UPDATE Jan 15 09 - exploits actively abused

Discussion for Admins of ETPro/BayonET servers.
If you don't run a server, please don't post here...

Moderators: Forum moderators, developers

User avatar
ReyalP
Posts: 1663
Joined: Fri Jul 25, 2003 11:44 am

UPDATE Jan 15 09 - exploits actively abused

Post by ReyalP »

UPDATE July 23 2010
wwwdl drop all clients exploit. See http://bani.anime.net/banimod/forums/vi ... 7&start=60

UPDATE January 15 2009
Specially crafted vote and similar commands (using a hacked client) can be used to execute console commands on the server. http://aluigi.freeforums.org/quake3-eng ... -t686.html

combinedfixes.lua updated.

UPDATE August 1 2008
etadmin_mod can be tricked into giving people with certain names admin access. See http://www.snl-clan.com/forum/viewtopic.php?f=9&t=9789 for a workaround.

ty SNL|Lucel|STA

UPDATE May 16 2008
Updated hash for combinedfixes.

UPDATE April 21 2008
Fixed

Code: Select all

etpro: et_RunFrame error running lua script: [string "combinedfixes.lua"]:127: attempt to call field `match' (a nil value)
error.

combinedfixes.lua now uses string.find instead of string.match.

UPDATE April 1 2008
Individual modules retired, combined fixes is the only one being maintained from now on.

Updated to prevent some more userinfo abuse, which allowed players to bypass the fakeplayer prevention, among other things. Thanks again DoGoD

UPDATE Mar 23 2008
userinfocheck.lua combindedfixes.lua updated to prevent an exploit in guidcheck.lua.

If you want to use the guidcheck fix, you MUST either update your combinedfixes.lua or run both userinfocheck.lua and guidcheck.lua

Note lua mod authors
The exploit relies on the fact that chat (or /m) with well chosen player names allows almost arbitrary strings to be sent to the et_Print function. Lua mod authors are urged to treat the text sent to et_Print with extreme caution.

Note to etadmin_mod users
Similar exploits likely exist against other log parsers such as etadmin_mod. The updated version of userinfocheck.lua may be used to prevent some abuse of this sort, but you must uncomment some lines in the file yourself. This is untested, and very likely does not eliminate all such exploits against etadmin_mod.

edit Mar 24 2008:
The name vulnerability should only apply to log parsers which read the game console or console log, not the game log.

Thanks to Hadr0 for bringing the guidcheck problem to my attention.

-- earlier post follows--
edit:
Updated Mar 2 2008
- fix nil var ref if kicked in RunFrame
- fix incorrect clientNum in log message for ClientConnect kick
thanks to DoGoD and benny.

--original post--
Several significant exploits against ET and ETPro have recently been brought to our attention.
  • the "ws" clientcommand can be used to crash servers, or with a modified client, obtain arbitrary information such as passwords from server memory. Since tvgame does not support lua, a fixed tvgame is available here: tvgame-update.zip. This should work with beta13. People who already have my ettv test builds don't need this, it's the same tvgame.
  • clients can send malformed userinfo which can confuse some game functions about their IP.
  • Cheats which spoof etpro guids can crash servers.
  • q3fill DOS program to fill up servers with bogus players.
All of these exploits have been observed in the wild. It is strongly recommended that you run combinedfixes.lua

The ws and infostring exploits affect all ET versions and mods. The authors of noquarter, jaymod, and etpub have been informed. The guid exploit obviously only affects etpro.

To install lua modules:
copy the .lua file to your etpro directory and add

Code: Select all

set lua_modules "somemodule.lua anothermodule.lua"

to your server cfg. lua_modules takes effect after a map change or map_restart. You can check whether your mod was loaded using the lua_status command, on either a client or the server console.

For leagues that wish to use these modules with their certified configs, you should also setl lua_allowedmodules to the hash of the module you wish to use. You can obtain this hash with lua_status. Because of length limitations, you can only allow one module in a .config, so use of combinedfixes.lua or your own custom module is recommended. The hash of combinedfixes.lua is

Code: Select all

1D864F1C022DD8E4F2103C5CCBF468FB9A84E39E
By default the combinedfixes.lua limits users to 3 connections per IP. You may want to adjust this using the cvar ip_max_clients if you expect a lot of players to connect from the same IP.

Thanks to McSteve and pants for bringing these to our attention. As always, we appreciate the help of the community in identifying this sort of thing.
Last edited by ReyalP on Thu Aug 12, 2010 8:18 pm, edited 14 times in total.
send lawyers, guns and money
User avatar
Nail
Posts: 425
Joined: Fri Jan 02, 2004 3:47 pm
Contact:

Post by Nail »

Thank you very much
Improvise, Adapt, Overcome
nedd3h
Posts: 67
Joined: Fri Jan 14, 2005 12:52 am
Location: Australia
Contact:

Post by nedd3h »

Thanks for this, I've added the combinedfixes script to my server.
User avatar
Pantaloons
Posts: 6
Joined: Wed Nov 17, 2004 3:36 pm
Contact:

Post by Pantaloons »

thanks for your time & effort reyal :thumbs:
www.fatalpunishers.com

[fP]Demolition Centre Too

81.169.171.73:29960
User avatar
Luk4ward
Posts: 236
Joined: Sun Jul 30, 2006 1:55 pm
Location: Poland
Contact:

