CyberCop Scanner Smbgrind 5.5 - Buffer Overflow

[+] Credits: hyp3rlinx
 
 
Vendor:
=======================
Network Associates Inc.
 
 
 
Product:
===========================================
smbgrind: NetBIOS parallel password grinder
circa 1996-1999
 
smbgrind.exe is a component of CyberCop Scanner v5.5. It is intended to
remotely crack SMB
usernames and passwords, used to establish a login session to the remote
NetBIOS file server.
Cybercop was discontinued back in 2002.
 
    usage: smbgrind -i <address> [options]
 
        -r      Remote NetBIOS name of destination host
        -i      IP address of destination host
        -u      Name of userlist file (default NTuserlist.txt)
        -p      Name of password list file (default NTpasslist.txt)
        -l      Number of simultaneous connections (max: 50 default: 10)
        -v      Provide verbose output on progress
 
 
 
Vulnerability Type:
===================
Buffer Overflow
 
 
 
CVE Reference:
==============
N/A
 
 
 
Vulnerability Details:
======================
 
Smbgrind.exe succumbs to buffer overflow when supplied a large number of
bytes (1206) for the -r switch for the remote
NetBios name of destination host. Resulting in memory corruption
overwriting several registers...
 
GDB dump...
 
Program received signal SIGSEGV, Segmentation fault.
0x0040c421 in ?? ()
(gdb) info r
eax            0x3      3
ecx            0x41414141       1094795585
edx            0x41414141       1094795585
ebx            0x41414141       1094795585
esp            0x241e89c        0x241e89c
ebp            0x241e8a8        0x241e8a8
esi            0x401408 4199432
edi            0x41414141       1094795585
eip            0x40c421 0x40c421
eflags         0x10283  [ CF SF IF RF ]
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x53     83
gs             0x2b     43
(gdb)
 
 
smbgrind core dump file...
 
(C:\smbgrind.exe 1000) exception C0000005 at 40C421
 
(C:\smbgrind.exe 1000) exception: ax 2 bx 41414141 cx 41414141 dx 41414141
 
(C:\smbgrind.exe 1000) exception: si 401408 di 41414141 bp 241F39C sp
241F390
 
(C:\smbgrind.exe 1000) exception is: STATUS_ACCESS_VIOLATION

#  0day.today [2018-04-01]  #