UPDATE Jan 15 09 - exploits actively abused

[ReyalP]

UPDATE July 23 2010
wwwdl drop all clients exploit. See http://bani.anime.net/banimod/forums/vi ... 7&start=60

UPDATE January 15 2009
Specially crafted vote and similar commands (using a hacked client) can be used to execute console commands on the server. http://aluigi.freeforums.org/quake3-eng ... -t686.html

combinedfixes.lua updated.

UPDATE August 1 2008
etadmin_mod can be tricked into giving people with certain names admin access. See http://www.snl-clan.com/forum/viewtopic.php?f=9&t=9789 for a workaround.

ty SNL|Lucel|STA

UPDATE May 16 2008
Updated hash for combinedfixes.

UPDATE April 21 2008
Fixed

Code: Select all

etpro: et_RunFrame error running lua script: [string "combinedfixes.lua"]:127: attempt to call field `match' (a nil value)

error.

combinedfixes.lua now uses string.find instead of string.match.

UPDATE April 1 2008
Individual modules retired, combined fixes is the only one being maintained from now on.

Updated to prevent some more userinfo abuse, which allowed players to bypass the fakeplayer prevention, among other things. Thanks again DoGoD

UPDATE Mar 23 2008
userinfocheck.lua combindedfixes.lua updated to prevent an exploit in guidcheck.lua.

If you want to use the guidcheck fix, you MUST either update your combinedfixes.lua or run both userinfocheck.lua and guidcheck.lua

Note lua mod authors
The exploit relies on the fact that chat (or /m) with well chosen player names allows almost arbitrary strings to be sent to the et_Print function. Lua mod authors are urged to treat the text sent to et_Print with extreme caution.

Note to etadmin_mod users
Similar exploits likely exist against other log parsers such as etadmin_mod. The updated version of userinfocheck.lua may be used to prevent some abuse of this sort, but you must uncomment some lines in the file yourself. This is untested, and very likely does not eliminate all such exploits against etadmin_mod.

edit Mar 24 2008:
The name vulnerability should only apply to log parsers which read the game console or console log, not the game log.

Thanks to Hadr0 for bringing the guidcheck problem to my attention.

-- earlier post follows--
edit:
Updated Mar 2 2008
- fix nil var ref if kicked in RunFrame
- fix incorrect clientNum in log message for ClientConnect kick
thanks to DoGoD and benny.

--original post--
Several significant exploits against ET and ETPro have recently been brought to our attention.

• the "ws" clientcommand can be used to crash servers, or with a modified client, obtain arbitrary information such as passwords from server memory. Since tvgame does not support lua, a fixed tvgame is available here: tvgame-update.zip. This should work with beta13. People who already have my ettv test builds don't need this, it's the same tvgame.
• clients can send malformed userinfo which can confuse some game functions about their IP.
• Cheats which spoof etpro guids can crash servers.
• q3fill DOS program to fill up servers with bogus players.

All of these exploits have been observed in the wild. It is strongly recommended that you run combinedfixes.lua

The ws and infostring exploits affect all ET versions and mods. The authors of noquarter, jaymod, and etpub have been informed. The guid exploit obviously only affects etpro.

To install lua modules:
copy the .lua file to your etpro directory and add

Code: Select all

set lua_modules "somemodule.lua anothermodule.lua"

to your server cfg. lua_modules takes effect after a map change or map_restart. You can check whether your mod was loaded using the lua_status command, on either a client or the server console.

For leagues that wish to use these modules with their certified configs, you should also setl lua_allowedmodules to the hash of the module you wish to use. You can obtain this hash with lua_status. Because of length limitations, you can only allow one module in a .config, so use of combinedfixes.lua or your own custom module is recommended. The hash of combinedfixes.lua is

Code: Select all

1D864F1C022DD8E4F2103C5CCBF468FB9A84E39E

By default the combinedfixes.lua limits users to 3 connections per IP. You may want to adjust this using the cvar ip_max_clients if you expect a lot of players to connect from the same IP.

Thanks to McSteve and pants for bringing these to our attention. As always, we appreciate the help of the community in identifying this sort of thing.

