I've known about this exploit for some time (I believe I was one of the first people to discover it, I only know of a couple others who were aware of this at the time), but I never cared enough to make a fix as it didn't seem to be getting abused until recently, so my apologies for that.
The exploit works by sending a corrupted handshake response - when the server receives the handshake response from the client, it crashes upon trying to decrypt it with the RSA keys, as the payload length isn't equal to the length of the modulus, but is instead some arbitrary number. I'm not sure what ps_login I used for this, as JuuF sent me his. I've uploaded the one I used just to be sure. Anyway, here is the fix:
The exploit works by sending a corrupted handshake response - when the server receives the handshake response from the client, it crashes upon trying to decrypt it with the RSA keys, as the payload length isn't equal to the length of the modulus, but is instead some arbitrary number. I'm not sure what ps_login I used for this, as JuuF sent me his. I've uploaded the one I used just to be sure. Anyway, here is the fix:
Code:
// Author: Cups // Date: 31/10/2017 [ENABLE] alloc(newmem, 128) // New memory cave used for performing the key length check label(return) // Address to return /* 404E60 is the CUserCrypto::KeyInit function. The keylen parameter describes the length of the RSA encrypted response from the client, which is the 2nd parameter to the function. Function parameters are stored in the EBP register, and are in reverse order. EBP+08 is the pointer to the second parameter (as all parameters are an integer, so 4 bytes in size) */ ps_login.exe+4E84: jmp newmem // Jump to our new memory return: // New memory for checking the key length newmem: // We overwrote this code when inserting our jump push eax mov ebx,ecx mov eax,esi // If the key length is not 128 bytes, jump to the end of the function and do nothing cmp ecx,80 jne ps_login.exe+4FAE // Key is valid, continue processing as normal jmp return [DISABLE] dealloc(newmem) ps_login.exe+4E84: push eax mov ebx,ecx mov eax,esi
