PWNING CALL OF DUTY 1: A 20-YEAR-OLD RCE, FOUND IN AN EVENING WITH AI

Summary from the TLDR InfoSec newsletter

Researchers tested Call of Duty 1's Linux dedicated server in Docker, where they found a stack overflow in the rcon map command. A 72-byte buffer accepted an unchecked map name. Sending 76 bytes overwrote the saved return address, and input filtering blocked high-byte addresses and int 0x80. The exploit used a low-memory jmp esp gadget and alphanumeric-safe shellcode with sysentera and it achieved a shell in the game-server process. The flaw requires the rcon password, making it post-authentication RCE.