I’m on day 2 of trying to upload a reverse shell to the the o**n configurator. I’ve tried every thing that makes sense and nothing works, I’m ready to ask for help. I read the article on ovpn command injection from Tenable and I know you can’t just copy/paste his conf because the quotes are not real quotes, the IP needs to be changed, and ‘nobind’ has to be in it.
Literally any input I put in the configurator returns “executed successfully” so I cant tell if anything I’m doing is working.
I replaced the ‘up ’ line with a simple wget back to the main machine, no luck, no injection. Yes, I included the nobind argument in my conf. I can’t imagine wtf the next step is, but if this VPN thing is a red herring I’m going to flip the f*** out.
Can anyone please pm me hint for this part?