Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
45
Attempt to shutdown server (whole system, start, shutdown, shutdown):
OK.
So, it appears if someone is connected during the attack it will save the server 
from crashing, but the server will lose all existing PPTP connections, and will 
not be able to negotiate new ones until the server is rebooted (or possible other 
services restarted, maybe there's a combination that could be found to work).
Of course, the recommendation is upgrade to latest service packs and patches.
Will test these attack again with the same system having all the current patches 
(though no manual registry hacks).
After upgrading system to SP 6a:
Attack server with win98se client NOT connected:
start, 04:28:00
CPU jumps to 9-14%. climbed as high as 20%
memory stable.
Stopped attack at 04:30:00
CPU dropped back down to 1%
Tested to see if client could connect after attack:
Affirmative.
Attack server with Win98se client connected:
attack start 04:31:05
client connect attempt start at 04:40, no problem connecting
pings working fine both from external IP and internal VPN IP’s.
summary attack has no effect now.
pptpattack1
while w2kpro (updates) is connected.
Server baseline at 112mb ram & 0-1% CPU utilization while running event log, 
command line pinging client at VPN IP 192.168.0.100, RRAS manager open.
begin attack at 14:34:00 
no immediate noticeable effect except that CPU stopped dropping to 0% and 
steadied around 1%, mostly steady at 1%, no ram increase, system remains 
responsive.
Client still connected and pings still going fine.
No ram usage increase.
end attack 14:39:04
notice CPU goes to about 30% for a minutes, then back down to 1% no memory 
0

---