2 exploit patches related to Agent command.

[Tankado]

Removed.

[MentaL]

[bulli10]

beast release !!

[LGPaul]

Hi,

This blocks server command via UDP and prevents sender UID spoofing. (Also known as proxy hack.)

[./CSCommon/Source/MMatchClient.cpp - MMatchClient::MakeCmdFromTunnelingBlob()]

Spoiler:

        return NULL;
    }

    delete [] pData;
    
    // Proxy patch.
    // m_pCommandDesc will never be NULL : above SetData() did it everything.
    if (!pCmd->m_pCommandDesc->IsFlag(MCDT_PEER2PEER))
    {
        delete pCmd; 
        return NULL;
    }
    
    pCmd->m_Sender = uidSender;
    pCmd->m_Receiver = m_This;

    MMatchPeerInfo* pPeer = FindPeer(uidSender); 

[./CSCommon/Source/MMatchClient.cpp - MMatchClient::ParseUDPPacket()] (case MSGID_RAWCOMMAND of switch)

Spoiler:

                    mlog("MMatchClient::ParseUDPPacket() -> SetData Error\n");

                    delete pCmd;
                    return;
                }

                MUID uidPeer = FindPeerUID(dwIP, nPort);
                if (uidPeer != MUID(0,0))
                {
                    // Proxy patch.
                    if (pCmd->GetID() == MC_AGENT_TUNNELING_TCP || pCmd->GetID() == MC_AGENT_TUNNELING_UDP)
                    {
                        delete pCmd; 
                        return;
                    }
                    
                    pCmd->m_Sender = uidPeer;
                } else {
                    // TODO: ?c}a ?oA?CO?sCO.
                    sockaddr_in Addr;
                    Addr.sin_addr.S_un.S_addr = dwIP;
                    Addr.sin_port = nPort;
                    char* pszIP = inet_ntoa(Addr.sin_addr); 

[./CSCommon/Source/MMatchClient.cpp - MMatchClient::ParseUDPPacket()] (case MSGID_COMMAND of switch)

Spoiler:

                    mlog("MMatchClient::ParseUDPPacket() -> MSGID_COMMAND SetData Error(%s:%d), size=%d\n", 
                        pszIP, nPort, nCmdSize);

                    delete pCmd; pCmd = NULL;
                    return;
                }

                MUID uidPeer = FindPeerUID(dwIP, nPort);
                if (uidPeer != MUID(0,0)) {
                    // Proxy patch.
                    if (pCmd->GetID() == MC_AGENT_TUNNELING_TCP || pCmd->GetID() == MC_AGENT_TUNNELING_UDP)
                    {
                        delete pCmd; 
                        return;
                    }
                    
                    pCmd->m_Sender = uidPeer;
                } else {
                    // Agent?ILA ?IE’E-ƒÊE A?CCƒÊaLA âc?eCIAo ?ELALU.
                    delete pCmd;
                    return;
/*
                    // TODO: ?c}a ?oA?CO?sCO.
                    sockaddr_in Addr;
                    Addr.sin_addr.S_un.S_addr = dwIP; 

[./MatchAgent/MMatchAgent.cpp - MMatchAgent::OnCommand()]

Spoiler:

        case MC_AGENT_TUNNELING_TCP:    // M2M
            {
                // Proxy patch.
                // When TCP tunneling is used normally?
                break;
                
                MUID uidSender, uidReceiver;
                if (pCommand->GetParameter(&uidSender, 0, MPT_UID)==false) break;
                if (pCommand->GetParameter(&uidReceiver, 1, MPT_UID)==false) break;
                
                MCommandParameter* pParam = pCommand->GetParameter(2);
                if (pParam->GetType()!=MPT_BLOB) break;
                void* pBlob = pParam->GetPointer();
                if( NULL == pBlob ) break;
                int nCount = MGetBlobArrayCount(pBlob);

                OnTunnelingTCP(uidSender, uidReceiver, pBlob, nCount);
                return true;
            } 

[./MatchAgent/MMatchAgent.cpp - MMatchAgent::ParseUDPPacket()]

Spoiler:

                MCommandParameterUInt(nPort).GetData(pData, 1024);
                pParamPort->SetData(pData);

                PostSafeQueue(pCmd);
            } else if (pCmd->GetID() == MC_AGENT_TUNNELING_UDP) {
                // Proxy patch...
                /*
                pCmd->m_Sender = MUID(0,0);
                pCmd->m_Receiver = m_This;

                PostSafeQueue(pCmd);
                */
                
                sockaddr_in addr;
                addr.sin_addr.S_un.S_addr = dwIP;
                addr.sin_port = wRawPort;
                
                char szIP[64]; strcpy(szIP, inet_ntoa(addr.sin_addr));
                unsigned int nPort = ntohs(addr.sin_port);
                
                MUID uidSender = FindClientUID(szIP, nPort);
                if(uidSender == MUID(0, 0)) break;
                
