Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
49
System won't accept encrypted or non-encrypted connections now. it appears 
that the PPTP is hosed, I'll probably have to reapply the sp3 I bet it why.
ok, reinstalling sp3.
then after testing if works with client connected or not, do test #2, and see if you 
can get anything to happen with the ipsend attack. (remember to turn off the 
laptops firewall.
Try yet again to connect client (now using windows XP pro since it gives me 
more flexibility on the encryption level to use than win98se does.).
OK, reapply of sp3 worked. connected with 40bit encryption and mschav1 using 
XP pro (no updates) and nt4 Enterprise Server sp3 only.
Now will start attack and see if the client looses connection and if it helps to 
protect the server at all like attack number one.
client connect: 8:56
Attack start time:8:57 am
results:
utilization shot up to 35%, then 40%, then fluctuated.
memory climbed about 1MB /sec.
current open windows are task manager, event log (system), and command line 
window.
8:58, client is now experiencing about 5-10% packet loss over VPN AND regular 
network. 
exactly 9:00am system hits 100% CPU and 127mb ram used and plateaus. 
client now 100% packet loss on both VPN and network, other pinging systems 
get no ping response from server as well.
09:01:30 attack stops.
CPU and memory still same.
dir command listing produced: insufficient system resources exist to complete 
the requested service. (see picture)
attempt to refresh logs resulted in popup:
The remote procedure call failed. (see picture)
09:03:00 exactly, external ping works again!
client never dropped connection, and at this time can ping inside the VPN again, 
but CPU and memory still same.
09:05:01 attempted to connect to share 1 from client since still connected and 
able to ping, but unable to connect to share.
However was able to connect to share2 and share3 no problem.
09:05:30 server CPU utilization dropped down to normal 
09:06:00 server CPU shot back up to 100%
client still connected and such. pings still working.
was able to open control panel, but then it (the control panel window) just hung 
with an hourglass for the cursor).
system now not responding to mouse clicks, attempts to click start button 
0

---