Luigi Auriemma

People have tried to screw with my server, I saw it in my logs. I want to try this now myself on my own server.

I saw a number of topics about this tool on this forum.
But I still don't know what I am doing wrong.

I start q3dirtrav.exe
Then I start Call of Duty 4 Multiplayer.
I connect to a server, it automatically downloads the mod files.
Then I alt tab and I refresh the processes then fill in the output filename.
Afther that I click the iw3mp.exe and I click activate exploint.
This is the respond of the tool:


Then I go back to Call of Duty 4 Multiplayer and place this in console:
/download main/server.cfg

But nothing happens, no error, nothing. Also the server log file doesn't show anything.

in the CoD series you need to use also another tool called forfopen:
post3479.html#p3479

in any case when you launch the /download command the game should restart the map, if it doesn't then means there is something incorrect like the server (or the client, you) with downloads disabled

K Thanxs.
When I fill in /download just_a_map/file_that_does_not_excist.cfg
I get this error in my cod4 console: Error: CL_ParseServerMessage: Illegible server message 69
When I fill in the correct path to the cfg I do not get an error.

But I can't find the tmp.txt file.
I also tried this: post9740.html#p9740
But this map does not excist on my pc: C:\Users\User\AppData\Local\VirtualStore\Program Files\Activision\Call of Duty 4 - Modern Warfare\

I can go to: C:\Users\User\AppData\Local\VirtualStore\Program Files\
But there is no Activision map in there.

I have Windows 7 x64 and Call of Duty 4 installed in D:\Call of Duty 4 - Modern Warfare\
The files also inst in there.

Is there something I am doing wrong?

Put your files in the Moden warfare root folder,
Boot them from there.

btw, you should get a sort of vid_restart when doing the /download command

It works on my other compter with xp :)
Thanxs

it works on ayn windows, this is how i do it on cod4
open foropen, type in "temp.txt" press enter (foropen must be in root cod4 folder, where iw3mp is located, but this is not the case for cod2 where you put it in main folder [you dont even need fopen sometimes])
open q3dirtrav
get in my (dont use this on others servers without admins permission!) cod4 server, /cl_wwwdownload 0
alt+tab, type in q3dirtrav "temp.txt" select iw3mp.exe in process list (button may not be enabled, but just click on the textbox, and it will be enabled)
get in game,and type in console: /download main/server.cfg (or whatever is the path/name of cfg, also, im working on a brute-forcer for this, which will try to find irregular paths and names of config file, be sure that il post it here when im finished :D)
if you did all as described, your client will reconnect you (or disconnect you in case that server is patched or something) and foropen will say sometihn like press ctrl+c to close (aluigi's fopen is a bit different then mine) and in cod4 root folder there will be temp.txt holding the config of the server

hope this helps!

Thanxs :D

Good luch with your tool. I can try it on my server. I don't have a server.cfg so :)

well, you have some kind of configuration on your server (most likely)
but q3dirtrav isn't limited to configuration files, so for instance, you could do the following:
/download main/iw_00.iwd

or if server has pb webtool:

/download pb/pbsv.cfg

and read the pb webtool port (you obviously know the ip...) and password
there you go, you have pbwebtool, and you can do whatever you want with server

anyways, possiblities are endless (not really, lol, but you are bound to files below game's root folder :D)

Yes I know you can download everything out of the root folder :)

Yes ofcourse the pb web tool I forgot that ... Thanxs for saying it.
Going to secure that.

no problem :D
best way to secure it is to patch the servers exe with http://aluigi.altervista.org/patches/q3dirtravfix.zip

We have linux files running on the server.

consider also the possibility of just disabling downloads and voting, you can't imagine how much troubles you will kill doing it

We have a mod on the server. So we have download enabled.

But voting is disabled.

but you are using a CoD server so you can allow only the www downloads, disabling the non-www ones.
in that case you are safe

Yea that is true.

And how do I run q3infoboom?
I saw this: http://aluigi.org/adv/q3infoboom-adv.txt
And I downloaded the file.
But I don't know what I have to do now.

And when I use it on my server. What will happen? Only the cod4 server crashes or the whole hardware server?

q3infoboom is a command-line tool so launch it from cmd.exe and BE SURE to launch it also with the -q getstatus option, so:
q3infoboom SERVER PORT
q3infoboom -q getstatus SERVER PORT

the tool could be a bit slow because it scans any possible lenght of the infostring for being sure that the server is vulnerable or not.

if you are vulnerable the effect is the termination of the cod4 server's process (termination or crash, NOT the server hardware ih ih ih)

I placed the 2 files in C:
I open cmd there I type: cd\
Then I type: q3infoboom -q getstatus 28960
I get this error:
q3infoboom is not recognized as an internal
or external command, program or batch file

for doubts about the usage of the command-line refer to google or http://aluigi.org/about.htm#howuse
then remember to specify also the IP or hostname of your server before the port

I already tried typing: q3infoboom -q getstatus 12.34.56.78:28960
But I still get the same error.

I already saw the how to use. But it says this: - now type the name of the executable
But that file isn't an executable.

Do I first have to compile them to an exe?

q3infoboom.zip already contains q3infoboom.exe

Yea I know.

Only my virus scanner removed the file every time.

But now I get this error:
- getstatus crash/shutdown scan:

packet length: 1200

- last packet sent was 1200 bytes (size of data = 1186)
- check server:

Server doesn't seem vulnerable



I think it is good that the server isn't vulnerable :)
Or did I do something wrong?

Try using a different packet such as getstatus or getchallenge, as servers tend to be vulnerable to different types. Also make sure you are starting off from size 0 going to 2048

q3infoboom.exe -f 0 -t 2048 -q getstatus IP:Port would be an example of this. Hypothetically speaking, ofc.

Is that possible to programm or to edit in hex to make the command for downloading to be not /download but to be, for example, /wqas or to make us to can choose the command we want to use for downloading.

yes you can do it with a hex editor, the string is "download" with a 00 byte before and after it, example:
to:

he wasn't referring to my tool, he referred to the game server.
yeah he was totally off-topic :)

Can anyone tell me if "q3dirtrav" works on CS and CSS??? Please let me know, thanks :)

no, q3dirtrav is a proof-of-concept for a bug in the Quake 3 engine NOT the source/half-life one