Login denied (multiple issues) about hostscan-bypass

[somewhereinthepacific]

Update: I figured out what the issue was.

Changing line 77 of the script so that it uses --data-binary instead of --data-ascii fixed the problem for me.

(Well... that and manually updating the HTTP headers so that they include correct values)

When using "--data-ascii" curl removes newlines and my VPN server does not seem to like that.

Anyway, do you think this change could be merged? What is the advantage of using "--data-ascii"?

Also, in regard to the three different sets of "host-scan-ticket"+"host-scan-token", it looks like it is OK as long as the forged host scan reply and the request containing the login/password make reference to the same CSD token, which is what openconnect does.

[Gilks]

Thanks for the detailed report! It sounds like you got into the weeds on this one. Out of curiosity, what error message were you getting when trying to authenticate with openconnect?

I can't really speak to the differences between --data-ascii and --data-binary as that was part of the original code that I found by a user named Fromzy. I'll have to test that change on another network to verify everything still works as intended.

EDIT: I just verified that changing the --data-ascii flag to --data-binary works just fine on AnyConnect 4.5. If you want to put in a PR, I'll happily merge it in so you get credit. It's interesting no one has run into this so far.

[somewhereinthepacific]

Out of curiosity, what error message were you getting when trying to authenticate with openconnect?

It was the same "login failure" response I get when some of the fields on the forged request are missing.

For example, my VPN server expects the CSD script to report that Windows Firewall is active. If I were to change the forged packet to not include that piece of information, it would fail in the same way (ie. "login failure").

For all of this, I would say that not including the newlines confuses the VPN server which just treats the CSD reply as an empty one.