mikeisastar / counter-strike-remote-code-execution Goto Github PK

Patch for CVE-2023-35855, Windows build 8684 (pre-HL25 Anniversary, aka "steam_legacy" branch) for all mods.
By the way, this exploit is not only for Counter-Strike but works for other Half-Life mods too.

Original 8684 hw.dll

  File: hw.dll
CRC-32: f7dcffd9
   MD4: 3db85c7df94b2e5bddbbbeb0d741999b
   MD5: a74c64de593e2533c04200c5417bd9e9
 SHA-1: f0f7372692f285154c76be35fc50b89ed0ea2d18

Patched 8684 hw.dll

  File: hw.dll
CRC-32: eca35f3d
   MD4: 1be4615a18dd7051f68ce2d98ba46e50
   MD5: a121c926bc1dd90d0a8632766d228c4d
 SHA-1: 51c2ecb1ab8241b6afeae535a6a66dbd73a00a65

Prepatched
hw_dll_8684_patched.zip

Manual patch
https://gist.github.com/anzz1/71689275ed722492da7ec7c02a41b867

Info

Instead of patching the underlying overflow, which is the use of unbounded sprintf instead of snprintf in the mod dlls (mp.dll/hl.dll/opfor.dll/etc.), and having to do it for each mod separately, the better way is to block server from sending the lservercfgfile to a client at all. It's clearly an oversight, since it's not a cvar that server should be able to set on a client.

After patching:

Server tried to send invalid command:"lservercfgfile "MikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikeStarMikAAAA";map de_nuke
"

No more crash 😃