信息来源：SecurityFocus
Exploit Tested On :
GamePort 4.0
GamePort 3.1
GamePort 3.0
Platform :
Windows 9X/Me/2K/XP
Background of Program :
Gameport is a product of interactivestudio(
www.interactivestudio.sk). it is very
Common Program in Iran(My Country) that is used for Gamenets and Coffenets.
It has to Parts Client and Server. Each Costomer of Coffenet or Gamenet has an ID
and a Password and by his ID and password he can access one of PCs in the Gamenet
or Coffeenet. The user credits will be count down from time he will log in to
system GamePort untill he will log out. In the case the users credits has expired
the computer will be restarted and he can logon again after he buy a new credits.(more
Informations in
www.interactivestudio.sk)
Type of Vulnerability:
Remote/Local Critical
Descripttion :
we've found 4 Vulnerability
Vul I :
When Client is not Logged in, in ID textbox Put your username and in Password
textbox Put your password and "^^#LOGOFF#" for example :
ID : 101
Password : 123^^#LOGOFF#
then you will login and you can use the Client PC and the Server wont count down
your credits.
Vul II :
the admin Password of server is reversable, it means that You can easily decode
the password recorded in registry. we've programmed a decoder for admin password
of server. you may download the source(in VB) here :
http://www.sharemation.com/devilkins/GPSPDecoder.zip
***Other Vulnerabilities is Only for Version 4.0***
Vul III :
In Case you have access to Server's PC(the PC have GamePortserver installed)
but you don't have the admin password you can change the clients password Or you
can call an application on the Clients(Pcs that have Gameport Client installed)
remotly without admin password. just push right click on mouse over icon of client
pc in the main window of Gameport server, that we want to Call an application
on or change it's admin password. After this the menu appear, where we choose
item "Send message to user...". Now the window will appear where we can write a
message and send it by pushing button "Send". in the Textbox type "^^#CALL#:application_name.exe"
and push send that application will run on the client. also you
can change admin password by typing "^^#CHANGEPSSWD#:New password" instead of
message. for example :
"^^#CALL#:CMD.exe"
"^^#CHANGEPSSWD#:123"
Vul IV :
I don't Know why this Occurs.
In "Remore applictaion call" part of server If you type "\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\.exe"
or "//////////////////////////////////////////////.exe"
and Press OK. the Client you've send the packet to it Will hang up for a Long
time.
Analisis :
Vul I :
When you type your ID and password and "^^#LOGOFF#" at the end and press the
login key. a packet with this data will be sent to server :
"^#LOGME#:ID:Password^^#LOGOFF#:computername^"
it means that log me in and then log me off but when Client Logs off doesn't
perevnt your access.
Vul III:
after sending that message to client, that client will recive this data :
"^#ECHO#:^^#CALL#:CMD.exe^"
it means show "nothing" as message and Call CMD.exe application.
*****All Words Between ## are Capital*****
Solution :
We've Made a Patch for 3.0 & 4.0 Versions ourself, may be Interactivestudio Gonna
make a Patch for it in future but til they haven't released it we try to sell
our patch.
Credits:
amoXi & Dr.vaXin
am0xi yahoo com
GrayDevilkins Team
