Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
47
no apparent effect so far.
just attacking with no client connected still.
14:58:30 all still well no apparent effect.
Try to connect client during attack at 14:59:00
client connected fine, system still behaving normally.
stopped attack at 15:01:00 (5 minutes). everything appears normal, will perform 
shutdown to verify and clear buffers.
logs all normal.
note attacker and VPN on Cisco switch, laptop on hub behind router, so couldn't 
sniff anything except ping from the client on the hub.
normal shutdown.
checked logs after reboot:
normal.
PPTP Attack #3:
Laboratory Log notes:
This takes a while to crash the victim, somewhere around 350,000 to 400,000 
packets, but it is CUMULATIVE, meaning, you can come back later to complete 
the count!
Also see what the system logs list, various failures of system errors.
CPU will climb to 100%, and commands will fail, such as commands at 
the command line like DIR.
Start 07:20 am.
CPU immediately shot up to 54%, and slowly climbed from there.
Fluctuating about 5% example 54-59, 55-50, etc.
Memory consumption also skyrocketed, went from idling at around 30MB to 
using up about 1 more MB per second
07:22 CPU jumps to  100%, memory usage at 125MB, stopped climbing.
system has total of 256 MB physical btw, so about 50% memory.
attempt to start>settings>control panel, met with no response.
start>run = nothing appears.
no HD activity.
tried to open "My Computer" from the desktop, received error:
"There is not enough free memory to run this program. Quit one or more 
programs and try again."
And yet, if I look at system processes, it lists 96% used for Idle!
07:26, stopped attack, still no change on system from once the system pegged.
Tried a right click properties on "My Computer" received error message popup:
Title: Control Panel
rundll32.exe
“Insufficient system resources exist to complete the requested service.”
0

---