# Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser

Unchecked strcpy of hl.exe's -game argument overflows the stack, letting a malicious steam:// link hijack EIP and run shellcode on victims with Half-Life installed.

- Payout: hidden
- Severity: high
- Program: Valve
- Found by: irukandjisecresearch
- Disclosed: 2020-08-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/832750
- Library page: https://bugbountylibrary.com/r/h1%3A832750
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:reverse-engineering vuln:memory-corruption vuln:rce

**Target:** hl.exe command-line -game argument via Steam URI handler
**Root cause:** WinMain() copies the -game argument into a fixed stack buffer with strcpy() without bounds checking, overwriting the saved return address.
**Steps:**
1. Craft payload of 524 'A' bytes followed by 4 bytes overwriting the return address.
2. Point return address at a JMP ESP gadget (0x757d6537 in an ASLR'd OS module) followed by alpha-encoded shellcode.
3. Run `hl.exe -game <payload>` or deliver via `steam://rungameid/70//-game <payload>` in a browser.
4. Observe EIP control in Immunity Debugger and shellcode execution on return.
**How found:** Researcher reviewed documented command-line options, noted -game is copied via strcpy in WinMain(), and confirmed the overflow by feeding an oversized argument in Immunity Debugger and watching EIP become controlled.
**Exploitation:** Attacker hosts a page that navigates the victim's browser to a steam:// URI passing an oversized -game argument; Steam launches hl.exe, the strcpy overflow overwrites the return address, and a JMP ESP gadget in an OS DLL redirects execution into shellcode (e.g. msfvenom windows/exec calc.exe).
**Escalation:** Browser-to-Steam URI handler turns a local argument overflow into remote code execution triggered by a single malicious link.
**Insight:** Documented CLI/URI launch arguments that get strcpy'd are a reliable local-to-remote RCE path; when the payload must stay printable ASCII, pivot to an OS-module JMP ESP gadget and accept ASLR brute-force odds (1/256 on 32-bit).