Luigi Auriemma

Hi!

When i recently bought a cod4 server, i got acces to control panel of it, and after one night of playing, i thought of an idea . So i slept the night over, and next day i got into control panel, got into command line manager, checked what's the last command is writen in line (i had problems with rcon stealing, so server provider set me up with additional box to set the rcon password in command line), so last waht was writen in the line was +map_rotate, and my +set_rconpassword was jsut before it, so i typed in the rcon password setting box: PASSWORD +set sv_maxclients 64
and voila, i saved everything, restarted the server, and i had 64 usable slots, tho i paid for 12 :D

the trick is that if a command is repeated, the one that is stated as last will actually take the effect

i even wrote a greasemonkey script as a proof of conceptl, but i didnt release it anywhere till now (it's nothing special. you will have to adjust it to make it work on you game panel)
script:


i know, it looks awfull, but it works just fine
to make this work, you need to get elements of the textbox to write to (in my case, first element didnt have id, so i had to get it by name)

this SHOULD work with most game panels, except if some have filtering (i doubt it, as i didnt see aynone post this kind of exploit aynwhere, tho i could be wrong)

WARNING: your server provider will most likely see that you modified the command line, and suspend your server. USE AT YOUR OWN RISK

there is also something that "could" be possible ("could" because maybe some hosters are vulnerable) and is interesting too: commands injection

for example:
PASSWORD & ps -aef
PASSWORD && ps -aef
PASSWORD ; ps -aef

(and maybe an additional ; echo in case PASSWORD is used in the middle of the command for launching the server).
where "ps -aef" is only an example of system command to execute (for linux, but it's the same on windows too).
I don't know how are managed these hosters anyway it's not to exclude the possibility of getting control over the other hosted servers or running a shell and so on.

only an idea in case someone has not tried it yet.

well, i will try that
but i can take the control over the server by simply deleting the executable of game, replacing with, lets say remote administration tool, configuring the rat exe to ignore the all startup commands usually used for normal server starting, any simply rename my rat to original server .exe name, then all what is left to do is execute it
tho there is a slight problem: you cant delete the server .exe, but fortunetely protection is pretty weak, all i have to do is enable the checkbox
did it like this:



i never actually tested this method, but i have a strong feeling that it would work (as i can delete the servers exe)

Hmm, my hoster is running windows server
so i thought that i'd give this a try, and as i dont know much about those commands, i googled it (google is probably my best friend) and came to information on unix servers, and here is where i came to stall

this is my command line:

X replaces sensitive data
>><< is the place where i can "inject" commands to, so line modified for 64 users would look like this:


now, im not really sure how would the command line look like when i would put PASSWORD & ps -aef in
as i dont get what password actually is, and what ps -aef stands for
im sorry if im bothering you, to this isnt really important to me, it really bugs me when i leave something half done :-S

on windows obviously you will need to replace ps -aef with another better command (which is also the same thing you must do on linux, mine was only an example).
the real difference between win and linux is that the "&" symbol used only linux to set the original command in background on windows acts just like the "&&" one which is a concatenation of commands.
for example:
so, in conclusion, any command you inject will be executed when the process finishes, so immediately after the server is stopped.

and yes this "trick" doesn't add something to the one of the substituition of the exe, so it's a valid alternative only if the admin can't touch the remote game's executable

okay, if i got it right, i would just put

at the end of my command line, regardless of fact that game starting arguments are first commands (and i cant modify them, but i can overwrite them)?

and, for that commands, it would be anything that can be done in command prompt, for instance: ?

yeah so the final "password" you should use would be:

I have added the final "list" only to avoid to specify that you must leave an empty space after "echo".
you can also build text files through output redirections and so abusing them for building bat files or list of commands for ftp (yeah the ftp client of windows can be scripted), example:
or

so what i could do would be: just upload a remote administration tool add: in command line, and then i restart the server, and stop it again
if this is correct, i would see my server's ip as a zombie in rat client?

yes, after having uploaded the rat server (for example using the ftp example above) it's enough to use that command-line you specified to start it.
maybe in some cases could be necessary to "tune up" a bit the example we showed but in general it looks all correct

thanks for your help
i would try it straight away, but i guess it's not right to take down a server whne it's full...
when ithink about it, its most of the times full, so il have to test it locally i guess

oh, by the way: i can crash all game servers running punkbuster on that machine, it would go like this:

+set fs_savepath D:\UserFiles\K9372\GameServers\TC27072318654272127623234\

that is line wehere my pb save dir is located, i can change it to same dir as other pb dirs, and then restart pb on my server multiple times, which would automatically restart the servers which operate with that dir

bah, this bug is full of possible exploits, i may have to write to hoster to check the filtering of input. but i'l first look what i can actually do with it

I contacted my server provider, and we "kinda" solved the problem: they cant change the panel to filter out things, but they set it up so that whenever server settings change (maxclients, password...) they get a notification, so they can ban the server, or something, im not sure yet...
still, that wont stop anyone from rooting the server, as that shouldnt get supply them notification

Can't they just set a max amount of characters?

they can do tons of things, but they didn't actually develop the gamepanel, so they have to tell the dev to fix it, but i highly doubt that they will...
anyways, best and easiest way would be to filter out additional commands from input

Okay, i figured out that i can delete anything from the server, even if they strictly said that it cannot be done

here is their message: Also, game panel system by itself does not allow upload of exe, dll, php, bat and other extension nor delete cod4.exe or other dll, exe files.

that's translated from my language (google was core of translation, but i had to correct few things. bah, i hate google, tho its my best friend :D)

here is the proof that i deleted .EXE file, only through their own file manager (tho with my assist :D)

http://img261.imageshack.us/img261/4695/w3spdel.png

Decided to take a good bite on their security :D

So i guess il be updating this thread as i find new potential exploits

btw. i warned them about deleting the files, told them how i did it, and they apparently posted a ticket to gpanel dev's, and today, they wanted to thank me for letting them know there is a bug with 2 free extra slots on my server =)

Anyways, i thought that i "scanned" everything well, and that there was no obvious bugs, but i guess i was wrong
With a bit of researching, i came to idea that i could upload an exe file even if it is blacklisted (yeah, i guess that is only protection)
so i didnt uplaod anything, but instead made a new empty file, and saved it as: file.exe%00.txt
as you can see, null terminator actually makes blacklist filter to fail (not detect that it ia actuallyan exe file)
even if file manager show that it is an .txt document, it completely acts like an exe file (cant delete it without tool, just like i deleted iw3sp.exe, so basically it has all attributes of an exe file)

im still figuring out how could this be exploited (im sure it can, almost 96%, hehe)

EDIT: I think that when i try to stream the file, it gets executed, but nothing happens because it id simply a dummy exe
so it wont open asother txt files (even empty one) but it will instead execute itself, but i doubt this. will see anyways...

if you can't delete/replace the exe remember that you can ever:
- create a proxy dll for injecting your code (for example wsock32.dll)
- if the game supports dll mods (so not vm one) then you can start your code as a mod