🔒 Closed [Proof of concept] Working OpenVPN NO CAPPING!!

[prinzrainer]

Warning highly technical post!

Hi guys mga OpenVPN users sawa na ba kayo dahil hindi working yung config nyo?? Well ito na yung solution.
Related Post: https://phcorner.org/threads/700148/#post-11925141

Simulan natin muna kung pano ba talaga na bbypass natin yung ISP para maka free net tayo?
Gumagana ito sa pamamagitan ng pag sesend ng fake server name during TLS connection, so akala ni ISP nag aaccess tayo ng website na yun? (Application Level yung filtering ng ISP dahil hirap silang e filter yung packets network or transport level)

Ano yung bago sa method na to?
Yung iba na nakikita ko full TLS yung implementation ng server nila. Ito transparent forwarding lang with a twist during initial message.

Ano yung call flow ng message at ano yung twist?
Una kelangan natin makita yung traces kung wala tayong load:



Kita nyo yung pula pula? Ibig sabihin nun nag force disconnect yung ISP nyo sa socket connection na yun.
Napansin nyo din ba na nangyayari lang yun after ng Client Hello?

Ito ay dahil di tangap ni ISP yung server name na inaaccess ng client.
Ito din yung pinag dadamot ng iba na ibigay sa inyo, aka SNI or Server Name Indication

So ano nga yung call flow at ano yung twist?
Yung call flow ay elementary basic lang



Yung twist dito is tranparent forwarding lang yung ginagamit natin, nag inject lang tayo ng Fake TLS Client Hello na message after nag establish yung TCP connection ng LocalForwardingServer at RemoteForwardingServer.

Bat ang gulo?!
Chill lang! Elementary basic lang din yung implementation nito.

LocalForwardingServer.py

#!/usr/bin/python

import socket
import time
import threading

# Adress kung saan naka run yung LocalForwardingServer
# Usually mag rurun to same machine ng OpenVPN Client
# So pweding 127.0.0.1 lang

LOCAL_SERVER_ADDRESS = ('XXX.XXX.XXX.XXX', 443)

# Address kung saan naka run yung RemoteForwardingServer
# Usually mag rurun to same machine ng OpenVPN Server
# Dapat di naka block sa firewall ng server yung 443
REMOTE_SERVER_ADDRESS = ("XXX.XXX.XXX.XXX", 443)

tosock= socket.socket(socket.AF_INET, socket.SOCK_STREAM)
fromlisten = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
fromlisten.bind(LOCAL_SERVER_ADDRESS)
fromlisten.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
fromlisten.listen(1)

def downlink(fromsock, tosock):
    print "downlink started!"
    while True:
        data = tosock.recv(1024*64)
        fromsock.send(data)

def uplink(fromsock, tosock):
    print "uplink started!"
    while True:
        data = fromsock.recv(1024*64)
        tosock.send(data)

while True:
    print "waiting for local connection.."
    fromsock,addr = fromlisten.accept()
    tosock.connect(REMOTE_SERVER_ADDRESS)
    tosock.send("16030100dd010000d90303524408300450b48f90ead85d002384a64b6c1dc570ffd1e0aca36728f3a3fff7000042c030c02cc028c024c014c00ac032c02ec02ac026c00fc005009d003d00350084c02fc02bc027c023c013c009c031c02dc029c025c00ec004009c003c002f004100ff0100006e00000015001300001070672e63646e2e76696265722e636f6d000b000403000102000a001c001a00170019001c001b0018001a0016000e000d000b000c0009000a00230000000d0020001e060106020603050105020503040104020403030103020303020102020203000f000101".decode("hex"))
    print "endpoints connected!"
    t1 = threading.Thread(target=uplink, args=(fromsock, tosock,))
    t2 = threading.Thread(target=downlink, args=(fromsock, tosock,))
    t1.start()
    t2.start()
    t1.join()
    t2.join()

