Posts: 108
Threads: 3
Joined: Jun 2010
Dec 11 03:34:45 [188.220.239.21] client BluePr!nt|BC| called a vote: ban player Teh54, reason: GTFO
Dec 11 03:34:45 [88.163.251.84] disconnecting client Teh54 (vote-banned from the server) cn 2, 28 seconds played, score saved
Dec 11 03:34:50 [88.163.251.84] client connected
Dec 11 03:34:50 [88.163.251.84] disconnecting client Teh54 (connection refused - you have been banned from this server) cn 2, 0 seconds played
Dec 11 03:34:52 [] >1$U<kaBOOM gibbed Miyagui
Dec 11 03:34:54 [] client connected
Dec 11 03:34:54 [] Ashley logged in (default), AC: 1104|840
Dec 11 03:34:55 [] +sCr3W+ParK0uR says: 'Go get 'em boys!'
Dec 11 03:34:58 [] +sCr3W+ParK0uR says: 'We did it!'
Dec 11 03:34:59 [] disconnected client Miyagui cn 4, 188 seconds played, score saved
Dec 11 03:35:00 [] ITCHI-BATI-SAN gibbed >1$U<kaBOOM
Dec 11 03:35:02 [] >1$U<kaBOOM says: 'ns'
Dec 11 03:35:03 [] +sCr3W+ParK0uR says: 'We did it!'
Dec 11 03:35:05 [88.163.251.84] client connected
Dec 11 03:35:05 [88.163.251.84] Teh54 logged in (default), AC: 1103|840
Dec 11 03:35:12 [88.163.251.84] Teh54 says: '?????????'
Dec 11 03:35:12 [] +sCr3W+ParK0uR gibbed >1$U<kaBOOM
Dec 11 03:35:18 [] >1$U<kaBOOM says: 'how he come backl'
Dec 11 03:35:22 [] +sCr3W+ says: 'hackkkk'
Teh54 used the same IP yet, was able to reconnect in less then a minute. he done this various times..
how is this possible with no IP change?
Posts: 192
Threads: 0
Joined: Jun 2010
Weird, maybe it's an exploit.
Posts: 890
Threads: 16
Joined: Jun 2010
Whatever he did it only took him 15 seconds. I'd guess it's a simple exploit that just hasn't been found.
Posts: 3,462
Threads: 72
Joined: Jun 2010
I took a noticing to his AC version which was 1103, was he using a different one before that?
* Ronald_Reagan starts shooting in the dark
Posts: 533
Threads: 33
Joined: Jun 2010
which server? what is the setting of "-kB"?
Posts: 1,436
Threads: 7
Joined: Jun 2010
"If you don't know what it does, better set it to 0"?
Posts: 108
Threads: 3
Joined: Jun 2010
12 Dec 10, 01:28PM
(This post was last modified: 12 Dec 10, 01:29PM by Blue_Pr!nt.)
the "-kB" although wrong was not the issue. (note arke, bans on others did remain, i have a "abnormal client behaviour" and my ban needed the admin pass after 5 minutes)
so there is still some exploit used. does no one know him? [Teh54] he has some skill, thats the worse part of it
Posts: 3,780
Threads: 33
Joined: Jun 2010
I think Ronald_Reagan is on to something, but can't confirm it.
So I tried a different approach. After running some tests on a local server, I believe the exploit is based on changes made to local DNS -- changing the local IP address without changing the external IP address. Something as simple as switching to another computer may allow this, though I believe some additional tweaking is required.
My experiment, truncated for clarity:
logging local AssaultCube server (version 1104, protocol 1132/104) now..
[127.1.1.0] client connected
[127.1.1.0] unarmed logged in (default), AC: 1104|840
[127.1.1.0] client connected
[127.1.1.0] DES|V-Man logged in (default), AC: 1104|840
[127.1.1.0] player DES|V-Man used admin password in line 9
[127.1.1.0] set role of player DES|V-Man to admin
[127.1.1.0] client DES|V-Man called a vote: ban player unarmed, reason: noob
[127.1.1.0] disconnecting client unarmed (vote-banned from the server) cn 0, 49 seconds played, score saved
[127.1.1.0] client connected
[127.1.1.0] disconnecting client unarmed (connection refused - you have been banned from this server) cn 0, 0 seconds played
[127.0.0.1] client connected
[127.0.0.1] unarmed logged in (default), AC: 1104|840
[127.0.0.1] unarmed says: ':D'
Although... I can't imagine why an external IP address would be discriminated by the server in this way. "88.163.251.84" looks like any other "88.163.251.84" to the server. I can't imagine how this would be done in a public server.
Posts: 108
Threads: 3
Joined: Jun 2010
locally i can see the sense in that. was the server on your machine? (maybe a stupid Q from IP's)
if the server was remote i would be interested in that local change being allowed/making a difference remotely. which i doubt but nice try V-man
Posts: 3,780
Threads: 33
Joined: Jun 2010
As I said, I can't figure out how to apply this principle on an external IP basis. :/ But I think it's a clue!
Posts: 1,436
Threads: 7
Joined: Jun 2010
I'm pretty sure this is an error somewhere in AC's code. I don't think it's related to networking in any way, but you could tip eihrul about it.
Posts: 108
Threads: 8
Joined: Dec 2010
Is it possible that this isn't as complicated as a hack? Maybe he just got ahold of the server/admin pass? I mean, if you have the pass, you can log in even if your're banned, right?
