Microsoft pptp vpn vulnerabilities Exploits in Action

1.7 MS PPTP Vulnerabilities Overview
This document will cover in considerable detail 5 exploits of vulnerabilities 
in the Microsoft implementation of PPTP and real lab based demonstrations of 
the exploits in action.
The vulnerabilities are summarized as:
DoS (Denial of Service): Can cause system to crash by attacking TCP/IP 
•
port 1723 on the listening server.
DoS: Can cause system to crash by attacking GRE (protocol 47) 
•
listening port on server
DoS: Can cause system crash by attacking GRE (protocol 47) listening 
•
port on server (another variation).
Information Compromise: Retrieve and quickly crack LANMAN hash 
•
from MSCHAP version 1 clients.
Information Compromise: Retrieve and quickly crack NT hash from 
•
MSCHAP version 2 clients.
Information Compromise: Spoof VPN server to intercept VPN traffic log 
•
enough to retrieve client has information.
Some of these vulnerabilities are fixed in later implementations, but others still 
remain even in the latest versions of Windows NT, 2000, & XP fully patched and 
updated as of June 30
th
2002. There are a number of registry hacks and not so 
easily found hot-fixes that can reduce some of these risks, but these tests were 
done under the common practice that most administrators follow of just 
performing the quickly and easily implemented updates, and not the laborious 
manual manipulations that are required for some, but not necessarily all of 
these issues to be resolved.