CS:GO: From Zero to 0-day

neodyme.io

cross-posted to:
cybersecurity@sh.itjust.works

CS:GO: From Zero to 0-day

neodyme.io

execveat@infosec.pubM to Research@infosec.pubEnglish · 1 year ago

cross-posted to:
cybersecurity@sh.itjust.works

We identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to our malicious python CS:GO server. This post details our journey through the CS:GO binary and conducts a technical deep dive into various identified bugs. We conclude by presenting a proof of concept (POC) exploit that leverages four different logic bugs into remote code execution in the game's client, triggered when a client connects to the server.

They’ve chained 4 logic bugs to achieve RCE in CS:GO, pretty impressive. Valve sucks at communication and bug bounty payouts though.

You must log in or register to comment.

Chat

Research@infosec.pub

research@infosec.pub

Create a post

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !research@infosec.pub

/r/netsec’s branch in the fediverse.

A community-curated aggregator of technical research. Our mission is to extract signal from the noise.

Only post technical content here. New tools (and major releases of existing ones), novel techniques, deep dives and post mortems are the ideal content. CTF and bug bounty writeups could be acceptable if they showcase lesser known approaches or techniques.

Non-technical content (both beginner and CISO level) will be considered spam.

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

1 user / day
1 user / week
1 user / month
2 users / 6 months
1 local subscriber
1 subscriber
8 Posts
1 Comment
Modlog

mods:
execveat@infosec.pub