synacktiv/nwn-exploitNeverwinter Nights : Enhanced edition exploit
This repository contains PoC to exploit Neverwinter Nights: Enhanced Editions. This blogpost details vulnerabilities and exploitation.
poc-server-1.js instruments NWN game server to trigger a memory leak vulnerablility.
poc-server-2.js instruments NWN game server to receive memory leak and exploit a second vulnerability. This will execute calc.exe on victim.
Machine 1 :
frida nwmain.exe -l poc-server-1.jsMachine 2 (IP: 192.168.56.105) :
frida nwmain.exe -l poc-server-2.jsVictim :
Connect to server 1
Create or choose a character and begin to play.
On machine 1 : type exploit(); in frida console (After the module has been loaded). Script will redirect player to server 2.
On machine 2 : type exploit(); in frida console (After the module Chapter 3 has been loaded). Script will exploit vulnerability to execute calc.exe.