Store Page
Hack 'n' Slash
All Discussions Screenshots Artwork Broadcasts Videos Workshop News Guides Reviews

Hack 'n' Slash

Store Page
Hack 'n' Slash >  Workshop > SmashManiac's Workshop
Not enough ratings
Security Exploit 2
Description Discussions0 Comments1 Change Notes
   
Award
Favorite
Favorited
Unfavorite
File Size
Posted
25.191 KB
Sep 20, 2014 @ 5:41pm
1 Change Note ( view )
Created by
SmashManiac
Offline
107 Unique Visitors
7 Current Subscribers
0 Current Favorites

Subscribe to download
Security Exploit 2

In 1 collection by SmashManiac
Security Exploits
2 items
Description
Status: FIXED
Reported 2014-09-20, fixed 2014-09-24

Hack 'n' Slash creates a special environment for mods by exposing only a subset of the Lua standard libraries and a few special functions designed for creating mods. This mod demonstrates an exploit that was possible on a previous version of the game which bypassed this protection and allowed arbitrary code execution, regardless of the player's operating system. It does not contain viruses, trojan horses, worms, or any other similar software or programs, but could have theorically been used to bootstrap one by a malicious modder.

When enabled, this mod was designed toiprompt for a command to be sent to the operating system, which would then be executed. By default, it would launch Windows Calculator in a separate process. For convenience, the mod automatically terminates the game once the command returns.

The vulnerability used in this particular exploit is the scripts.load() function. This function internally called Lua's loadfile() function, and code loaded through this function is applied on the global environment and has access to all Lua stardard libraries. Arbitrary code could then be executed through the os library. This particular exploit was patched by preventing access to Lua's os and io libraries.

Because of potential vulnerabilities such as this one, I recommend players to inspect the source code of the mods they download through Steam Workshop before enabling them and report those that violate the Steam Online Conduct Rules as soon as possible.

I hope that this mod will serve as an educational piece for all types of programmers about the importance of writing secure code.

If you find any security issues in the game, please contact support@doublefine.com

To see more Hack 'n' Slash vulnerabilities, please check my Security Exploits collection.
2 Comments
< >
SmashManiac  [author] Sep 24, 2014 @ 12:53am 
The fix appears to be working fine, but there's still some insecure functions available. For example, I can cause the EXE to crash when using package.loadlib() in my codeToInject variable. Exploiting this function is actually quite difficult but not impossible I believe.

I can't think of any other examples, but you should take a second look just to be on the safe side.
Noughtceratops Sep 23, 2014 @ 4:13pm 
This one should be fixed now. You can still access the global environment from scripts.load, but I did some work reducing the surface area of insecure functions in the global environment. Namely, you can no longer access lua's os or io modules.

If you need to load an asset in the game's file system, you can use the new DFHack.loadAsset(path) function. Paths are relative to the Hack 'n' Slash root directory.