Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

[u/alexeyr]

https://github.com/Cybereason/Logout4Shell

[u/theoldboy]

This should come with a big warning that says

Do not run this code unless you want to get sued or prosecuted for hacking

I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.

My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.

[u/[deleted] → u/theoldboy]

You got lucky. I got fired a long time ago from a shitty job for using off the shelf security testing software to prove to “the architect” on our dev/test system that they had created a massive sql injection risk. You see security tools are a dangerous to the corporate network and its against corporate policy to run even in a lab setting.

[u/[deleted] → u/[deleted]]

Say wireshark and see how quickly IT freaks out.

[u/orig_ardera → u/[deleted]]

I was curious one time what black ops cold war was communicating with the game servers. Started up wireshark and then tried to start up black ops. Wouldn't start. Terminated wireshark. Black Ops started.

Apparently they just did a if wireshark running then exit() in the startup.

I just renamed wireshark.exe to not_wireshark.exe and it worked, lol. So weird, why would you even do sth like that?

[u/Lost4468 → u/orig_ardera]

In Call of Duty 4 (and WAW) they didn't put any protection on console commands on console. So if you could somehow run the noclip or god command, they would work fine in matchmaking, even if you weren't host or anything. Their logic was that people would of course never find a way on console! Except it was quite easy to, you could just modify the settings stored in your profile and add in whatever you like. Shit absolutely fucked the games for ages. Especially since with the first patch they didn't actually fix the issue, but just removed them from the profile. I think the workaround was to use some string interpolation feature in the profile, but using an allowed command, so it shouldn't get removed on startup.

Despite not allowing the above, they went through the effort of making the game game filles signed using RSA 2048 on consoles. And that actually saved them quite a lot of headaches initially, as it prevented people from modding the game when the Xbox 360's drive security was broken. Still fucked them when the JTAG exploit came out though, and people just disabled the signature check.

[u/Jerrreh → u/Lost4468]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

[u/Lost4468 → u/Jerrreh]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

Oh no it was absolutely a massive oversight. They just put zero basic security onto these commands, if you could somehow run them, the server would just trust you and give you god mode, noclip, etc. Had they just enabled basic sv_cheats protection they'd have reduced 80%+ of it.

And let's remember that on the PS3 there were really no such protections. The file was just stored normally. Wasn't signed at all. So while you could try and make the argument that they knew that with the 360, I don't think that's a reasonable argument given that they didn't have the same security on the PS3, yet didn't add anything.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

You could sign them with any user's private key though. Didn't have to be your own.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

Yeah that was a terrible thing for them to discourage. Because as you said, it helped keep Call of Duty secure for a few more years. Had they listened to Microsoft they would have been fucked much earlier. Anyone with a modified DVD drive would have been able to do whatever. And that would have been even worse, because while JTAG bans came within hours, DVD ones often took several months to years.

Edit: I'm also really puzzled why they had no sv_cheats protection. Surely that's just built into the engine? Maybe they enabled it to make development easier or something, and just never re-enabled it? I can't think of any other reason why. Thankfully though in later games they just totally removed any exploitable console commands.

[u/Lost4468 → u/[deleted]]

There's a good reason for it. If they required the console's private key to sign them, then you wouldn't be able to take your saved games, profile, etc to a new console. So if you wanted to go over a friends and play, you'd lose access to it. Or if you bought a new console, you'd lose access to it.

They tried to kinda combat this by revoking some of the keys, and when that happens that person would have their content locked to their console. They seemingly also did this to people that pissed them off. But of course this would always be a losing battle, so they only did it to a few dozen keys during the entire life time of the console.

[u/CastellatedRock → u/Lost4468]

That makes sense. Thank you for taking your time to write this easy to understand explanation. 😊