There are many materials about the Dictionary attack or bit-flipping attack to PPTP VPN. But is it possible to implement a downgrade attack to pptp.

mitm downgrade attack

This is a picture showing how to implement a downgrade attack to pptp (from https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-ornaghi-valleri.pdf).

I've tried in this way, but doesn't work. And I got some wired results: if I change the configure-request packet form server to client, replacing its CHAP with PAP, and then I change the configure-request packet from client to server, adding a PAP option in it. The configuration process will never stop, server and client will get into a dead-lock loop, keep sending configure-request packets to each other.

After some research, I found out that: the mitm must send a Nak packet to server in order to reject the CHAP option. Maybe this Nak packet will terminate the dead-lock loop. But this will mess up the GRE sequence number of client, because this Nak packet is sent by mitm, not client.

Is there any other way to implement a downgrade attack to PPTP? I've stuck here for a very long time, and I'd appreciate any advice.

  • 1
    If I read your diagram correctly, you shouldn't replace CHAP with PAP in the server to client packet, but with something the client won't recognize, so that you get a nak from the client. – user2313067 Nov 15 '16 at 22:03
  • Thank you very much , @user2313067. I've tried to replace it with an invalid value, still not working. But anyway, thanks for your advice – Shawn Kang Nov 16 '16 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.