Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
46
consumption.
no problem connecting client. results all the same.
attack server without client connected:
no apparent effect
try connecting client during attack.
works fine, no apparent effect from attack.
performed system shutdown just to verify no delayed effect like with nt. and to 
clear any caches/buffers. before next test.
perfectly normal behavior on shutdown.
Checked event logs to see if any abnormal behavior: 
All normal.
PPTP Attack #2:
Laboratory Log notes:
Will blue screen quickly, usually about 50 packets required
09:46:00 
attacking via sun box (u333 not u300) since FreeBSD inside VMware inside 
Linux didn't seem to do anything at all.
2nd test, see if affects clients ability to connect, or disconnects client (dos)
nope, doesn't seem to have any effect at all.
noticed only a 1% increase in CPU utilization between attacking and not 
attacking. will let run for a while about 15 minutes or (10:00-ish) to see if 
anything hap[en cumulatively.
the traffic is definitely showing up on the network via activity at the switch and 
the NIC.
will try some sniffing via laptop, move laptop to the 10.0.0.x network.
do some capturing via ethereal to see what's up.
Test if ipsend works from Solaris 8 router, then try attack from there if it does 
(part of ipfilter package)
The current ipfilter version installed on the Solaris 8 router doesn't know what 
GRE protocol is.
Fixed by updating the /etc/protocols.ipfilter
Victim system now goes down within 5 seconds of beginning attack.
pptpattack2 against windows 2000 server
state attack 14:56:00
attack from Solaris box.
ram base line 99mb CPU 1%
0

---