validate pptp magic cookie in responses (#650)

Author: phillip-stephens

modules/pptp/scanner.go

@@ -115,7 +115,7 @@ func (scanner *Scanner) GetTrigger() string {
 
 // PPTP Start-Control-Connection-Request message constants
 const (
-	PPTP_MAGIC_COOKIE       = 0x1A2B3C4D
+	PPTP_MAGIC_COOKIE       = 0x1A2B3C4D // PPTP Magic Cookie in bytes, see RFC 2637 section 1.4
 	PPTP_CONTROL_MESSAGE    = 1
 	PPTP_START_CONN_REQUEST = 1
 	PPTP_PROTOCOL_VERSION   = 0x0100 // Split into two 16-bit values for binary.BigEndian.PutUint16
@@ -147,16 +147,25 @@ func createSCCRMessage() []byte {
 }
 
 // Read response from the PPTP server
-func (pptp *Connection) readResponse() (string, error) {
+func (pptp *Connection) readResponse() (string, []byte, error) {
 	buffer := make([]byte, 1024)
 	if err := pptp.conn.SetReadDeadline(time.Now().Add(5 * time.Second)); err != nil {
-		return "", fmt.Errorf("could not set read deadline: %w", err)
+		return "", nil, fmt.Errorf("could not set read deadline: %w", err)
 	}
 	n, err := pptp.conn.Read(buffer)
 	if err != nil {
-		return "", err
+		return "", nil, fmt.Errorf("could not read response: %w", err)
 	}
-	return string(buffer[:n]), nil
+	return string(buffer[:n]), buffer[:n], nil
+}
+
+// Validate that the response contains the correct PPTP magic cookie
+func validateMagicCookie(response []byte) bool {
+	if len(response) < 8 {
+		return false
+	}
+	receivedMagicCookie := binary.BigEndian.Uint32(response[4:8])
+	return receivedMagicCookie == PPTP_MAGIC_COOKIE
 }
 
 // Scan performs the configured scan on the PPTP server
@@ -180,14 +189,18 @@ func (scanner *Scanner) Scan(ctx context.Context, dialGroup *zgrab2.DialerGroup,
 	}
 
 	// Read the response
-	response, err := pptp.readResponse()
+	respStr, respBytes, err := pptp.readResponse()
 	if err != nil {
 		return zgrab2.TryGetScanStatus(err), &pptp.results, fmt.Errorf("error reading PPTP response from target %s: %w", target.String(), err)
 	}
 
 	// Store the banner and control message
 	pptp.results.Banner = string(request)
-	pptp.results.ControlMessage = response
+	pptp.results.ControlMessage = respStr
+
+	if !validateMagicCookie(respBytes) {
+		return zgrab2.SCAN_PROTOCOL_ERROR, &pptp.results, fmt.Errorf("invalid PPTP magic cookie in response from target %s", target.String())
+	}
 
 	return zgrab2.SCAN_SUCCESS, &pptp.results, nil
 }