog post which outlines attack techniques for abusing this Windows VPN feature for Red Team engagements.
Goes without saying, whatever's published is only intended for educational purposes and I'm not responsible for any malicious usage. I'm adding few detection controls at the bottom for our defender friends to start monitoring their network.
Ok, So there's a VPN setting pane inside Windows. Here's how you can access:
Head to Settings > Network & Internet
Choose ‘VPN’ from the left pane
Click ‘Add a VPN connection’ from the screen that appears
The weird thing is that any "non-administrative" users can create a VPN profile, connect to it. Essentially this means that any user can create a VPN without having administrative privilege. This means that user can bypass proxy/firewall and perform c00l actions like: establish tunnel with a server [thereby creating a pivot into the network], exfiltrate huge amounts of data and many more.
How to do it?
Step 1:
Create a PPTP VPN Server by following the guide below (takes 2 minutes)
2. Create a VPN connection using the settings pane
3. Connect to the connection
Once you are connected, you can do a lot. For instance, using "uploadserver" [Python package] to upload data.
On your VPN server, type:
Go to your VPN connected computer and use the local URL:
Does it work through PowerShell for non-administrative users?
No.
However, you can use "rasdial.exe" to connect via command line. This can be used to trigger the VPN (which maybe set through compromised RDP) or set it using persistence methods like startup folders to repeatedly connect to the VPN.
Event ID: "20222" is created in Application log whenever a user connects to a VPN.
The Server Address contains the server that's being used.
Update: I've observed in few setups that although we are able to add a new VPN, I'm unable to connect to it (Not sure which control is blocking it). Drop a note if you know something about it.
Peace
./