                MCommandParameterUID* pParamSenderUID = (MCommandParameterUID*)pCmd->GetParameter(0);
                if(pParamSenderUID == NULL || pParamSenderUID->GetType() != MPT_UID) break;
                
                char nData[1024];
                MCommandParameterUID(uidSender).GetData(nData, sizeof(nData));
                pParamSenderUID->SetData(nData);
                
                pCmd->m_Sender = uidSender;
                pCmd->m_Receiver = m_This;
                
                PostSafeQueue(pCmd);
            } 
        }
        break;
    case MSGID_COMMAND:
        {
            LOG(LOG_FILE, "MMatchAgent::ParseUDPPacket - Not Used\n");
        } 

[./MatchAgent/MMatchAgent.cpp]

Spoiler:

    } else {
        for (list<MUID>::iterator i=pClient->GetPeerRouteBegin(); i!=pClient->GetPeerRouteEnd(); )
        {
            MAgentClient* pTargetPeer = GetClient(*i);
            if (pTargetPeer == NULL) {
                i = pClient->RemovePeerRoute(*i);
                continue;
            }
            SendPeerTunnel(pClient, pTargetPeer, pBlob, nCount);

            ++i;
        }
    }
}

void MMatchAgent::OnDebugTest(const MUID& uidComm, const char* pszMsg)
{
}


// Proxy patch...
MUID MMatchAgent::FindClientUID(const char* pszIP, WORD wPort)
{
    for(MAgentClients::iterator i = m_Clients.begin(); i != m_Clients.end(); i++)
    {
        MAgentClient* pClient = (*i).second;
        
        if(stricmp(pClient->GetIP(), pszIP) == 0 && pClient->GetPort() == wPort)
        {
            return pClient->GetUID();
        }
    }
    
    return MUID(0, 0);
} 

[./MatchAgent/MMatchAgent.h - MMatchAgent class]

Spoiler:

    /// Local ClockAâ Global ClockACEI oPEP
    static unsigned long int ConvertLocalClockToGlobalClock(unsigned long int nLocalClock, unsigned long int nLocalClockDistance);
    /// Global ClockAâ Local ClockACEI oPEP
    static unsigned long int ConvertGlobalClockToLocalClock(unsigned long int nGlobalClock, unsigned long int nLocalClockDistance);

public: // For Debug
    friend void MDebugUtil_PrintStagePeerList();
    
    // Proxy patch.
protected:
    MUID FindClientUID(const char* pszIP, WORD wPort);
};


#endif 

Is it like this?

MCommand* MMatchClient::MakeCmdFromTunnelingBlob(const MUID& uidSender, void* pBlob, int nBlobArrayCount)
{
    if (nBlobArrayCount != 1) 
    {
        mlog("MakeCmdFromTunnelingBlob: BlobArrayCount is not 1\n");
        return NULL;
    }

    char* pPacket = (char*)MGetBlobArrayElement(pBlob, 0);

    int nSize = MGetBlobArraySize(pBlob) - (sizeof(int) * 2);
    if ((nSize <= 0) || (nSize >= MAX_BLOB_SIZE))
    {
        mlog("MakeCmdFromTunnelingBlob: Blob Size Error(size = %d)\n", nSize);
        return NULL;
    }

    char* pData = new char[nSize];

    if (!m_PeerPacketCrypter.Decrypt(pPacket, nSize, pData, nSize))
    {
        delete [] pData;
        return NULL;
    }


    MCommand* pCmd = new MCommand();
    if (!pCmd->SetData(pData, &m_CommandManager))
    {
        delete [] pData;
        delete pCmd; 
        return NULL;
    }

    delete [] pData;

    pCmd->m_Sender = uidSender;
    pCmd->m_Receiver = m_This;

    MMatchPeerInfo* pPeer = FindPeer(uidSender);
    if (pPeer == NULL)
    {
        delete pCmd;
      return NULL;
    }

    delete [] pData;
    
    // Proxy patch.
    // m_pCommandDesc will never be NULL : above SetData() did it everything.
    if (!pCmd->m_pCommandDesc->IsFlag(MCDT_PEER2PEER))
    {
        delete pCmd; 
        return NULL;
    }
    
    pCmd->m_Sender = uidSender;
    pCmd->m_Receiver = m_This;

    MMatchPeerInfo* pPeer = FindPeer(uidSender); 

    return pCmd;
}

[aV3PQmCJjM9L]

Is it like this?

