OpenVPN support

bambit · Nov 27, 2018 · 2cd1af0 · 2cd1af0
1 parent 240e07f
commit 2cd1af0
Show file tree

Hide file tree

Showing 3 changed files with 58 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -102,7 +102,7 @@ Supported software
 | Mails | Outlook, Thunderbird  | Clawsmail, Thunderbird |  |
 | Dumps from memory | Keepass, Wdigest (mimikatz method) | system password |  |
 | SVN | Tortoise  | | |
-| Sysadmin | Apache Directory studio, CoreFTP, CyberDuck, fileZilla, FTPNavigator, OpenSSH, PuttyCMRDPManager, WinSCP, Windows Subsystem for Linux | AWS,  Docker, Environnement variable, FileZilla, History files, SSH private keys |  |
+| Sysadmin | Apache Directory studio, CoreFTP, CyberDuck, fileZilla, FTPNavigator, OpenSSH, OpenVPN, PuttyCMRDPManager, WinSCP, Windows Subsystem for Linux | AWS,  Docker, Environnement variable, FileZilla, History files, SSH private keys |  |
 | Wifi | Wireless Network | Network Manager | * CF Keychains |
 | Internal mechanism passwords storage | .NET Passport, Generic Network Hashdump (LM/NT), LSA secret | GNOME Keyring, Kwallet,hashdump | Keychains, hashdump |
 

diff --git a/Windows/lazagne/config/manage_modules.py b/Windows/lazagne/config/manage_modules.py
@@ -41,6 +41,7 @@
 from lazagne.softwares.sysadmin.filezilla import Filezilla
 from lazagne.softwares.sysadmin.ftpnavigator import FtpNavigator
 from lazagne.softwares.sysadmin.opensshforwindows import OpenSSHForWindows
+from lazagne.softwares.sysadmin.openvpn import OpenVPN
 from lazagne.softwares.sysadmin.puttycm import Puttycm
 from lazagne.softwares.sysadmin.rdpmanager import RDPManager
 from lazagne.softwares.sysadmin.unattended import Unattended
@@ -138,6 +139,7 @@ def get_modules():
         FtpNavigator(),
         Puttycm(),
         OpenSSHForWindows(),
+        OpenVPN(),
         RDPManager(),
         Unattended(),
         WinSCP(),

diff --git a/Windows/lazagne/softwares/sysadmin/openvpn.py b/Windows/lazagne/softwares/sysadmin/openvpn.py
@@ -0,0 +1,55 @@
+try:
+    import _winreg as winreg
+except ImportError:
+    import winreg
+
+from lazagne.config.winstructure import *
+from lazagne.config.module_info import ModuleInfo
+from lazagne.config.winstructure import Win32CryptUnprotectData
+from lazagne.config.constant import constant
+
+
+class OpenVPN(ModuleInfo):
+    def __init__(self):
+        ModuleInfo.__init__(self, name='openvpn', category='sysadmin', registry_used=True, winapi_used=True)
+
+    def check_openvpn_installed(self):
+        try:
+            key = OpenKey(HKEY_CURRENT_USER, 'Software\\OpenVPN-GUI\\Configs')
+            return key
+        except Exception as e:
+            self.debug(str(e))
+            return False
+
+    def decrypt_password(self, encrypted_password, entropy):
+        return Win32CryptUnprotectData(encrypted_password,
+                                       entropy=entropy,
+                                       is_current_user=constant.is_current_user,
+                                       user_dpapi=constant.user_dpapi)
+
+    def get_credentials(self, key):
+        pwd_found = []
+        num_profiles = winreg.QueryInfoKey(key)[0]
+        for n in range(num_profiles):
+            name_skey = winreg.EnumKey(key, n)
+            skey = OpenKey(key, name_skey)
+            values = {'Profile': name_skey}
+            try:
+                encrypted_password = winreg.QueryValueEx(skey, "auth-data")[0]
+                entropy = winreg.QueryValueEx(skey, "entropy")[0][:-1]
+                password = self.decrypt_password(encrypted_password, entropy)
+                values['Password'] = password.decode('utf16')
+            except Exception as e:
+                self.debug(str(e))
+            pwd_found.append(values)
+            winreg.CloseKey(skey)
+        winreg.CloseKey(key)
+
+        return pwd_found
+
+    def run(self):
+        openvpn_key = self.check_openvpn_installed()
+        if openvpn_key:
+            results = self.get_credentials(openvpn_key)
+            if results:
+                return results