Microsoft pptp vpn vulnerabilities Exploits in Action

Brief summary description of protocols
In this section we will go into non-implementation specific descriptions of 
the protocols covered in this document. Implementation specific versions of 
these protocols will be covered later.
IP (Internet Protocol)
RFC 791 
http://www.ietf.org/rfc/rfc791.txt
details this well known protocol.
PPTP (Point to Point Tunneling Protocol)
RFC 2637 (
http://asg.web.cmu.edu/rfc/rfc2637.html
) describes the PPTP 
protocol in detail, but a (very) brief summary of the RFC is listed below:
There are three key parts to the PPTP protocol.
1. The Control Connection over TCP (destination port is 1723, source port 
can be any available port). THIS IS NOT AUTHENTICATED IN ANY WAY.
2. The IP tunnel used to transport GRE encapsulated packets (protocol 
47 (note, this is not PORT 47, but a specific PROTOCOL).
3. The PPP packets that are encapsulated inside of the GRE tunnel riding 
on top of IP. Note that only the DATA packets are encrypted (when encryption is 
actually used, which is left open to the implementer and not actually part of the 
PPTP RFC, only protocol numbers 0x21 through 0xFA (just the data usually) 
would then be encrypted, this means all the other PPP traffic (for example LCP) 
would not.
A tunnel must be established between each pair and a key that is included in 
the GRE packet header lists which tunnel session a PPP packet is a 
memoryber of.
The GRE header also contains:
Acknowledgement information
0

---