Ghost Recon Advanced Warfighter - Integer Overflow / Array Indexing Overflow

Source:
http://aluigi.org/adv/grawful-adv.txt

#######################################################################

                             Luigi Auriemma

Applications: Ghost Recon Advanced Warfighter
              Ghost Recon Advanced Warfighter 2
              http://ghostrecon.us.ubi.com/graw2/
Versions:     GRAW  <= 1.35
              GRAW2 <= 1.05
Platforms:    Windows
Bugs:         A] interger overflow
              B] Array indexing overflow
Exploitation: remote, versus server
Date:         07 Jul 2010
Author:       Luigi Auriemma
              e-mail: [email protected]
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Ghost Recon Advanced Warfighter (GRAW) and its sequel (GRAW2) are two
well known games developed by GRIN (http://www.grin.se) and part of the
famous game series called Ghost Recon.


#######################################################################

=======
2) Bugs
=======

-------------------
A] integer overflow
-------------------

The games are affected by an integer overflow in a particular type of
packet that makes the following operations:
- takes the number from a 16 bit field (offset 4)
- multiplicates it by 1300
- takes the 32 bit number after it at offset 6
- substracts the first number from the second one
- checks if the result is bigger than the size of the packet (signed)
- performs a byte-per-byte copying on a heap buffer


--------------------------
B] Array indexing overflow
--------------------------

In some types of packets an 8bit value is used for accessing an array
used for internal operations (pointers and so on).
So through the setting of particular values for that 8bit field is
possible to crash the server during these internal operations.


In both the cases doesn't seem possible to have worst effects than
invalid memory accesses.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
or
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14286.zip (grawpoc.zip)

A]
udpsz -C "0100 13 0003 0000 ffffffff" -b 0x41 SERVER 16250 3000

B]
udpsz -C "0100 0d" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000
or
udpsz -C "0100 0e" -X 3 8 l 0 -l 50 -b 0x41 SERVER 16250 3000


#######################################################################

======
4) Fix
======


No fix.


#######################################################################