THC PPTP Bruter

thc-pptp-bruter is a standalone tool designed for brute-forcing PPTP VPN endpoints. It targets the PPTP protocol on TCP port 1723 and has been tested against both Windows and Cisco gateways. The tool fully supports the latest MSChapV2 authentication mechanism commonly used in PPTP VPNs.

It exploits a specific weakness in Microsoft's anti-brute force protection, allowing it to reuse LCP connections with the same caller-id. This Windows hack is enabled by default and enables extremely high-speed password attempts, up to 300 per second.

Use cases include penetration testing of PPTP VPN services where weak credentials are suspected. The tool is efficient due to its parallel processing capabilities and rate limiting options, making it suitable for targeted brute-force attacks against vulnerable endpoints.

The tool establishes PPTP connections to the target host on TCP port 1723 and performs brute-force authentication using MSChapV2. By default, it enables the Windows hack, which reuses the LCP connection with the same caller-id to bypass Microsoft's anti-brute force protection. This allows multiple password attempts over the same connection without triggering rate limits. It supports parallel tries and can limit passwords per second for controlled operation.