Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
76
void cache_challenge(struct ip *ip, struct pptp_gre_header *gre, void *pack)
{
struct {
struct ppp_lcp_chap_header chap;
struct ppp_chap_challenge challenge;
} *p;
struct challenge *ptr;
p = pack;
for (ptr = challenges; ptr != NULL; ptr = challenges->next)
{
if ((ptr->clt.s_addr == ip->ip_dst.s_addr) &&
(ptr->srv.s_addr == ip->ip_src.s_addr))
break;
}
if (ptr == NULL)
{
if ((ptr = malloc(sizeof(struct challenge))) == NULL)
fatal(NULL);
ptr->next = challenges;
ptr->clt.s_addr = ip->ip_dst.s_addr;
ptr->srv.s_addr = ip->ip_src.s_addr;
challenges = ptr;
}
if (p->challenge.size == 8)
{
if (debug)
printf("Using MS-CHAP v1\n");
ptr->version = 1;
memcpy(ptr->challenge, p->challenge.value.challenge_v1, 8);
}
else if (p->challenge.size == 16) 
{
if (debug)
 printf("Using MS-CHAP v2\n");
ptr->version = 2;
memcpy(ptr->challenge, p->challenge.value.challenge_v2, 16);
}
else
fatal("unknown version of MS-CHAP");
}
0

---