imhunterand/cs2-exploit

Allows you to crash any server user cs2

The Exploit

This exploit relies on the game:loc metadata key, which when set to a length greater than 2^15 or 32768 and a client is invited, an out of bounds memory write is triggered, leading to an Access Violation/Segmentation Fault which ultimately crashes the CS:GO client. This XML file includes a Javascript file (panorama/scripts/friendlobby.js) that populates the fields such as the lobby members' avatars, the gamemode, the average lobby rank, and most importantly, the lobby location.

	var _SetFlag = function ( elTile )
	{
		var countryCode = PartyBrowserAPI.GetPartySessionSetting( _m_xuid, 'game/loc' );
		var elFlagImg = elTile.FindChildTraverse( 'JsFriendLobbyFlag' );
		if ( countryCode )
		{
			elFlagImg.SetImage( 'file://{images}/flags/'+ countryCode +'.png' );
			elFlagImg.RemoveClass( 'hidden' );
		}
		else
		{
			elFlagImg.AddClass( 'hidden' );
		}
	};

The hash function attempted to call the Clang memset function and write the parsed filepath to another area of memory without validating the size of the source data. This is called an Out-of-bounds Write. Initially, I had attempted to escalate this vulnerability to an RCE or remote code execution since the Valve bug bounty program would consider a client crasher out of scope. After contacting many friends who were much better than I was at reverse engineering, it was concluded that the most that could be achieved with this exploit was Denial of Service.

Credits

• Thanks to @imhunterand for finding the crash method
• Thanks to the @pwn0sec CSE Team for being our test subjects

cs2-exploit's Issues

dont work

dont work, maybe wrong protobufs, what protobufs u use?

Helpers need to be updated with the new proto buffers.

it seems to be out of date.

could be wrong :) nice work

Don`t work

		let error = (err) => {
			this.steam.removeListener("loggedOn", loggedOn);
			this.steam.removeListener("error", error);
			this.steam.removeListener("steamGuard", steamGuard);

			reject(err);
		}

		let steamGuard = (domain, callback) => {
			this.steam.removeListener("loggedOn", loggedOn);
			this.steam.removeListener("error", error);
			this.steam.removeListener("steamGuard", steamGuard);

			// Prompt user for Steam Guard code
			const readline = require('readline').createInterface({
				input: process.stdin,
				output: process.stdout
			});

			readline.question('Enter Steam Guard code: ', (code) => {
				readline.close();
				callback(code);
			});
		};


		this.steam.on("loggedOn", loggedOn);
		this.steam.on("error", error);
		this.steam.on("steamGuard", steamGuard);

		this.steam.logOn(details);
	});
	
}

I modificate code, but can`t loggin into account and after i input steam guar its do nothing

EGCBaseClientMsg is undefined and not present in object

TypeError: Cannot read properties of undefined (reading 'k_EMsgGCClientHello')
at C:\Users\kiril\source\repos\cs2-external-esp-main\x64\Release\cs2-exploit-main\helpers\Lobby.js:158:52
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

Does this still work ?

?

app 730 is out of date

2279720 is the new cs2 method, I'm currently researching. a new method.

credits to you all ill update you if I can get it working.

thanks for all the hard work.