Post by Luk4ward »

thx:), so all cheaters with spoofed etpro guids like 13333333337 are kicking out, nice. McSteve was working of such thing as on many g8 things:P. I wonder if u can add to this lua the cl_guid checking,

cheers
wolFTeam.pl
SoupDragon
Posts: 1
Joined: Wed Feb 16, 2005 6:28 am

Post by SoupDragon »

Nice to see, tvm

But why not a small increment and release of etpro instead? I feel the uptake of this fix will be slower.
Last edited by SoupDragon on Fri Apr 27, 2007 1:54 pm, edited 1 time in total.
User avatar
ReyalP
Posts: 1663
Joined: Fri Jul 25, 2003 11:44 am

Post by ReyalP »

Luk4ward wrote:thx:), so all cheaters with spoofed etpro guids like 13333333337 are kicking out, nice. McSteve was working of such thing as on many g8 things:P. I wonder if u can add to this lua the cl_guid checking,

cheers
This module does NOT make etpro GUIDs any more reliable than they were. They are still broken and can still be spoofed, and so should not be used for just about anything. All it does is prevent some obviously malformed ones (including particular ones that have bad side effects) from being used.

You could do similar checking on the cl_guid in userinfo, but I don't see the point.

Note that if you want to gather IPs of people who are ~100% sure trying to cheat, search your server log for guidcheck: messages.
send lawyers, guns and money
User avatar
Luk4ward
Posts: 236
Joined: Sun Jul 30, 2006 1:55 pm
Location: Poland
Contact:

Post by Luk4ward »

ReyalP wrote:
Luk4ward wrote:thx:), so all cheaters with spoofed etpro guids like 13333333337 are kicking out, nice. McSteve was working of such thing as on many g8 things:P. I wonder if u can add to this lua the cl_guid checking,

cheers
This module does NOT make etpro GUIDs any more reliable than they were. They are still broken and can still be spoofed, and so should not be used for just about anything. All it does is prevent some obviously malformed ones (including particular ones that have bad side effects) from being used.

You could do similar checking on the cl_guid in userinfo, but I don't see the point.

Note that if you want to gather IPs of people who are ~100% sure trying to cheat, search your server log for guidcheck: messages.
I understand and knows about it, but @ cl_guid, sometimes some pr0 cheaters got spoofed cl_guid not etpro so the command !ban cheater can do nothing to them, but u will say propably that this is the problem of etadmin mod users ;p and lua patch is only to prevent from crashing / exploiting the servers,

regards
wolFTeam.pl
Tron
Posts: 22
Joined: Mon Apr 18, 2005 7:30 pm

Post by Tron »

Speaking of exploits, I witnessed a particular one some weeks ago. I don't know if it's a well known one or not, but with my limited server setup knowledge I guess you could stop it with flood protection (?). What happened was that some guy very rapidly switched teams for some seconds until the server seemingly crashed. The console log looks like this:

[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
...

I have a demo if required.
Gobbo
Posts: 4
Joined: Mon Oct 02, 2006 3:22 am

Post by Gobbo »

brilliant work .. had the ws lua but not the others ... We just had 2 days of server being crashed every few maps and then today we had someone connect and bring in something like 5 bots with 0 ping and when we looked close all same ip .
So guess you have fixed all my problems ..
And all i was looking for was if i had missed a sv_command like max ip limit !

Really many thanks . 8)
User avatar
ReyalP
Posts: 1663
Joined: Fri Jul 25, 2003 11:44 am

Post by ReyalP »

Tron wrote:Speaking of exploits, I witnessed a particular one some weeks ago. I don't know if it's a well known one or not, but with my limited server setup knowledge I guess you could stop it with flood protection (?). What happened was that some guy very rapidly switched teams for some seconds until the server seemingly crashed. The console log looks like this:

[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
...

I have a demo if required.
The floodkick stuff in 3.2.6 should prevent this. That is why it was implemented. Perhaps the server admin changed the the default values ?

@SoupDragon
These fixes will be in the next etpro release. These scripts allow us to address the issues right away, without the usual beta cycle that goes with a full release, or the delays that leagues usually have adopting updates. If admins decide not to use the workarounds provided, that is their choice and certainly not my problem.
send lawyers, guns and money
Tron
Posts: 22
Joined: Mon Apr 18, 2005 7:30 pm

Post by Tron »

ReyalP wrote:Perhaps the server admin changed the the default values ?
I guess b_floodMaxCommands is the cvar to be checked (?). '/pb_cvarval b_floodMaxCommands' on that server says '3' now, but I didn't check this when the server got crashed 4 weeks ago. :(
User avatar
ReyalP
Posts: 1663
Joined: Fri Jul 25, 2003 11:44 am

Post by ReyalP »

send lawyers, guns and money
User avatar
h3ll
Posts: 3
Joined: Fri Apr 13, 2007 4:29 pm
Location: The Netherlands
Contact:

Post by h3ll »

nice, now lets see how long it takes for CB to update their configs
User avatar
Lagger
Posts: 316
Joined: Mon Sep 29, 2003 8:30 am

Post by Lagger »

h3ll wrote:nice, now lets see how long it takes for CB to update their configs
not very long, apparently
Post Reply