NachoVPN 🌮🔒

NachoVPN is a Proof of Concept that demonstrates exploitation of SSL-VPN clients, using a rogue VPN server.

It uses a plugin-based architecture so that support for additional SSL-VPN products can be contributed by the community. It currently supports various popular corporate VPN products, such as Cisco AnyConnect, SonicWall NetExtender, Palo Alto GlobalProtect, and Ivanti Connect Secure.

For further details, see our blog post, and HackFest Hollywood 2024 presentation [slides|video].

Installation

Prerequisites

• Python 3.9 or later
• Docker (optional)
• osslsigncode (Linux only)
• msitools (Linux only)
• python3-netfilter (Linux only)
• git

Linux Setup

NachoVPN is built and tested on Ubuntu 22.04.

• Install python3-nftables and nftables

• Optionally use setcap to avoid sudo requirement:

  root@kitploit:~

  sudo setcap 'cap_net_raw,cap_net_bind_service,cap_net_admin=eip' /usr/bin/python3.10
  

• Enable IP forwarding:

  root@kitploit:~

  sudo sysctl -w net.ipv4.ip_forward=1
  

Installing from source

NachoVPN can be installed from GitHub using pip. Note that this requires git to be installed.

First, create a virtual environment.

On Linux, ensure that the virtual env has access to the system site-packages, so that nftables works:

python3 -m venv env --system-site-packages
source env/bin/activate

On Windows, nftables (and thus packet forwarding) is disabled, so use:

python -m venv env
.\env\Scripts\activate

Then, install NachoVPN:

pip install git+https://github.com/AmberWolfCyber/NachoVPN.git

If you prefer to use Docker, then you can pull the container from the GitHub Container Registry:

docker pull ghcr.io/AmberWolfCyber/nachovpn:release

Building for distribution

Building a wheel file

First, clone this repository, and install setuptools and wheel via pip. You can then run the setup.py script:

git clone https://github.com/AmberWolfCyber/NachoVPN
pip install -U setuptools wheel
python setup.py bdist_wheel

This will generate a wheel file in the dist directory, which can be installed with pip:

pip install dist/nachovpn-1.0.0-py3-none-any.whl

Building for local development

Alternatively, for local development you can install the package in editable mode using:

pip install -e .

Building a container image

You can build the container image with the following command:

docker build -t nachovpn:latest .

Running

To run the server as standalone, use:

python -m nachovpn.server

Alternatively, you can run the server using Docker:

docker run -e SERVER_FQDN=connect.nachovpn.local -e EXTERNAL_IP=1.2.3.4 -v ./certs:/app/certs -p 80:80 -p 443:443 --rm -it nachovpn

This will generate a certificate for the SERVER_FQDN using certbot, and save it to the certs directory, which we've mounted into the container.

Alternatively, for testing purposes, you can skip the certificate generation by setting the SKIP_CERTBOT environment variable.

This will generate a self-signed certificate instead.

docker run -e SERVER_FQDN=connect.nachovpn.local -e SKIP_CERTBOT=1 -e EXTERNAL_IP=1.2.3.4 -p 443:443 --rm -it nachovpn

An example docker-compose file is also provided for convenience.

Debugging

You can run nachovpn with the -d or --debug command line arguments in order to increase the verbosity of logging, which can aid in debugging.

Alternatively, if the logging is too noisy, you can use the q or --quiet command line argument instead.

Plugins

NachoVPN supports the following plugins and capabilities:

URI handlers

• The Ivanti Connect Secure (Pulse Secure) URI handler can be triggered by visiting the /pulse URL on the NachoVPN server.
• The SonicWall NetExtender URI handler can be triggered by visiting the /sonicwall URL on the NachoVPN server. This requires that the SonicWall Connect Agent is installed on the client machine.
• The Delinea URI handler can be triggered by visiting the /delinea URL on the NachoVPN server.

Operating Notes

• It is recommended to use a TLS certificate that is signed by a trusted Certificate Authority. The docker container automates this process for you, using certbot. If you do not use a trusted certificate, then NachoVPN will generate a self-signed certificate instead, which in most cases will either cause the client to prompt with a certificate warning, or it will refuse to connect unless you modify the client settings to accept self-signed certificates. For the Palo Alto GlobalProtect plugin, this will also cause the MSI installer to fail.
• In order to simulate a valid codesigning certificate for the SonicWall plugin, NachoVPN will sign the NACAgent.exe payload with a self-signed certificate. For testing purposes, you can download and install this CA certificate from /sonicwall/ca.crt before triggering the exploit. For production use-cases, you will need to obtain a valid codesigning certificate from a public CA, sign your NACAgent.exe payload, and place it in the payloads directory (or volume mount it into /app/payloads, if using docker).
• For convenience, a default NACAgent.exe payload is generated for the SonicWall plugin, and written to the payloads directory. This simply spawns a new cmd.exe process on the current user's desktop, running as SYSTEM.
• The Palo Alto GlobalProtect plugin requires that the MSI installers and file are present in the directory. Either add these manually, or run the script to download them.

Disabling a plugin

To disable a plugin, add it to the DISABLED_PLUGINS environment variable. For example:

DISABLED_PLUGINS=CiscoPlugin,SonicWallPlugin

Environment Variables

NachoVPN is configured using environment variables. This makes it easily compatible with containerised deployments.

Global environment variables:

Plugin specific environment variables:

Mitigations

We recommend the following mitigations:

• Ensure SSL-VPN clients are updated to the latest version available from the vendor.
• Most VPN clients support the concept of locking down the VPN profile to a specific endpoint, or using an always-on VPN mode. This should be enabled where possible.
• Unfortunately, in some cases this lockdown can be removed by a malicious local user, therefore it is also recommended to use host-based firewall rules to restrict the IP addresses that the VPN client can communicate with.
• Consider using an Application Control policy, such as WDAC, or an EDR solution to ensure that only approved executables and scripts can be executed by the VPN client.
• Detect and alert on VPN clients executing non-standard child processes.

References

• AmberWolf Blog: NachoVPN
• HackFest Hollywood 2024: Very Pwnable Networks: Exploiting the Top Corporate VPN Clients for Remote Root and SYSTEM Shells, Rich Warren & David Cash [video]
• BlackHat 2008: Leveraging the Edge: Abusing SSL VPNs, Mike Zusman
• BlackHat 2019: Infiltrating Corporate Intranet Like NSA, Orange Tsai & Meh Chang
• NCC Group: Making New Connections: Leveraging Cisco AnyConnect Client to Drop and Run Payloads, David Cash & Julian Storr
• The OpenConnect Project

Contributing

We welcome contributions! Please open an issue or raise a Pull Request.

If you're interested in developing a new plugin, you can take a look at the ExamplePlugin to get started.

License

NachoVPN is licensed under the MIT license. See the LICENSE file for details.