mailing list archives
4 Vulnerabilities in GamePort
From: amoXi Devilkin <am0xi () yahoo com>
Date: 17 Dec 2004 19:40:21 -0000
Exploit Tested On :
Background of Program :
Gameport is a product of interactivestudio(www.interactivestudio.sk). it is very Common Program in Iran(My
Country) that is used for Gamenets and Coffenets. It has to Parts Client and Server. Each Costomer of Coffenet or
Gamenet has an ID and a Password and by his ID and password he can access one of PCs in the Gamenet or Coffeenet. The
user credits will be count down from time he will log in to system GamePort untill he will log out. In the case the
users credits has expired the computer will be restarted and he can logon again after he buy a new credits.(more
Informations in www.interactivestudio.sk)
Type of Vulnerability:
we've found 4 Vulnerability
Vul I :
When Client is not Logged in, in ID textbox Put your username and in Password textbox Put your password and
"^^#LOGOFF#" for example :
ID : 101
Password : 123^^#LOGOFF#
then you will login and you can use the Client PC and the Server wont count down your credits.
Vul II :
the admin Password of server is reversable, it means that You can easily decode the password recorded in registry.
we've programmed a decoder for admin password of server. you may download the source(in VB) here :
***Other Vulnerabilities is Only for Version 4.0***
Vul III :
In Case you have access to Server's PC(the PC have GamePortserver installed) but you don't have the admin password
you can change the clients password Or you can call an application on the Clients(Pcs that have Gameport Client
installed) remotly without admin password. just push right click on mouse over icon of client pc in the main window of
Gameport server, that we want to Call an application on or change it's admin password. After this the menu appear,
where we choose item "Send message to user...". Now the window will appear where we can write a message and send it by
pushing button "Send". in the Textbox type "^^#CALL#:application_name.exe" and push send that application will run on
the client. also you can change admin password by typing "^^#CHANGEPSSWD#:New password" instead of message. for example
Vul IV :
I don't Know why this Occurs.
In "Remore applictaion call" part of server If you type "\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\.exe" or
"//////////////////////////////////////////////.exe" and Press OK. the Client you've send the packet to it Will hang up
for a Long time.
Vul I :
When you type your ID and password and "^^#LOGOFF#" at the end and press the login key. a packet with this data
will be sent to server :
it means that log me in and then log me off but when Client Logs off doesn't perevnt your access.
after sending that message to client, that client will recive this data :
it means show "nothing" as message and Call CMD.exe application.
*****All Words Between ## are Capital*****
We've Made a Patch for 3.0 & 4.0 Versions ourself, may be Interactivestudio Gonna make a Patch for it in future
but til they haven't released it we try to sell our patch.
amoXi & Dr.vaXin
am0xi () yahoo com