Exploiting Titan Quest Arbitrary Code Execution Through Mali...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://synacktiv.com/en/publications/exploiting-titan-quest.html
• Blog Title: Exploiting Titan Quest: Arbitrary Code Execution Through Malicious Custom Maps
• Suggested Section: Binary Exploitation → Libc Heap → Heap Overflow, with cross-references from Binary Exploitation → Integer Overflow, ROP & JOP → Stack Pivoting, and Generic Methodologies → Fuzzing/binary file-format parser exploitation

🎯 Content Summary

Overview and attack vector

Synacktiv analyzed the 32-bit GOG release of Titan Quest: Anniversary Edition v2.10.21415 on Windows 11 Professional 10.0.26200. The game supports community-created worlds installed manually under C:\Users\user\Documents\My Games\Titan Quest - Immortal Throne\custommaps. A malicious map can therefore deliver attacker-controlled binary assets that are parsed inside the game process. The demonstrated exploit chain...

🔧 Technical Details

Integer-overflow and independent-copy-length bug: A binary parser is exploitable when it allocates width * height bytes using fixed-width arithmetic but copies an independent attacker-controlled count. The multiplication may wrap modulo 2^32, and count may independently exceed the allocation. Attackers can choose the dimensions to obtain a desired heap size and use the copied file data as a controlled forward heap overflow.

Destination-capacity bugs in binary deserialization: Checking that input remains inside the source buffer is insufficient. Every file-controlled element count must also be validated against the destination array's capacity. Loops that advance through fixed arrays or consecutive structure members can corrupt a heap object even when each individual string or primitive value is read safely. This pattern applies to arrays of C++ strings, booleans, DWORDs, compound records, and...

🤖 Agent Actions

Done — I updated:

• src/binary-exploitation/libc-heap/heap-overflow.md

What I added:

• A new parser-driven heap overflow exploitation section covering:
  • integer-wrap + independent copy-length bugs
  • destination-capacity validation failures in deserializers
  • heap grooming with variable-length reference-counted objects
  • multi-stage embedded asset exploitation
  • pre-cleanup pointer hijack
  • minimal fake C++ objects
  • 32-bit heap spray + virtual-call stack pivot
• Internal links to existing integer overflow and stack pivoting pages
• The Synacktiv Titan Quest article in References

I kept the change scoped to a single file and verified that it’s the only modified file.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://synacktiv.com/en/publications/exploiting-titan-quest.html

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation → Libc Heap → Heap Overflow, with cross-references from Binary Exploitation → Integer Overflow, ROP & JOP → Stack Pivoting, and Generic Methodologies → Fuzzing/binary file-format parser exploitation".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0