Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
68
L0phtcrack
http://www.atstake.com/research/lc/
2002
IETF (Internet Engineering Task Force)
www.ietf.org
2600 Magazine
www.2600.com
Phrack
www.phrack.com
6.0 SOURCE CODE
6.1 Anger.c
/*
* anger.c v1.33 by Aleph One
*
* This program implements:
*
* a) A PPTP challenge/responce sniffer. These c/r can be input into
* L0phtcrack to obtain the password.
*
* b) An active attack on PPTP logons via the MS-CHAP vulnerability to
* obtain the users password hashes. Notice that this also generates
* the password hashes of the new password the user wanted to use.
* These can be input into L0phtcrack to get password, into a modified
* smbclient to logon onto a SMB sever, or into a modified PPP client
* for use with the Linux PPTP client.
*
* You must compile this program against libpcap and the openssl crypto
* library (or a library that implements the DES and SHA API). Example:
*
* 
gcc -o anger anger.c in_cksum.c -lcrypto -lpcap
*
* Changes:
*  [10/26/2000] Added support for sniffing MSCHAPv2 challenge/responses.
*/
#include
#include
0

---