[Nail]

Thank you very much

[nedd3h]

Thanks for this, I've added the combinedfixes script to my server.

[Pantaloons]

thanks for your time & effort reyal

[Luk4ward]

thx:), so all cheaters with spoofed etpro guids like 13333333337 are kicking out, nice. McSteve was working of such thing as on many g8 things:P. I wonder if u can add to this lua the cl_guid checking,

cheers

[SoupDragon]

Nice to see, tvm

But why not a small increment and release of etpro instead? I feel the uptake of this fix will be slower.

[ReyalP]

thx:), so all cheaters with spoofed etpro guids like 13333333337 are kicking out, nice. McSteve was working of such thing as on many g8 things:P. I wonder if u can add to this lua the cl_guid checking,

cheers

This module does NOT make etpro GUIDs any more reliable than they were. They are still broken and can still be spoofed, and so should not be used for just about anything. All it does is prevent some obviously malformed ones (including particular ones that have bad side effects) from being used.

You could do similar checking on the cl_guid in userinfo, but I don't see the point.

Note that if you want to gather IPs of people who are ~100% sure trying to cheat, search your server log for guidcheck: messages.

[Luk4ward]

thx:), so all cheaters with spoofed etpro guids like 13333333337 are kicking out, nice. McSteve was working of such thing as on many g8 things:P. I wonder if u can add to this lua the cl_guid checking,

cheers

This module does NOT make etpro GUIDs any more reliable than they were. They are still broken and can still be spoofed, and so should not be used for just about anything. All it does is prevent some obviously malformed ones (including particular ones that have bad side effects) from being used.

You could do similar checking on the cl_guid in userinfo, but I don't see the point.

Note that if you want to gather IPs of people who are ~100% sure trying to cheat, search your server log for guidcheck: messages.

I understand and knows about it, but @ cl_guid, sometimes some pr0 cheaters got spoofed cl_guid not etpro so the command !ban cheater can do nothing to them, but u will say propably that this is the problem of etadmin mod users ;p and lua patch is only to prevent from crashing / exploiting the servers,

regards

[Tron]

Speaking of exploits, I witnessed a particular one some weeks ago. I don't know if it's a well known one or not, but with my limited server setup knowledge I guess you could stop it with flood protection (?). What happened was that some guy very rapidly switched teams for some seconds until the server seemingly crashed. The console log looks like this:

[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
...

I have a demo if required.

[Gobbo]

brilliant work .. had the ws lua but not the others ... We just had 2 days of server being crashed every few maps and then today we had someone connect and bring in something like 5 bots with 0 ping and when we looked close all same ip .
So guess you have fixed all my problems ..
And all i was looking for was if i had missed a sv_command like max ip limit !

Really many thanks .

[ReyalP]

Speaking of exploits, I witnessed a particular one some weeks ago. I don't know if it's a well known one or not, but with my limited server setup knowledge I guess you could stop it with flood protection (?). What happened was that some guy very rapidly switched teams for some seconds until the server seemingly crashed. The console log looks like this:

[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
[skipnotify]kajohahahahaa^7 entered the game
kajohahahahaa^7 has joined the Axis team^7!
kajohahahahaa^7 has joined the Spectators^7!
...

I have a demo if required.

The floodkick stuff in 3.2.6 should prevent this. That is why it was implemented. Perhaps the server admin changed the the default values ?

@SoupDragon
These fixes will be in the next etpro release. These scripts allow us to address the issues right away, without the usual beta cycle that goes with a full release, or the delays that leagues usually have adopting updates. If admins decide not to use the workarounds provided, that is their choice and certainly not my problem.

[Tron]

Perhaps the server admin changed the the default values ?

I guess b_floodMaxCommands is the cvar to be checked (?). '/pb_cvarval b_floodMaxCommands' on that server says '3' now, but I didn't check this when the server got crashed 4 weeks ago.

[ReyalP]

see here:
http://bani.anime.net/banimod/forums/vi ... 5298#65298

[h3ll]

nice, now lets see how long it takes for CB to update their configs

[Lagger]

nice, now lets see how long it takes for CB to update their configs

not very long, apparently