Microsoft pptp vpn vulnerabilities Exploits in Action

How the Exploit Works:
Anger.c has several attack modes.
The most basic passive mode simply “sniffs” the traffic from a PPTP 
challenge-response event, it parses out the MS-CHAP portion and outputs the 
information to any file in a format compatible with the L0phtcrack password 
cracking tool.
Anger.c can also initiate an active attack manipulating the MS-CHAP 
version 1 protocol. It is able to initiate a “change password” request to the PPTP 
client attempting to logon to the PPTP VPN server. The user will then see a 
password change request dialog box appear on the screen. The user will then fill 
it out and submit the information, then the attacker will easily acquire this 
information. These hashes will then be formatted and output to a L0phtcrack 
compatible file for cracking. The attacker could also just use these raw hashes 
using a modified version of a PPTP client to logon directly to the VPN server.
0

---