Initial commit

.gitignore

@@ -0,0 +1,10 @@
+/.vs
+/Debug
+/Release
+/auth_bypass/Debug
+/auth_bypass/*.user
+/*.opendb
+/*.db
+/wowned/Debug
+/wowned/Release
+/wowned/*.user

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017, namreeb (legal@namreeb.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,41 @@
+# wowned
+This application is a proof of concept exploit for the authentication bypass methods in many World of Warcraft emulation
+authentication servers discovered by Chaosvex (https://github.com/Chaosvex) and Daemon (https://github.com/DevDaemon).
+
+To use, `auth_bypass.dll` must be injected into wow.exe (versions 1.12.1, 2.4.3 and 3.3.5a are supported).  An injector `wowned.exe`
+is included.
+
+An example usage would be:
+
+`wowned.exe -c -p "f:\wow 3.3.5\WoW.exe" --2`
+
+wowned.exe --help output:
+
+```
+wowned v0.1 injector
+Allowed options:
+  -h [ --help ]                   display help message
+  -c [ --console ]                enable wow console
+  -p [ --program ] arg (=wow.exe) path to wow binary
+  --1                             exploit method one
+  --2                             exploit method two
+  ```
+
+# ethics
+The bugs which this application will exploit have been publicly disclosed since early November 2016 (see here:
+https://www.reddit.com/r/wowservers/comments/5b0chc/attention_server_developers_and_administrators/).  Some private servers have
+opted to ignore the warning.  It is a common practice among security researched to release a proof of concept exploit after
+vendors and users have had ample opportunity to apply a patch.  Doing so can encourage the remaining vendors or users to follow suit.
+
+For reference, these are two commits which fix 'method one' and 'method two' respectively:
+
+https://github.com/cmangos/mangos-classic/commit/74d51cf70d67f6d4a47321a4226e7473cb8e2601
+https://github.com/cmangos/mangos-classic/commit/0d2b7e38c886ddd6828cfa75e2daba5121467383
+
+# credit
+As mentioned above, credit for the initial discovery goes to Chaosvex.  Credit for the discovery of method two goes to
+Daemon of nostalrius.org, who found the second issue when he and I were discussing the first one.
+
+# impact
+Some of the private servers that I have tested this on are still vulnerable.  If you are a private server administrator and for
+whatever reason are unable to adapt the above-linked commits to your code, please feel free to contact me.

auth_bypass/CDataStore.cpp

@@ -0,0 +1,41 @@
+/*
+    MIT License
+
+    Copyright (c) 2017, namreeb (legal@namreeb.org)
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+ */
+
+#include "CDataStore.hpp"
+#include "misc.hpp"
+
+#include <hadesmem/detail/alias_cast.hpp>
+
+#include <Windows.h>
+
+#include <cstdint>
+#include <cassert>
+
+void CDataStore::Write(const void *data, unsigned int length)
+{
+    assert(m_bytesWritten + length <= m_capacity);
+
+    memcpy(static_cast<char *>(m_data) + m_bytesWritten, data, length);
+    m_bytesWritten += length;
+}

auth_bypass/CDataStore.hpp

@@ -0,0 +1,56 @@
+/*
+    MIT License
+
+    Copyright (c) 2017, namreeb (legal@namreeb.org)
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+ */
+
+#pragma once
+
+#include <cstdlib>
+
+class CDataStore
+{
+    private:
+        const void * _vmt;                      // 0x00-0x04
+
+    public:
+        void * m_data;                          // 0x04-0x08
+        const unsigned int m_base;              // 0x08-0x0C
+        const unsigned int m_capacity;          // 0x0C-0x10
+        unsigned int m_bytesWritten;            // 0x10-0x14
+        unsigned int m_bytesRead;               // 0x14-0x18
+
+        CDataStore(size_t size) : _vmt(nullptr), m_data(malloc(size)), m_base(0), m_capacity(size), m_bytesWritten(0), m_bytesRead(0) {}
+
+        ~CDataStore()
+        {
+            free(m_data);
+        }
+
+        template <typename T> void Write(T);
+        void Write(const void *, unsigned int);
+};
+
+template <typename T>
+void CDataStore::Write(T val)
+{
+    Write(&val, sizeof(T));
+}