# Abusing Windows VPN for EXFIL

Recently, I came across a section in Windows settings called "VPN Settings". After some digging, I identified that we can "create", "modify" existing VPN settings and "connect" to newly created VPNs. 

Obviously, VPNs are used for circumventing network controls. This can be abused to exfiltrate data or create a pivot into network. The following is a small blog post which outlines attack techniques for abusing this Windows VPN feature for Red Team engagements. 

> Goes without saying, whatever's published is only intended for educational purposes and I'm not responsible for any malicious usage. ***I'm adding few detection controls at the bottom for our defender friends to start monitoring their network.***

![VPN Settings page](/files/UVKO6Dm2rvyPERlPtJs6)

Ok, So there's a VPN setting pane inside Windows. Here's how you can access:

1. Head to Settings > Network & Internet
2. Choose ‘VPN’ from the left pane
3. Click ‘Add a VPN connection’ from the screen that appears

{% embed url="<https://www.techadvisor.com/how-to/vpn/windows-10-built-in-vpn-3804720>" %}
Windows 10 Built In VPN
{% endembed %}

The weird thing is that any "non-administrative" users can create a VPN profile, connect to it. Essentially this means that any user can create a VPN without having administrative privilege. This means that user can bypass proxy/firewall and perform c00l actions like: establish tunnel with a server \[thereby creating a pivot into the network], exfiltrate huge amounts of data and many more.&#x20;

How to do it?&#x20;

Step 1:&#x20;

1. Create a PPTP VPN Server by following the guide below (takes 2 minutes)

{% embed url="<https://help.ubuntu.com/community/PPTPServer>" %}

2\. Create a VPN connection using the settings pane

![](/files/enb6A5R38tRe3X8CAhLQ)

3\. Connect to the connection

![](/files/kBhKfTnM5rvVRQ3pivww)

### Exfiltration

Once you are connected, you can do a lot. For instance, using "uploadserver" \[Python package] to upload data.&#x20;

On your VPN server, type:

```
pip3 install uploadserver
python3 -m uploadserver
```

Go to your VPN connected computer and use the local URL:

![](/files/NkvyD6HNpZ5GA1G0SaN4)

Does it work through PowerShell for non-administrative users?

No.

![](/files/jnKrNSfl90mBc72tr7Wz)

*However, you can use "rasdial.exe" to connect via command line. This can be used to trigger the VPN (which maybe set through compromised RDP) or set it using persistence methods like startup folders to repeatedly connect to the VPN.*&#x20;

![](/files/yW45B35E8xNcPyL1B5Re)

## Detection

Event ID: "20222" is created in Application log whenever a user connects to a VPN.&#x20;

![](/files/47emx9FchjQYusttlrOR)

***The Server Address contains the server that's being used.***&#x20;

***Update: I've observed in few setups that although we are able to add a new VPN, I'm unable to connect to it (Not sure which control is blocking it). Drop a note if you know something about it.***

Peace&#x20;

./[@pbssubhash](https://twitter.com/pbssubhash)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://blog.p1k4chu.com/security-research/adversarial-tradecraft-research-and-detection/abusing-windows-vpn-for-exfil.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.