#######################################################################

                             Luigi Auriemma

Application:  TeamSpeak 3
              http://www.teamspeak.com
Versions:     <= 3.0.0-beta23
              2.x not affected
Platforms:    Windows, Mac OS X and Linux
Bugs:         A] execution of various admin commands
              B] various failed assertions
              C] various NULL pointer dereferences
Exploitation: remote, versus server
Date:         16 Jun 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


TeamSpeak 3 is the latest and current version of one of the most
popular VOIP softwares intended mainly for gamers where exists just a
florid market of hosters for renting servers.


#######################################################################

=======
2) Bugs
=======


First a small introduction and a little explanation about why the old
2.x versions aren't vulnerable.
From the major version 3.x TeamSpeak has completely changed the whole
protocol used by the Standard Port (UDP 9987) adding encryption with
variable ivec (uses libtomcrypt) and using 7 channels for each type of
packet, like channel 2 for the commands packets.

All the vulnerabilities below are exploitable by unauthenticated users
and even via one single UDP packet making it possible to spoof it and
bypassing any possible IP based filter on the server.


--------------------------------------
A] execution of various admin commands
--------------------------------------

The commands available through channel 2 are exactly those available
in the TeamSpeak 3 ServerQuery Manual (doc\ts3_serverquery_manual.pdf)
and partially those available through the TCP port 10011.

They can be used to change practically any aspect of the server and
the hosted virtual servers but obviously they require some permissions.
The problem is that through this particular way (the standard port's
channel) and before any login/join on the server (so just the first
packet) it's possible to execute even some of those commands that
require permissions.

The following is a list of commands that have been tested with success:
  banclient
  bandel
  channeladdperm/channeldelperm
  channelclientaddperm/channelclientdelperm
  channeldelete
  channeledit
  some others channelgroup* commands
  channelmove
  clientaddperm/clientdelperm
  clientdbdelete
  clientget* commands
  clientkick
  clientmove
  clientpoke
  messageadd
  sendtextmessage
  serveredit
  servergroupadd
  other servergroup* commands
  setclientchannelgroup
  tokenadd/tokendel
  various "view-only" commands but they don't print the output back
  ... other commands

Who knows a bit how the configuration of TeamSpeak works or has given a
quick look to the manual can understand the dangerousness caused by the
execution of some of these commands.
The following are some examples and scenarios:

- serveredit
  through this command is possible to configure the server/virtual
  server modifying any possible option like adding a custom join
  password, setting the number of max clients to zero so that nobody
  can join, changing the admin group, setting a custom filebase (the
  disk location where are saved all the avatars of the clients and
  other files), setting custom banners and host message, disable logs,
  disable uploads and downloads, change the server's port, retrieving
  all the IPs and "suid" of any client in the server through the
  setting of virtualserver_hostbanner_gfx_url and other things

- sendtextmessage
  it's possible to use this command for sending a message to the main
  channel or to specific channels and clients from the user "Server",
  good for social engineering and flooding (clients will freeze in
  some cases)

- channel*
  it's possible to delete and move the channels created by the users

- client* and ban*
  it's possible to kick and ban any client currently in the server
  and even unban any permanent and temporary ban or deleting the users
  from the database and so on

- clientpoke
  this particular command spawns a dialog box on the client containing
  a message (annoyance)

- messageadd
  sends offline messages from the server (possible social engineering)

- token* and servergroup*
  these commands could be used for gaining more privileges anyway I
  have not understood and tested them much

Note that, upon success, the output of the commands is not returned
making the "view-only" commands available through this method (like
version, permissionlist, clientgetids and the others) enough useless
while a message is returned in case of errors and unavailable or
incomplete commands.
This could be enough ugly in some cases where are needed IDs and other
numeric identificators for channels and clients but most of them can
be retrieved probably from the protocol of a normal client and from
the info available from there otherwise it's possible to brute force
them.

Note also that exist some commands not listed yet in the official
ServerQuery manual because are commands used by the client for itself
like clientsitereport, setwhisperlist and so on.

Although "serveredit" is already a critical command I have not tested
if it's possible to become superadmin (I mean to login in the server
through a token or the TCP interface for administering it "normally"
like a normal admin without using this vulnerability because
"serveredit" is already a superadmin command) or causing more system
damages like files reading and overwriting.
UPDATE:
the "serveraddgroupclient" command is the one for assigning superadmin
privileges to users.

It's also important to highlight the "virtualserver_hostbanner_gfx_url"
parameter of "serveredit" because the client automatically loads that
url at regular intervals or when it joins the server or each time it
gets modified and http:// is not the only protocol handler that can be
used (ftp://, file:// and any other one supported by the client's
browser) so it "could" be used for exploiting particular clientside
bugs (like freezing/crashing it with particular files) or for forcing
the clients to exploit external web server vulnerabilities and other
possible things.
But yeah this is not related to this advisory or should require a
separate bug section.


----------------------------
B] various failed assertions
----------------------------

Some of the available TeamSpeak 3 commands used via the standard's port
method cause various failed assertions on the server that will
terminate silently.
The following is the list of the commands and relative assertions:

  banlist                     Assertion "invokerClientID != 0" failed at server\serverlib\virtualserver.cpp:7442; 
  complainlist                Assertion "client != 0" failed at server\serverlib\permission_manager.cpp:167; 
  servernotifyunregister      not implemented
  serverrequestconnectioninfo Assertion "client != 0" failed at server\serverlib\permission_manager.cpp:167; 
  setconnectioninfo           Assertion "clID != 0" failed at common\packethandler.cpp:367; 
  servernotifyregister event=server   not implemented


------------------------------------
C] various NULL pointer dereferences
------------------------------------

Exactly as above except that the following are all NULL pointers that
cause a crash of the server:

  bandelall
  channelcreate channel_name=name
  channelsubscribe cid=1
  channelsubscribeall
  banadd ip=1.2.3.4
  clientedit clid=1 client_description=none
  messageupdateflag msgid=1 flag=1
  complainadd tcldbid=1 message=none
  complaindelall tcldbid=1
  ftinitupload clientftfid=1 name=file.txt cid=5 cpw= size=9999 overwrite=1 resume=0
  ftgetfilelist cid=1 cpw= path=\/
  ftdeletefile cid=1 cpw= name=\/
  ftcreatedir cid=1 cpw= dirname=\/
  ftrenamefile cid=1 cpw= tcid=1 tcpw=secret oldname=\/ newname=\/
  ftinitdownload clientftfid=1 name=\/ cid=1 cpw= seekpos=0


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/teamspeakrack.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13959.zip (teamspeakrack.zip)


#######################################################################

======
4) Fix
======


No fix.

UPDATE:
version 3.0.0-beta25


#######################################################################