Luigi Auriemma

server's terminations, crash and execution of some admin commands that allow to change various things on the server (password, maxclients and so on).
in my opinion it deserves to be read:
http://aluigi.org/adv/teamspeakrack-adv.txt

and obviously also the TeamSpeak 3 ServerQuery Manual needs to be read to understand better the bug about the execution of admin commands

I would also like to add some informations about the process used for finding these vulnerabilities, maybe for who is interested in the researching of security bugs in general or just curiosity.

like any of my "sessions" it required almost one day (yeah I'm a slow guy) which includes the:
- reversing of the protocol (not yet finished because I worked on these bugs)
- a minimal understanding of how it's implemented and works (for example that thing of the packets-rate limitation from the same udp port)
- fuzzing with the testing of each command manually or automatical in reference to the ServerQuery manual and all the commands stored in the process
- writing of the proof-of-concept in real-time during the tests
- additional random tests and fuzzing
- testing of the vulnerabilities on a vanilla installation (another computer of mine) for their confirmation
- writing of the advisory

about the fix:
it's just a news of this moment that a beta25 version of the server will be released within 24 hours

I must say this exploit is by far one of the most amazing ones I've seen you find. You impress me btw aluigi just out of curiousity is there a syntax command for deleting all channels or finding out channel ID's/user ID's? I'm just not too sure I looked around couldnt find much. And how would I go about adding someone as admin if I wanted?

for deleting all the channels I guess you can only use the brute forcing method like the one I used for some of the other tests available in my PoC.
if you can't recompile the PoC it's enough that you modify the executable with a hex editor, from:
to
remember aspace or a NULL byte to cover the last byte not covered by the new string ('5').

then you can test it with bug 8:
teamspeakrack 8 SERVER PORT

so this same method should be used for any other ID related operation because, as far as I know, there is no way to see the IDs through this vulnerability.

while for the question about adding someone as admin I guess you must refer to the ts3 ServerQuery Manual because I'm not an expert of ts3 administration which looks a complex thing (tokens, ids, blah)

ahhh great idea, worked like a charm aluigi. :D thanks, i'm amazed to how ignorant people are that own their own servers and dont even upgrade. It's in beta still so I mean wtf expect a shit ton of releases lol. Still a very good find on that exploit aluigi good work yet again.

I was on it to take a look at the ts3 protocol, but this... pew blow me away.
Im allways amazed how quick you can understand a protocol that is a:crypted b: you have never seen befor

It's patched with beta25 :)

already known but thanks for the input jeff, if no one had been a white knight it would've taken longer to fix probably but either way I give them props for taking very short time patching it... i just wish people were smart and would upgrade theres still vulnerable servers out there lol...