Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
44
Same effect, client unable to complete connection, client times-out (the client 
isn't reporting the server refusing the connection, it just times out).
Any attempt to run anything significant causes blue screen, Tried to just open 
control panel, windows started to come up, then blue screen.
Error:
0x0000001E (0xC0000005,0x8016bfaf,0x00000000,0x00000035)
This means just trying to restart the PPTP service (RAS/RRAS) won't work 
because it will crash before it can be reset.
Verification with same system while client was connected:
Connected client.
Began attack
Results:
Client stays connected, but loses ability to ping or any other traffic to the remote 
network, then client pops-up saying disconnected after about 30 seconds 
(standard timeout for no response).
However, I was able to shutdown server without crashing. 
Hypothesis, does a connected client somehow "protect" the server from the 
attack?
Try a few more trials with client connected.
Ok, try again with client connected first, to see if can shutdown safely or if that 
was a fluke.
If repeatable, then try it again, and then running various apps like control panel, 
trying to stop and start the RAS server, file explorer, etc.
Note, ping from client to server (inside VPN tunnel to 192.168.0.1) stopped the 
moment the attack started however normal (external) pings still ok 10.0.0.2.
Repeatable, server shutdown safely, even though it couldn't respond to any 
more PPTP requests, it didn't crash on shutdown.
Test running other apps after attack: 
Ran attack for 60 seconds instead of 5 seconds...
control panel:
Opened ok.
Stopping and starting the RAS service:
Services opened ok.
Shutdown Remote Access Server (service): ok
It also automatically shutdown the Remote Access Connection Manager too. ok.
Start Remote Access Server (Service):  ok , though took over a minute to start.
Try client reconnecting again:
Client still unable to connect at all. (times out)
0

---