PPTP - Port 1723
PreviousOracle TNS Listener - Port 1521,1522-1529NextMQTT (Message Queuing Telemetry Transport) - Port 1883
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
The Point-to-Point Tunneling Protocol (PPTP) is a network protocol used to implement virtual private networks (VPNs). While PPTP has been widely adopted due to its ease of configuration and speed, it is notoriously vulnerable. Understanding how to identify, test, and exploit these vulnerabilities is essential for penetration testers.
This guide covers in-depth technical methods to identify, analyze, and exploit PPTP, allowing security professionals to perform accurate vulnerability assessments and simulate real-world attack vectors.
PPTP uses the following components:
TCP Port 1723: For control messages
GRE (Generic Routing Encapsulation): Protocol number 47, used to encapsulate PPP frames
Misconfigured or poorly filtered GRE traffic can lead to exploitable situations where the attacker intercepts or manipulates the VPN communication.
PPTP uses Microsoft’s Point-to-Point Encryption (MPPE) combined with MS-CHAPv1 or MS-CHAPv2. Both have critical weaknesses.
Susceptible to dictionary attacks
Challenge-response mechanisms can be captured and cracked
NT Hash is derived from the user password, allowing offline brute-force
To identify active PPTP services, use the Nmap port scanner targeting TCP port 1723:
Look for:
Open port 1723 (PPTP control channel)
OS fingerprinting to detect routers or VPN appliances
Use Netcat to manually interact with the PPTP port:
A PPTP server typically responds with GRE negotiation identifiers.
Use a Man-in-the-Middle approach or capture with Wireshark on port 1723 and GRE:
Extract challenge and response:
Crack using asleap:
This enables offline cracking of MS-CHAPv2 handshakes using known dictionaries.
Metasploit includes auxiliary modules for PPTP brute-force:
You can combine this with previously cracked NTLM hashes to validate credentials.
After compromising PPTP, attackers can establish a VPN session and pivot into internal networks.
Use tools like pptpsetup or pppd to establish the session:
Confirm GRE tunneling is established and route internal traffic through the VPN interface.
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