Disclosure: The Call of Duty protocol has been patched against the vulnerability discussed by momo5502. Take heart, it is software and therefore has multiple vulnerabilities. The post remains an instructive one.
Game hacking reinvented? – A cod exploit
From the post:
A few years ago, I became aware of a security issue in most Call of Duty games.
Although I did not discover it myself, I thought it might be interesting to see what it could be used for.
Without going into detail, this security issue allows users playing a Call of Duty match to cause a buffer overflow on the host’s system inside a stack-allocated buffer within the game’s network handling.
In consquence, this allows full remote code execution!
To use this vulnerability to exploit the game, a few things have to be taken into consideration.
To exploit this vulnerability (or actually any vulnerability), you need to replicate the network protocol of the game.
This turns out to be somewhat complex, so I decided not to rewrite this myself but to actually use the game as a base and to simply force it into sending malicious hand-crafted packets that exploit it.
And indeed, this method seems to work, but the problem is that you need to modify the game in order to send the packets.
As Call of Duty has, just like any modern game these days, a not-so-bad anticheat mechanism (namely VAC), modifying it could result in myself getting banned from the game.
After a few other failed attempts of exploiting this vulnerability, I came up with something completely different: Why shouldn’t I use the game, without actually using the game?
The idea is still to take the game as base, but instead of hooking it, the underlying network transactions are analyzed to recreate the state of the game and to inject custom packets into the system’s network stack that look as if they were sent by the game.
So you don’t modify the game itself, but rather control all the data it sends and receives.
As this method doesn’t touch the game at all, it is not possible for current anti-cheat systems to detect this (it actually is possible, but I don’t think there is any anti-cheat that tries to detect that, yet).
…
Catalin Cimpanu tweeted a link to this post, along with links for a YouTube video: https://www.youtube.com/watch?v=j2N3_pDEsnE and GitHub PoC: https://github.com/momo5502/cod-exploit.
An elegant attack that relies on networked software, well, using a network for communication. However heavily protected the software, communication over a network can be captured and analyzed. Encryption may poses issues, but only if done well, which isn’t all that common.
Enjoy!