RemoteForwardingServer.py

#!/usr/bin/python

import socket
import time
import threading

# Binding address ng RemoteForwardingServer
FAKESSL_SERVER_ADDRESS = ('XXX.XXX.XXX.XXX', 443)

# Address ng OpenVPN Server relative sa RemoteForwardingServer
VPN_SERVER_ADDRESS = ("localhost", 1194)

tosock= socket.socket(socket.AF_INET, socket.SOCK_STREAM)
fromlisten = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
fromlisten.bind(FAKESSL_SERVER_ADDRESS)
fromlisten.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
fromlisten.listen(1)

def downlink(fromsock, tosock):
    print fromsock
    print tosock
    print "downlink started!"
    while True:
        data = tosock.recv(1024*64)
        fromsock.send(data)

def uplink(fromsock, tosock):
    print fromsock
    print tosock
    print "uplink started!"
    print "discarding hello!"
    fromsock.recv(1024*64)

    while True:
        data = fromsock.recv(1024*64)
        tosock.send(data)

while True:
    print "waiting for local connection.."
    fromsock,addr = fromlisten.accept()
    tosock.connect(VPN_SERVER_ADDRESS)
    print "endpoints connected!"
    t1 = threading.Thread(target=uplink, args=(fromsock, tosock,))
    t2 = threading.Thread(target=downlink, args=(fromsock, tosock,))
    t1.start()
    t2.start()
    t1.join()
    t2.join()

Wow sobrang dali lang pala talaga!!
Diba?!

So ano yung hitsura ng client config?
Ganito lang:


gagawin mo lang na remote yung LocalForwardingServer's IPort

TESTS:



OpenVPN Server Hosted on AWS

 

[2018freenet]

penge naman po nang openvpn config nyu

 

[mrspliff420]

tnx idol

 

[Mult0]

Sa dinami ng binasa ko, isa lang talaga ang hanap ko. Ang working config mo at step by step na pagpapagana ng open vpn

 

[jedime]

boss config nlng po para madali nlng thanks

 

[2018freenet]

sana po may magawa kayung config openvpn ngaun d po kase gumana yung CURL REQUEST kapag naka HTTP INJECTOR

 

[marko81]

config nalang po

 

[PHC_clockbooster]

Ahhh lest direct po may opvn po kayo pang PC

 

[2018freenet]

ngaun kolang na intindihan yung importancya nang WIRESHARK sana po may config na

 

[prinzrainer]

Sorry guys pero proof of concept palang yan, pansin nyo yung implementation ay python palang tapos one client at a time lang din yung pwedi. Madalian na post lang to kanina ko lang kasi naasikaso yung server ko. Mag uup ako ng production level na implementation using c++ para mas mabilis. Follow nyo nalang ako sa github para informed kayo kung available na yung ForwardingServer
Github: You do not have permission to view the full content of this post. Log in or register now.

 

[Vanzkie3128]

Udp config ba to? Pag sa tcp protocol error pa rin. Gusto ko lng e clarify. Marami kasi naghinala sa 443 jan sa ovpn kung anong type. (Ssl suspected nila)

 

[karnekurt]

nakakatamad mag basa haha. pero basahin ko parin mea mea.sana gumagana na sa ovpn

 

[prinzrainer]

Udp config ba to? Pag sa tcp protocol error pa rin. Gusto ko lng e clarify. Marami kasi naghinala sa 443 jan sa ovpn kung anong type. (Ssl suspected nila)

Nasa post ko paps.
Transparent forwarding lang yung sakin with a twist basahin mo nalang yung details sayang yung props ko.
Pwedi mo din tingan dito kung ano yung ibang bypass methods https://phcorner.org/threads/700148/#post-11925141
Napagana ko na yung DNS Tunnelling both TCP and UDP pero feasible lang yun for IoT (~5kbps lang yung throughput)

 

[Vanzkie3128]

Nasa post ko paps.
Transparent forwarding lang yung sakin with a twist basahin mo nalang yung details sayang yung props ko.

Ok g ko na. 127.0.0.1 lng sa fake dba. Ok lets go

 

[crushkitaalammoba]

kudos sa post ni ts. ganda ng pagkagawa at informative. parang sysad si ts or programmer. or baka h.a.cker. hehehee

 

[2018freenet]

Ok g ko na. 127.0.0.1 lng sa fake dba. Ok lets go

boss share ka naman pag gumana para ma tapus kona assignment ko

 

[2018freenet]

kudos sa post ni ts. ganda ng pagkagawa at informative. parang sysad si ts or programmer. or baka h.a.cker. hehehee

View attachment 580949

paps share naman kung may working openvpn config kana

 

[prinzrainer]

Ok g ko na. 127.0.0.1 lng sa fake dba. Ok lets go

kelangan mo rin e run yung RemoteForwardingServer.py sa server side.

 

[Alice Schuberg]

thanks sa idea, applicable kaya ito sa droplets?

 

[prinzrainer]

thanks sa idea, applicable kaya ito sa droplets?

kahit san paps basta may public ip