13

I am changing a users laptop and they have saved their username and passowrd in the OpenVPN GUI. Naturally they don't know their password because they entered them a while back and click "save password". Is there anyway to recover these details so that I can migrate them to the new laptop without having to get the VPN account reset (which would be quite a lot more difficult that it should be!).

Both laptops are Windows 10.

I have copied the .ovpn, p12 and .key files over but the GUI still prompts for the username and password. There is no password text file inside the config directory (under OpenVPN under Program Files).

I've search the registry too but couldn't find the info there.

EDIT: To be clear I don't actually need to "recover" the password. If it is encrypted in a registry key for example, that is fine, I could export the key from the old laptop and import it on the new one. I need to find a way to copy the details from laptop1 to laptop2.

1
  • Since keywords are protected using system security services I doubt copy-pasting the encrypted record is going to work. Did it work in your case? Oct 21, 2021 at 7:40

3 Answers 3

14
+100

Per the OpenVPN GUI source code, saved passwords are stored in the registry under HKCU\Software\OpenVPN-GUI\configs.

17

The Powershell script in this link gets the password for me: OpenVPN Password Recovery

The registry names on my computer are a bit different; my version:

$keys = Get-ChildItem "HKCU:\Software\OpenVPN-GUI\configs"
$items = $keys | ForEach-Object {Get-ItemProperty $_.PsPath}

foreach ($item in $items)
{
  $encryptedbytes=$item.'auth-data'
  $entropy=$item.'entropy'
  $entropy=$entropy[0..(($entropy.Length)-2)]

  $decryptedbytes = [System.Security.Cryptography.ProtectedData]::Unprotect(
    $encryptedBytes, 
    $entropy, 
    [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
 
  Write-Host ([System.Text.Encoding]::Unicode.GetString($decryptedbytes))
}

You may also need to execute Add-Type -AssemblyName System.Security in Powershell to make it work.

edit: on windows 10, OpenVPN v11.9, $encryptedbytes=$item.'key-data'

2
  • 5
    Worked for me changing 'key-data' to 'auth-data'
    – leonbloy
    Mar 20, 2020 at 23:10
  • @leonbloy / Alex has anyone seen my question here stackoverflow.com/q/70934162/365107 ? How do I get OpenVPN Username in the same way, I have also put what I tried as code there, can anyone assist in fixing the issue ?
    – Vicky Dev
    Feb 7 at 0:08
0

Adding to the answer from Alex:

You can also easily extract the username as well if required by adding the following two lines:

$username=$encryptedbytes=$item.'username'
Write-Host ([System.Text.Encoding]::Unicode.GetString($username))

Also note that depending on your PowerShell config, you might need to run the following two commands first before the script can work (to allow scripts and enable the security types needed for the decryption process):

set-executionpolicy remotesigned 
Add-Type -AssemblyName System.Security

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.