MCommand* MMatchClient::MakeCmdFromTunnelingBlob(const MUID& uidSender, void* pBlob, int nBlobArrayCount)
{
    if (nBlobArrayCount != 1) 
    {
        mlog("MakeCmdFromTunnelingBlob: BlobArrayCount is not 1\n");
        return NULL;
    }

    char* pPacket = (char*)MGetBlobArrayElement(pBlob, 0);

    int nSize = MGetBlobArraySize(pBlob) - (sizeof(int) * 2);
    if ((nSize <= 0) || (nSize >= MAX_BLOB_SIZE))
    {
        mlog("MakeCmdFromTunnelingBlob: Blob Size Error(size = %d)\n", nSize);
        return NULL;
    }

    char* pData = new char[nSize];

    if (!m_PeerPacketCrypter.Decrypt(pPacket, nSize, pData, nSize))
    {
        delete [] pData;
        return NULL;
    }


    MCommand* pCmd = new MCommand();
    if (!pCmd->SetData(pData, &m_CommandManager))
    {
        delete [] pData;
        delete pCmd; 
        return NULL;
    }

    delete [] pData;

    pCmd->m_Sender = uidSender;
    pCmd->m_Receiver = m_This;

    MMatchPeerInfo* pPeer = FindPeer(uidSender);
    if (pPeer == NULL)
    {
        delete pCmd;
      return NULL;
    }

    delete [] pData;
    
    // Proxy patch.
    // m_pCommandDesc will never be NULL : above SetData() did it everything.
    if (!pCmd->m_pCommandDesc->IsFlag(MCDT_PEER2PEER))
    {
        delete pCmd; 
        return NULL;
    }
    
    pCmd->m_Sender = uidSender;
    pCmd->m_Receiver = m_This;

    MMatchPeerInfo* pPeer = FindPeer(uidSender); 

    return pCmd;
}

I think only "// Proxy patch." parts are required to edit.

@On-topic : nice release.

[vhrool12]

Can you explain better? I do not understand, is how you fix the topic and put the same Solarie? the topic it explains the location of the exploit and give place to replace, I do not understand much ...

[Tankado]

Can you explain better? I do not understand, is how you fix the topic and put the same Solarie? the topic it explains the location of the exploit and give place to replace, I do not understand much ...

Well, you have to find it by ctrl + f,
and you have to add only the //Proxy patch parts.

[Aiona]

Very nice, thanks ^.^

[12pool3]

If you discovered this: Good job.
If you ripped this: Give some credits.

You're certain to make some waves with this anyway, it's been private for over 2 years.

[Solaire]

Though I really appreciate your release, this isn't going to work out. Here are a few of my concerns:

1. You're placing a flag check in MMatchClient.cpp. Which is client-sided and also unsafe (m_pCommandDesc is assumed not being NULL).
2. You shouldn't be disabling TCP tunnelling as it is actually being used when UDP is unavailable. TCP is actually the safe protocol here with verified headers.
3. You verify UDP packets based on IP and port at the MatchAgent, which isn't going to patch anything. The header of a UDP packet is rarely verified (other than the checksum) which means that you can easily spoof both IP and port of a UDP packet. E.g. I can send peer info using your IP. I've done this once at Utopia using WinPcap and it was quite a lot of fun, I sent packets of my own with the IP and port of every other player in the stage.

[12pool3]

I can send peer info using your IP (UDP Packet Header). I've done this once at Utopia using WinPcap and it was quite a lot of fun, I sent packets of my own with the IP and port of every other player in the stage.

Would really like to know what ISP you're using, since a lot of them block any such forged packets due to the problematic security risk they pose.

[Solaire]

Would really like to know what ISP you're using, since a lot of them block any such forged packets due to the problematic security risk they pose.

There's not one single ISP in the Netherlands that blocks UDP spoofed packets. And as far as I'm aware, there's only a few that do so in the entire world.

[12pool3]

There's not one single ISP in the Netherlands that blocks UDP spoofed packets. And as far as I'm aware, there's only a few that do so in the entire world.

The majority of ISPs in the world block outgoing packets with IP headers containing a forged source IP.
This has been in effect since RFC 2827: http://www.ietf.org/rfc/rfc2827.txt

[dacharles]

Though I really appreciate your release, this isn't going to work out. Here are a few of my concerns:

1. You're placing a flag check in MMatchClient.cpp. Which is client-sided and also unsafe (m_pCommandDesc is assumed not being NULL).
2. You shouldn't be disabling TCP tunnelling as it is actually being used when UDP is unavailable. TCP is actually the safe protocol here with verified headers.
3. You verify UDP packets based on IP and port at the MatchAgent, which isn't going to patch anything. The header of a UDP packet is rarely verified (other than the checksum) which means that you can easily spoof both IP and port of a UDP packet. E.g. I can send peer info using your IP. I've done this once at Utopia using WinPcap and it was quite a lot of fun, I sent packets of my own with the IP and port of every other player in the stage.

2. TCP tunneling is not implemented.
3. Try ArticGunz

[Solaire]

The majority of ISPs in the world block outgoing packets with IP headers containing a forged source IP.
This has been in effect since RFC 2827: http://www.ietf.org/rfc/rfc2827.txt

I was aware of that RFC, but it's not implemented here with any ISP as far as I know. Not sure about ISP's in other countries.

2. TCP tunneling is not implemented.

If I recall correctly, it was implemented back in '07 files.

3. Try ArticGunz

Why?

[dacharles]

Patched.