cyber.hendryadrian.com
Threat Research · aikido.dev

MECCHA CHAMELEON Maps Enabled a Delayed RCE Through Arbitrary File Writes

· Original article ↗

Summary

Researchers demonstrated that a crafted MECCHA CHAMELEON map could exploit an exposed recording function to write a payload to the Windows Startup folder, enabling delayed RCE. The game fixed the issue in version 4.0.0.

Key points

  • MECCHA CHAMELEON maps can contain Unreal Engine Blueprints that run inside the game when loaded.
  • Researchers found the exposed Finish Recording Output function could write files to arbitrary filesystem paths.
  • A null byte in the filename bypassed Unreal’s automatic .wav suffix, allowing a chosen filename.
  • The proof of concept used controlled PCM audio data to place an HTA-compatible payload in the WAV file.
  • Writing the payload to the Windows Startup folder could enable remote code execution after a restart.
  • The developers fixed the issue in version 4.0.0; StopRecordingOutput no longer creates files.
  • The researchers reported finding no Steam Workshop maps exploiting this issue.

Article Details

Attack Vectors
  • A malicious community map runs Blueprint graphs when loaded in MECCHA CHAMELEON, calling the exposed StopRecordingOutput function to write files to arbitrary filesystem paths.
  • A null character in the supplied filename causes the file-writing path to discard the trailing text, allowing the payload to use an executable extension despite Unreal Engine appending .wav.
  • The attacker-controlled PCM samples contain an HTA script after the WAV header; mshta.exe can run the script, which uses WScript.Shell to start another process.
  • The proof of concept writes the payload to the Windows Startup folder so it can run after a system restart.
Defensive Notes
  • The vulnerability was fixed in MECCHA CHAMELEON version 4.0.0; the article says the update is automatically installed before the game launches.
  • The patched StopRecordingOutput function no longer creates files.
  • The researchers recommend playing only on official MECCHA CHAMELEON maps and exercising caution with custom maps.
  • The researchers report that they checked Steam Workshop maps and found none exploiting this issue.

MITRE ATT&CK

T1059.007 · JavaScriptThe HTA proof of concept contains script code that uses WScript.Shell to start Calculator.T1203 · Exploitation for Client ExecutionLoading a crafted MECCHA CHAMELEON map triggers the vulnerable exposed function, enabling the described remote code execution.T1218.005 · MshtaThe proof-of-concept payload is an HTA that Windows opens with mshta.exe to run its script.T1547.001 · Registry Run Keys / Startup FolderThe proof of concept writes its payload to the Windows Startup folder for execution after a restart.

Products

MECCHA CHAMELEONTL;DR: We found another delayed RCE in MECCHA CHAMELEON.Microsoft Windowsa delayed remote code execution is to write an executable to C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. Whenever your device starts up, it will automatically execute all files inUnreal EngineMECCHA CHAMELEON maps have more control than that. The game is built with Unreal Engine 5.6.1, and its maps can contain Blueprints. Blueprint is Unreal's visual programming system. You can connect nodes to make

Related Articles