Ghost Recon Advanced Warfighter – Integer Overflow / Array Indexing Overflow
Source: http://aluigi.org/adv/grawful-adv.txt ####################################################################### Luigi Auriemma Applications: Ghost Recon Advanced Warfighter Ghost Recon Advanced Warfighter 2 http://ghostrecon.us.ubi.com/graw2/ Versions: GRAW <= 1.35 GRAW2 <= 1.05 Platforms: Windows Bugs: A] interger overflow B] Array indexing overflow Exploitation: remote, versus server Date: 07 Jul 2010 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Ghost Recon Advanced Warfighter (GRAW) and its sequel (GRAW2) are two well known games developed by GRIN (http://www.grin.se) and part of the famous game series called Ghost Recon. ####################################################################### ======= 2) Bugs ======= ------------------- A] integer overflow ------------------- The games are affected by an integer overflow in a particular type of packet that makes the following operations: - takes the number from a 16 bit field (offset 4) - multiplicates it by 1300 - takes the 32 bit number after it at offset 6 - substracts the first number from the second one - checks if the result is bigger than the size of the packet (signed) - performs a byte-per-byte copying on a heap buffer -------------------------- B] Array indexing overflow -------------------------- In some types of packets an 8bit value is used for accessing an array used for internal operations (pointers and so on). So through the setting of particular values for that 8bit field is possible to crash the server during these internal operations. In both the cases doesn't seem possible to have worst effects than invalid memory accesses. ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/udpsz.zip or https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14286.zip (grawpoc.zip) A] udpsz -C "0100 13 0003 0000 ffffffff" -b 0x41 SERVER 16250 3000 B] udpsz -C "0100 0d" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000 or udpsz -C "0100 0e" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000 ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |