Friday 28 October 2022

OpenVPN Python Scanner

I'm trying to create a script in Python that can scan an OpenVPN port over TCP, my general idea is to try and connect to the server by doing a TCP handshake and then sending it to the server

P_CONTROL_HARD_RESET_CLIENT_V2

and if the server answers me - so it's an OpenVPN port. This is my code:

import socket
  

target = IP
port = PORT
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
socket.setdefaulttimeout(1)
s.connect((target, port))
print("Connected")
s.send() # P_CONTROL_HARD_RESET_CLIENT_V2
data = s.recv(1024)
print(data)

My main issue is that I don't know how to send P_CONTROL_HARD_RESET_CLIENT_V2, I searched how it should look and couldn't find it.

I tried to use:

senddata= "\x38\x01\x00\x00\x00\x00\x00\x00\x00"
s.send(senddata.encode())
result = s.recv(1024)
print(result)

like in here: https://serverfault.com/questions/262474/how-to-check-that-an-openvpn-server-is-listening-on-a-remote-port-without-using but it didn't work and the answer from the server was b''.

I was able to make this thing:

senddata = "\x00\x36\x38\xe2\x9f\x68\xf2\x3d\x76\x15\x2e\x00\x00\x00\x01\x63\x5a\x3f\x14\x10\xf1\xb9\xd3\x98\xb5\x36\xb9\xbd\x48\x70\xaa\xc7\x29\x2c\x4c\x98\xd0\x17\xdb\x3b\x42\xf0\xa9\x4e\xbd\x65\xbd\x2f\x12\x37\xf2\x10\xb8\x95\xc6\x0a"
s.send(senddata.encode())
result = s.recv(1024)
print(result)

and this time when I used Wireshark I saw that the packet is P_CONTROL_HARD_RESET_CLIENT_V2 (malformed) but I didn't get a response.



from OpenVPN Python Scanner

No comments:

Post a Comment