Painkiller <=1.3.1 Remote Memory Corruption Vulnerability Analysis

Application: Painkiller Version: <= 1.3.1 Platform: Windows Vulnerability: Memory corruption, limited code execution Risk: Medium/High Exploitation: Remote, against server Date: August 24, 2004 Author: Luigi Auriemma Email: aluigi@altervista.org Website: http://aluigi.altervista.org Vulnerability Details 1. Vulnerability Description: - Joining a Painkiller server involves a handshake composed of 3 packets: - Client connection request (ID 0x02) - Server key (ID 0x03), used to compute the Gamespy CD key authorization string and password for accessing protected game servers - Client join packet (ID 0x04), containing game version, Gamespy CD key authorization string, password (if required), and other information - The issue lies in the password field, which is read by both protected and unprotected game servers. It is encoded using a specific algorithm and a challenge string from the server. When the server attempts to decode an overly long password (more than 256 characters), it writes to critical memory areas. - An optimized encoding/decoding algorithm is available here. 2. Exploitation Difficulty: - Due to the encoding algorithm and the nature of the vulnerability, full remote code execution is not easily achievable (at least not trivially), as the return address can only be overwritten with specific bytes allowed by the intermediate step size, ranging from 0x00 to 0x3f. - Other exploitation methods may exist, but the author only discovered this limited approach. 3. Code: - Download link 4. Fix: - None. - Developers were contacted one month prior, but no patch has been released yet.

Goal Reached Thanks to every supporter — we hit 100%!

Painkiller <=1.3.1 Remote Memory Corruption Vulnerability Analysis