Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
21
Mac OS 9.1 (default) plus various PPTP products
Mac OS X (default) plus various PPTP products
MAC OS X (all updates) plus various PPTP products
The “attacker” system had several operating systems installed to allow for 
the widest range of tools, some accessed by multi boot partitions, and others 
from inside VMware running on Linux as the “host” operating system:
Red Hat 7.3 (all updates)
Windows 2000 Advanced Server (all updates) plus W2k Resource Kit
Solaris 7 x86 (all updates)
FreeBSD 4.5 (all updates)
OpenBSD 3.1 (all updates)
System equipment varied greatly from very low end:
Pentium 100 Mhz, 48 MB ram, 800 MB HD, 10 Mbps NIC
Low to mid range:
Pentium 233 Mhz, 128-385 MB ram, 2 to 8 GB HD, 10/100 NICs
Ultra 10 300 Mhz, 640 MB Ram, 3x 10/100 NICs, 9 GB HDs
Ultra 10 333 Mhz, 1,024 MB Ram, 1x 10/100 NIC + 1 Quad 10/100 
NIC, 9GB SCSI HDs.
Higher end systems:
Athlon 750 Mhz, 512 to 640 MB ram, 30 to 100 GB HD, 100 Mbps 
NICs
Attacker system (laptop):
Pentium III 1,000 Mhz (mobile), 512 MB Ram, 20 GB HD, 10/100 
NIC, Orinoco Wavelan “Gold” 128 bit 802.11b PCMCIA card, Sierra 
Wireless AirCard 300 CDPD PCMCIA card, Merlin Ricochet 
wireless card, 56 Kbps analog modem, VMware 3.1.1 build 1790