Children crashed when scanning rstp (v9.0)

creamiced commented 5 years ago

error info:

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2019-08-07 17:39:28 [DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:1), ~1 try per task [DATA] attacking rtsp://x.x.x.x:554/ [VERBOSE] Resolving addresses ... [VERBOSE] resolving done [ATTEMPT] target x.x.x.x - login "admin" - pass "admin12345" - 1 of 1 [child 0] (0/0) [ERROR] children crashed! (0) [REDO-ATTEMPT] target x.x.x.x - login "admin" - pass "admin12345" - 2 of 2 [child 0] (1/1) [ERROR] children crashed! (0) [REDO-ATTEMPT] target x.x.x.x - login "admin" - pass "admin12345" - 3 of 3 [child 0] (2/2) [ERROR] children crashed! (0) [REDO-ATTEMPT] target x.x.x.x - login "admin" - pass "admin12345" - 4 of 4 [child 0] (3/3) [ERROR] children crashed! (0) [STATUS] attack finished for x.x.x.x (waiting for children to complete tests) 1 of 1 target completed, 0 valid passwords found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2019-08-07 17:39:30

host info:

# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 18.04 LTS Release: 18.04 Codename: bionic # uname -a Linux ubuntu 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Already install all libs required in README.

config info:

# ./configure --debug

Starting hydra auto configuration ... Detected 64 Bit Linux OS

Checking for zlib (libz.so, zlib.h) ... ... found Checking for openssl (libssl, libcrypto, ssl.h, sha.h) ... DEBUG: SSL_LIB= include /etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf /etc/ld.so.conf.d/libc.conf /etc/ld.so.conf.d/x86_64-linux-gnu.conf /lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/libfakeroot /usr/local/lib /usr/local/lib/x86_64-linux-gnu /lib64 /usr/lib64 /usr/local/lib64 /opt/local/lib64 /lib /usr/lib /usr/local/lib /opt/local/lib DEBUG: SSL_INC=/usr/include /usr/local/include /opt/include /opt/local/include DEBUG: SSL_PATH=/usr/lib/x86_64-linux-gnu/libssl DEBUG: CRYPTO_PATH=/usr/lib/x86_64-linux-gnu/libcrypto DEBUG: SSL_INC=/usr/include/openssl/ssl.h ... found Checking for gcrypt (libgcrypt.so) ... ... gcrypt not found, radmin2 module disabled Checking for idn (libidn.so) ... DEBUG: IDN_PATH=/usr/lib/x86_64-linux-gnu/libidn DEBUG: IDN_IPATH=/usr/include/stringprep.h DEBUG: PR29_IPATH=/usr/include/pr29.h ... found Checking for curses (libcurses.so / term.h) ... DEBUG: CURSES_PATH=/libcurses DEBUG: CURSES_IPATH=/term.h ... NOT found, color output disabled Checking for pcre (libpcre.so, pcre.h) ... DEBUG: PCRE_PATH=/lib/x86_64-linux-gnu/libpcre DEBUG: PCRE_IPATH=/usr/include/pcre.h ... found Checking for Postgres (libpq.so, libpq-fe.h) ... DEBUG: POSTGRES_PATH=/usr/lib/x86_64-linux-gnu/libpq DEBUG: POSTGRES_IPATH=/usr/include/postgresql/libpq-fe.h ... found Checking for SVN (libsvn_client-1 libapr-1.so libaprutil-1.so) ... DEBUG: SVN_PATH=/usr/lib/x86_64-linux-gnu/libsvn_client-1 DEBUG: APR_PATH=/usr/lib/x86_64-linux-gnu/libapr DEBUG: SVN_IPATH=/usr/include/apr-1.0/ DEBUG: APR_IPATH=/usr/include/apr-1.0/ ... found Checking for firebird (libfbclient.so) ... DEBUG: FIREBIRD_PATH=/usr/lib/x86_64-linux-gnu/libfbclient DEBUG: FIREBIRD_IPATH=/usr/include/ibase.h ... found Checking for MYSQL client (libmysqlclient.so, math.h) ... DEBUG: MYSQL_PATH=/usr/lib/x86_64-linux-gnu/libmysqlclient DEBUG: MYSQL_IPATH=/usr/include/mysql/mysql.h ... found Checking for AFP (libafpclient.so) ... DEBUG: AFP_PATH=/libafpclient DEBUG: AFP_IPATH=/afp.h ... NOT found, module Apple Filing Protocol disabled - Apple sucks anyway Checking for NCP (libncp.so / nwcalls.h) ... DEBUG: NCP_PATH=/libncp DEBUG: NCP_IPATH=/ncp/nwcalls.h ... NOT found, module NCP disabled Checking for SAP/R3 (librfc/saprfc.h) ... DEBUG: SAPR3_PATH=include/librfc DEBUG: SAPR3_IPATH=/saprfc.h ... NOT found, module sapr3 disabled Get it from http://www.sap.com/solutions/netweaver/linux/eval/index.asp Checking for libssh (libssh/libssh.h) ... DEBUG: SSH_PATH=/usr/lib/x86_64-linux-gnu/libssh DEBUG: SSH_IPATH=/usr/include/libssh/libssh.h ... found Checking for Oracle (libocci.so libclntsh.so / oci.h and libaio.so) ... DEBUG: ORACLE_LIB= include /etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf /etc/ld.so.conf.d/libc.conf /etc/ld.so.conf.d/x86_64-linux-gnu.conf /lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/libfakeroot /usr/local/lib /usr/local/lib/x86_64-linux-gnu /lib64 /usr/lib64 /usr/local/lib64 /opt/local/lib64 /lib /usr/lib /usr/local/lib /opt/local/lib DEBUG: ORACLE_INC=/usr/include /usr/local/include /opt/include /opt/local/include DEBUG: ORACLE_PATH=/libocci DEBUG: ORACLE_PATH=/libaio DEBUG: ORACLE_IPATH=/oci.h ... NOT found, module Oracle disabled Get basic and sdk package from http://www.oracle.com/technetwork/database/features/instant-client/index.html Checking for GUI req's (pkg-config, gtk+-2.0) ... ... found Checking for Android specialities ... ... strrchr() found ... RSA_generate_key() found Checking for secure compile option support in gcc ... Compiling... yes Linking... yes

