exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

smbgrind.exe Buffer Overflow

smbgrind.exe Buffer Overflow
Posted Feb 16, 2016
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

smbgrind.exe suffers from a buffer overflow vulnerability.

tags | exploit, overflow
SHA-256 | a6cc32b60c5b420033593bbd7a0064d9e918dd7334c279a954bb80f532def656

smbgrind.exe Buffer Overflow

Change Mirror Download
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/SMBGRIND-BUFFER-OVERFLOW.txt



Vendor:
=======================
Network Associates Inc.



Product:
===========================================
smbgrind: NetBIOS parallel password grinder
circa 1996-1999

smbgrind.exe is a component of CyberCop Scanner v5.5. It is intended to
remotely crack SMB
usernames and passwords, used to establish a login session to the remote
NetBIOS file server.
Cybercop was discontinued back in 2002.

usage: smbgrind -i <address> [options]

-r Remote NetBIOS name of destination host
-i IP address of destination host
-u Name of userlist file (default NTuserlist.txt)
-p Name of password list file (default NTpasslist.txt)
-l Number of simultaneous connections (max: 50 default: 10)
-v Provide verbose output on progress



Vulnerability Type:
===================
Buffer Overflow



CVE Reference:
==============
N/A



Vulnerability Details:
======================

Smbgrind.exe succumbs to buffer overflow when supplied a large number of
bytes (1206) for the -r switch for the remote
NetBios name of destination host. Resulting in memory corruption
overwriting several registers...

GDB dump...

Program received signal SIGSEGV, Segmentation fault.
0x0040c421 in ?? ()
(gdb) info r
eax 0x3 3
ecx 0x41414141 1094795585
edx 0x41414141 1094795585
ebx 0x41414141 1094795585
esp 0x241e89c 0x241e89c
ebp 0x241e8a8 0x241e8a8
esi 0x401408 4199432
edi 0x41414141 1094795585
eip 0x40c421 0x40c421
eflags 0x10283 [ CF SF IF RF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x53 83
gs 0x2b 43
(gdb)


smbgrind core dump file...

(C:\smbgrind.exe 1000) exception C0000005 at 40C421

(C:\smbgrind.exe 1000) exception: ax 2 bx 41414141 cx 41414141 dx 41414141

(C:\smbgrind.exe 1000) exception: si 401408 di 41414141 bp 241F39C sp
241F390

(C:\smbgrind.exe 1000) exception is: STATUS_ACCESS_VIOLATION



[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

hyp3rlinx
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close