Exploit in privmessage causes memory-leak #265

New Issue

2026-10-05T04:08:37+02:00

adam commented

2026-10-05 04:08:37 +02:00

My ZNC ( 1.0 ) has been attacked.
I don't know the details, but I know the attacker used an error concerning a missing (or wrong) null-terminator in privmessages to send a message including a payload to the ZNC.
This caused in a memory leak that sent all information like passwords to the attacker.
He has been able to log in as the user he attacked this way, also he has been able to "ghost" my nickname in the IRC-Network.

If there are any questions I'll answer them as far as I know about it.

My ZNC ( 1.0 ) has been attacked. I don't know the details, but I know the attacker used an error concerning a missing (or wrong) null-terminator in privmessages to send a message including a payload to the ZNC. This caused in a memory leak that sent all information like passwords to the attacker. He has been able to log in as the user he attacked this way, also he has been able to "ghost" my nickname in the IRC-Network. If there are any questions I'll answer them as far as I know about it.

adam closed this issue

2026-10-05 04:08:37 +02:00

adam commented

2026-10-05 04:08:38 +02:00

If this was an exploit in ZNC core or a standard module (and not an external module/modified version of ZNC), this is very concerning. Any evidence you've been able to glean from ZNC/system logs, transcripts, etc.?

If this was an exploit in ZNC core or a standard module (and not an external module/modified version of ZNC), this is very concerning. Any evidence you've been able to glean from ZNC/system logs, transcripts, etc.?

adam commented

2026-10-05 04:08:39 +02:00

Question 1: What should we do about a report saying "something has a problem somewhere"?
Question 2: What exactly do you mean with "a message including payload"?
Question 3: How do you know it is a missing or wrong null-terminator?
Question 4: Since when are private messages null-terminated in IRC?
Question 5: Since when does a memory leak do anything besides leaking memory?
Question 6: Are your passwords hashed with a salt? MD5? SHA256?
Question 7: With "ghosting" someone, you mean that you had the nickserv module set up and he got the password from it?

Question 1: What should we do about a report saying "something has a problem somewhere"? Question 2: What exactly do you mean with "a message including payload"? Question 3: How do you know it is a missing or wrong null-terminator? Question 4: Since when are private messages null-terminated in IRC? Question 5: Since when does a memory leak do anything besides leaking memory? Question 6: Are your passwords hashed with a salt? MD5? SHA256? Question 7: With "ghosting" someone, you mean that you had the nickserv module set up and he got the password from it?

adam commented

2026-10-05 04:08:39 +02:00

This caused in a memory leak that sent all information like passwords to the attacker.

> This caused in a memory leak that sent all information like passwords to the attacker.

adam commented

2026-10-05 04:08:40 +02:00

@dgw It was not a modified version of ZNC.
Until now, I have not been able to find something obvious in any logs.

@psychon

Maybe someone could have a look at it, since I personally don't have enough experience in C++
The attacker sent a privmessage including some code that has been executed and caused this memory leak
He told me.
/
If it leaks the ZNCs memory, all login data (and more) is sent to the attacker
SHA256, but due to this leak he seems to get them plain
I just wanted to point out that this memory leak sent him all data going through the ZNC. My NickServ-PW has not (!) been saved in the ZNC, it was just sent through it when I connected. After exploiting the ZNC, he had my NS-PW.
He might also have been able to see any messages (privmessages etc) stored there to be shown after connecting.

@dgw It was not a modified version of ZNC. Until now, I have not been able to find something obvious in any logs. @psychon 1. Maybe someone could have a look at it, since I personally don't have enough experience in C++ 2. The attacker sent a privmessage including some code that has been executed and caused this memory leak 3. He told me. 4. / 5. If it leaks the ZNCs memory, all login data (and more) is sent to the attacker 6. SHA256, but due to this leak he seems to get them plain 7. I just wanted to point out that this memory leak sent him all data going through the ZNC. My NickServ-PW has not (!) been saved in the ZNC, it was just sent through it when I connected. After exploiting the ZNC, he had my NS-PW. He might also have been able to see any messages (privmessages etc) stored there to be shown after connecting.

adam commented

2026-10-05 04:08:41 +02:00

If it leaks the ZNCs memory, all login data (and more) is sent to the attacker

No

SHA256, but due to this leak he seems to get them plain

No

I just wanted to point out that this memory leak sent him all data going through the ZNC. My NickServ-PW has not (!) been saved in the ZNC, it was just sent through it when I connected. After exploiting the ZNC, he had my NS-PW.
He might also have been able to see any messages (privmessages etc) stored there to be shown after connecting.

No

It is not possible for a memory leak to cause any of that.

> 1. If it leaks the ZNCs memory, all login data (and more) is sent to the attacker No > 1. SHA256, but due to this leak he seems to get them plain No > 1. I just wanted to point out that this memory leak sent him all data going through the ZNC. My NickServ-PW has not (!) been saved in the ZNC, it was just sent through it when I connected. After exploiting the ZNC, he had my NS-PW. > He might also have been able to see any messages (privmessages etc) stored there to be shown after connecting. No It is not possible for a memory leak to cause any of that.

adam commented

2026-10-05 04:08:41 +02:00

@md-5
That's just what I know / have been told.

It's a fact someone broke into our ZNC although it has just accepted connections from a tor hidden service with TorAuth, which address was known to 4 users including me.
It's a fact the attacker somehow managed to hijack our sessions.
It's a fact the attacker somehow got our passwords and more (even those that had not been saved in the ZNC)

He told me he used an (0day) exploit in privmessages to send code that is executed due to some missing / wrong null-terminator.
This caused the ZNC to reply with a memory dump that included all our data.

@md-5 That's just what I know / have been told. It's a fact someone broke into our ZNC although it has just accepted connections from a tor hidden service with TorAuth, which address was known to 4 users including me. It's a fact the attacker somehow managed to hijack our sessions. It's a fact the attacker somehow got our passwords and more (even those that had not been saved in the ZNC) He told me he used an (0day) exploit in privmessages to send code that is executed due to some missing / wrong null-terminator. This caused the ZNC to reply with a memory dump that included all our data.

adam commented

2026-10-05 04:08:42 +02:00

@GodsDeceiver why not have the attacker nicely report the details here or in IRC (#znc on Freenode)

@GodsDeceiver why not have the attacker nicely report the details here or in IRC (#znc on Freenode)

adam commented

2026-10-05 04:08:42 +02:00

@SuperSpyTX
Already tried it, but he's not interested in telling anybody more than he told me.

He used a missing / wrong null-terminator in privmessages
His exploit lead to a memory leak that gave him all our data.

That's pretty much it.

@SuperSpyTX Already tried it, but he's not interested in telling anybody more than he told me. 1. He used a missing / wrong null-terminator in privmessages 2. His exploit lead to a memory leak that gave him all our data. That's pretty much it.

adam commented

2026-10-05 04:08:43 +02:00

Who did he send the private message to? or is that where it begins?

Who did he send the private message to? or is that where it begins?

adam commented

2026-10-05 04:08:44 +02:00

@SuperSpyTX
To me and other 2 other people using the ZNC.
But nothing of that message shows up anywhere.

@SuperSpyTX To me and other 2 other people using the ZNC. But nothing of that message shows up anywhere.

adam commented

2026-10-05 04:08:44 +02:00

Closing until more details are provided.

Closing until more details are provided.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#265