Hydra will be installed into .../bin of: /usr/local (change this by running ./configure --prefix=path)

DEBUG: XDEFINES= -DHAVE_MYSQL_MYSQL_H -DLIBOPENSSL -DLIBFIREBIRD -DLIBIDN -DHAVE_PR29_H -DHAVE_PCRE -DLIBMYSQLCLIENT -DLIBPOSTGRES -DLIBSVN -DLIBSSH -DHAVE_ZLIB -DHAVE_MATH_H DEBUG: XLIBS= -lz -lssl -lfbclient -lidn -lpcre -lmysqlclient -lpq -lsvn_client-1 -lapr-1 -laprutil-1 -lsvn_subr-1 -lssh -lcrypto DEBUG: XLIBPATHS=-L/usr/lib -L/usr/local/lib -L/lib -L/usr/lib/x86_64-linux-gnu -L/lib/x86_64-linux-gnu -L/usr/lib/x86_64-linux-gnu DEBUG: XIPATHS= -I/usr/include/mysql -I/usr/include -I/usr/include -I/usr/include -I/usr/include/postgresql -I/usr/include -I/usr/include/subversion-1 -I/usr/include/apr-1.0 -I/usr/include/subversion-1 DEBUG: PREFIX=/usr/local DEBUG: XHYDRA_SUPPORT=xhydra DEBUG: STRIP=strip Writing Makefile.in ... now type "make"

vanhauser-thc commented 5 years ago

can you please do:

make clean ./configure -> edit the Makefile and add -g option to the OPTS= ... line and ulimit -c unlimited -> redo the hydra command with the new compiled hydra => hopefully this creates a core, replace with the correct location of the corefile gdb ./hydra core

creamiced commented 5 years ago

Unfortunately, I've tried it and no hydra coredump file created. i've tested with a simple error C program and this host can generate coredump file properly. I tested it in a Ubuntu VM in MacOS ParallelDesktop. In a CentOS 7.3 in a physical machine, it also crashed. And if I try to scan a non-rtsp port, the same error occurs: (this ip is my router and 80 is its web port) # hydra -I -s 80 -l admin -p admin12345 -vV -o out.sjon -t 1 10.0.0.1 rtsp Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2019-08-07 23:28:00 [DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:1), ~1 try per task [DATA] attacking rtsp://10.0.0.1:80/ [VERBOSE] Resolving addresses ... [VERBOSE] resolving done [ATTEMPT] target 10.0.0.1 - login "admin" - pass "admin12345" - 1 of 1 [child 0] (0/0) [ERROR] children crashed! (0) [REDO-ATTEMPT] target 10.0.0.1 - login "admin" - pass "admin12345" - 2 of 2 [child 0] (1/1) [ERROR] children crashed! (0) [REDO-ATTEMPT] target 10.0.0.1 - login "admin" - pass "admin12345" - 3 of 3 [child 0] (2/2) [ERROR] children crashed! (0) [REDO-ATTEMPT] target 10.0.0.1 - login "admin" - pass "admin12345" - 4 of 4 [child 0] (3/3) [ERROR] children crashed! (0) [STATUS] attack finished for 10.0.0.1 (waiting for children to complete tests) 1 of 1 target completed, 0 valid passwords found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2019-08-07 23:28:03

Is there anything I can do to help?

vanhauser-thc commented 5 years ago

hmm It does not crash for me.

but what I can see in your output:

Hydra v8.9.1

that is an old version and not the current github state. do:

git clone https://github.com/vanhauser-thc/thc-hydra
cd thc-hydra
./configure
make
sudo make install

vanhauser-thc commented 5 years ago

@creamiced ? can you please react?

vanhauser-thc / thc-hydra