gsc-kick.txt

`Name: Michael Gray  
Website: www.ownerarium.net  
Contact: [email protected]  
Discovered Exploit: 06-05-2008  
  
Vulnerable Software Title: GSC  
Vulnerable Version: <= 2067  
Severity: CRITICAL  
Website: http://www.getgsc.com  
Reported to vendor: Yes  
Actively exploited: Yes  
  
Exploit Discovery  
------------------  
  
I was analyzing packets for an application of my own to figure out an   
issue with my own protocol when I noticed I was receiving packets that   
looked similar to that of IRC, so I decided to take a break from my own   
project and figure out what application it was. I noticed it was the   
voice communication and chat program called GSC. Since I was bored I   
figured I would poke around at some of these packets.  
  
First I logged on to my own channel as an administrator and kicked a   
friend of mine from the chat channel while recording packets. After   
capturing that packet I sent him an application to send raw packets over   
a specific socket and told him to send that to the server while he did   
not have administrator rights. Immediately after sending the packet he   
was disconnected from the channel because he was kicked. We discovered   
that the administration system's authentication is done completely   
client side and the server only sends a message to the client saying if   
the client has administrator rights to the channel, but the server   
doesn't check these rights if any administrator command is received.  
  
The Exploit  
------------  
  
1.) Log on to GSC with a valid user account  
2.) Join your own channel  
3.) Record packets that are sent/received to/from GSC  
4.) Kick a kind friend from your channel  
5.) Stop capturing packets  
6.) Modify this packet to reflect who you want to kick  
  
The packet for kicking a user looks something like this:  
  
NOTICE <user> :KICK <channel id> :<kick message>  
  
The user is the name of the user  
The channel ID is the same number used in a gsc://join:1 link  
The kick message is a string <= 15 characters  
  
Software Implementation  
------------------------  
  
Write a program that simply requests you to type in a user, a channel   
ID, and a kick message. Format the text to reflect the above example for   
the way the kick command is and encode it using UTF-8. Append the packet   
with 0x0A to show where the end of the command is. Hook your application   
to GSC and determine the socket ID of it's current connection and   
forward your packet through it's socket to the server.  
  
Additional Information  
-----------------------  
  
The above information may be adapted to fit any administrator command   
including those used to completely kick and ban users from GSC as a   
whole, rather than just in a single channel. As is currently happening,   
users will use social engineering to get users to give out account   
information and personal information by impersonating a GSC staff member   
and claiming they will shut down the channel unless this information is   
released.  
  
A C# implementation of the way packets are constructed and how to   
properly format them can be found here: http://pastebin.se/194837 or can   
be received by requesting it via email from [email protected]  
  
`