Need help with hostscan-bypass?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

Gilks
152 Stars 32 Forks 12 Commits 2 Opened issues

Description

Generate OpenConnect CSD files to bypass Cisco AnyConnect hostscan requirements

Services available

!
?

Need anything else?

Contributors list

# 427,264
Go
6 commits
# 169,597
Shell
C
Objecti...
metaspl...
1 commit
# 608,591
Go
1 commit

Hostscan Bypass

Generate an OpenConnect Cisco Secure Desktop (CSD) file that bypasses AnyConnect hostscan requirements.

This script parses an AnyConnect client connection and outputs a CSD file that can be used with OpenConnect. The CSD file will perform a POST request to the AnyConnect server, giving the illusion a hostscan took place. Even if the AnyConnect server does not publish binaries for your Operating System (OS), you will still be able to connect. This is due to the fact that OpenConnect allows you to specify which OS you are connecting from. This means you can be on a Linux box and pretend to be a Windows client!

WARNING: Doing this will bypass the checks hostscan performs. This may be against your company's policy. By using this script and the resulting CSD file, you are using these files at your own risk. This script is for educational purposes only.

Using MacOS with the Hostscan Bypass

The hostscan bypass was originally coded and tested against a Windows machine running AnyConnect. I do not personally have the resources to troubleshoot issues on MacOS. However, @cjbirk did a bit of troubleshooting and successfully generated a CSD file using the bypass on MacOS. Please see this issue for suggestions on troubleshooting any mac related issues.

Blog

You can find the associated blog for this tool here.

Quick Start

Note: You will need to install go. That process won't be covered here.

  1. sudo go run hostscan-bypass.go -l  -p 443 -r :443 -s
  2. Use AnyConnect and connect to
    
    
  3. Wait. You do not need to enter in any credentials for hostscan to start. By default, the CSD file will be named
    hostscan-bypass.sh
    .
  4. Make the CSD file executable (otherwise OpenConnect can't use it):
    chmod +x hostscan-bypass.sh
  5. Finally, connect:
    sudo openconnect --csd-wrapper=hostscan-bypass.sh  --os=win

Shout Outs

  1. hostscan-bypass.go
    was hacked off of tcpprox. Thanks @staaldraad!
  2. Fromzy, who posted the most simple CSD example
  3. @bmaddy, who posted examples and resources that aided in the completion of this project
  4. @cjbirk for taking the time to figure out how to successfully intercept AnyConnect on MacOS!

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.