Remap shader exploit?

(Ragnar_40k) #1

http://www.milw0rm.com/exploits/1750

Uses a buffer overflow with remapshader to open a shell on the client.

(Floris) #2

Eh you shouldnt be posting this kind of stuff in a public forum mate

(breathKILL) #3

Most of us don’t get it anyway :))

(Floris) #4

It has very easy instructions above it, I would be able to do it

(Ragnar_40k) #5

Its an exploit and not a cheat. And the server admin need to install it to make it work. Don’t know if mods like ETPro or ETPub can fix it, so I posted it here, because it may require an engine patch.

(Ragnar_40k) #6

Here is one fix for Q3: http://svn.icculus.org/quake3?rev=765&view=rev

(bandit5k) #7

Hmm…I remember some worry about this a while ago. Aparently it’s fixed in ET/ETPro…

(SCDS_reyalP) #8

bandit5k: no, thats a different bug.

However, if the server operator wants to mess with you there are lots of things they can do.

(klines) #9

is a patch going to be released?

(klines) #10

ok, if i am right (and i am probably not), this should fix it: (someone confirm for me plz)

in q_shared.c on line 70 change

void COM_StripExtension( const char *in, char *out ) {
	while ( *in && *in != '.' ) {
		*out++ = *in++;
	}
	*out = 0;
}

to

void COM_StripExtension( const char *in, char *out ) {
	if(strlen(in) > 1023) {
		*out = *in;
	} else {
		while ( *in && *in != '.' ) {
			*out++ = *in++;
		}
		*out = 0;
	}
}
(Lanz) #11

They’ve released patches for all three games (Q3, RTCW, W:ET) it seems. Check the Blues news article here:

http://www.bluesnews.com/cgi-bin/board.pl?action=viewthread&threadid=67152

(kamikazee) #12

:beer: Cheers for id!

(Sauron|EFG) #13

Protocol is the same as 2.60 apparently, but I assume unpatched servers will kick patched clients (and other way round) for being “unpure”.

(mortis) #14

I added a mirror to the patch at my site here:

http://forums.quakewarsterritory.com/viewtopic.php?p=2932#2932

(kamikazee) #15

I’m not too sure.
Maybe PB kicks for some corrupt or modified file, but I think the engine is not checked by the game itself.

(SCDS_reyalP) #16

Pure doesn’t check et.exe/et.x86

Some servers may do a pb md5 check, but that should be easy to avoid.

(Nail) #17

patches available for all O/S
http://www.idsoftware.com/

afaik, not usable with etpro, only etmain and it’s mods

(Sauron|EFG) #18

It’s harder to avoid etpro servers though. :wink:

(Hewster) #19

Respect to ID for releasing a patch so quickly :slight_smile:

However, shame they didn’t fix the well known “infoBoom” exploit too :frowning:

However However, the infoboom “fix” does work on the new binaries :slight_smile:

I appreciate the above is a bit cryptic, but those who know will understand :wink:

Hewster