Posts: 481
Threads: 11
Joined: Jul 2010
nope it would log "player connected using admin pass in line x"
Posts: 108
Threads: 3
Joined: Jun 2010
(23 Dec 10, 12:26PM)JGAN Wrote: nope it would log "player connected using admin pass in line x"
exactly, also its my server so i know who has pass
Posts: 481
Threads: 11
Joined: Jul 2010
Posts: 2,841
Threads: 44
Joined: Jun 2010
(23 Dec 10, 01:32PM)JGAN Wrote: can i haz pass? ;D Make an app for the BC Servershare ;) (beyondcompare.org)
Posts: 2,387
Threads: 56
Joined: Aug 2010
On some server hosters (like Roxserver i think) you can give one or some IP's (or range i think) who will can be ban but who the server will auto-deban without specific message.
It's often do for server's owner.
So maybe , the banned had the same IP (or range) than the owner.
________________________________________________________________
I often saw TeH54 insulting some random players.
But he insults in french language , i really hate this.
I should have some screens if i search a little.
Posts: 1,162
Threads: 19
Joined: Jun 2010
(25 Dec 10, 01:22AM).ExodusS* Wrote: I often saw TeH54 insulting some random players.
But he insults in french language , i really hate this.
I should have some screens if i search a little.
88.163.251.84 // 12-21-2010 Teh54 - TKer
------------
His banned from my server.
Posts: 2,387
Threads: 56
Joined: Aug 2010
Ok , happy to learn that :)
Posts: 20
Threads: 0
Joined: Sep 2010
(25 Dec 10, 01:54AM)DES|OpenSource Wrote: (25 Dec 10, 01:22AM).ExodusS* Wrote: I often saw TeH54 insulting some random players.
But he insults in french language , i really hate this.
I should have some screens if i search a little.
88.163.251.84 // 12-21-2010 Teh54 - TKer
------------
His banned from my server.
ahhh yes I know this fool, was blacklisted in Exodus 1.0.4 for using many cheats and utter rudeness to others...
Posts: 146
Threads: 46
Joined: Nov 2010
(23 Dec 10, 10:11AM)Thrawn Wrote: Is it possible that this isn't as complicated as a hack? Maybe he just got ahold of the server/admin pass? I mean, if you have the pass, you can log in even if your're banned, right? no its not a hack, some servers has passwords that can let you in, for example: |FOX| Clan Server has a pass were you can come back after a ban, the pass is "happy". Some other servers have them to, you just gotta figure it out and be nerdy! =D
Posts: 999
Threads: 20
Joined: Jul 2010
(30 Dec 10, 08:25AM)fox_ares Wrote: (23 Dec 10, 10:11AM)Thrawn Wrote: Is it possible that this isn't as complicated as a hack? Maybe he just got ahold of the server/admin pass? I mean, if you have the pass, you can log in even if your're banned, right? no its not a hack, some servers has passwords that can let you in, for example: |FOX| Clan Server has a pass were you can come back after a ban, the pass is "happy". Some other servers have them to, you just gotta figure it out and be nerdy! =D
D: D: D: D: D: :D D: D: D: D: D:
Then basically anyone can hack on your servers, be banned, and get back?
Posts: 502
Threads: 20
Joined: Dec 2010
As said above: "nope it would log 'player connected using admin pass in line x'"
Posts: 56
Threads: 13
Joined: Jan 2011
05 Jan 11, 10:59PM
(This post was last modified: 05 Jan 11, 11:01PM by IBiteBack.)
I hear this can be bone by re-installing assault cube. I don't think there is any way to keep this from happening.
(11 Dec 10, 07:09PM)Blue_Pr!nt Wrote: Dec 11 03:34:45 [188.220.239.21] client BluePr!nt|BC| called a vote: ban player Teh54, reason: GTFO
Dec 11 03:34:45 [88.163.251.84] disconnecting client Teh54 (vote-banned from the server) cn 2, 28 seconds played, score saved
Dec 11 03:34:50 [88.163.251.84] client connected
Dec 11 03:34:50 [88.163.251.84] disconnecting client Teh54 (connection refused - you have been banned from this server) cn 2, 0 seconds played
Dec 11 03:34:52 [] >1$U<kaBOOM gibbed Miyagui
Dec 11 03:34:54 [] client connected
Dec 11 03:34:54 [] Ashley logged in (default), AC: 1104|840
Dec 11 03:34:55 [] +sCr3W+ParK0uR says: 'Go get 'em boys!'
Dec 11 03:34:58 [] +sCr3W+ParK0uR says: 'We did it!'
Dec 11 03:34:59 [] disconnected client Miyagui cn 4, 188 seconds played, score saved
Dec 11 03:35:00 [] ITCHI-BATI-SAN gibbed >1$U<kaBOOM
Dec 11 03:35:02 [] >1$U<kaBOOM says: 'ns'
Dec 11 03:35:03 [] +sCr3W+ParK0uR says: 'We did it!'
Dec 11 03:35:05 [88.163.251.84] client connected
Dec 11 03:35:05 [88.163.251.84] Teh54 logged in (default), AC: 1103|840
Dec 11 03:35:12 [88.163.251.84] Teh54 says: '?????????'
Dec 11 03:35:12 [] +sCr3W+ParK0uR gibbed >1$U<kaBOOM
Dec 11 03:35:18 [] >1$U<kaBOOM says: 'how he come backl'
Dec 11 03:35:22 [] +sCr3W+ says: 'hackkkk'
Teh54 used the same IP yet, was able to reconnect in less then a minute. he done this various times..
how is this possible with no IP change?
Posts: 3,780
Threads: 33
Joined: Jun 2010
Do you suppose he reinstalled AC in 15 seconds?
Posts: 1,436
Threads: 7
Joined: Jun 2010
Plus, that wouldn't help either.
Posts: 56
Threads: 13
Joined: Jan 2011
Posts: 166
Threads: 3
Joined: Oct 2010
07 Jan 11, 02:26PM
(This post was last modified: 07 Jan 11, 02:27PM by Darkbee.)
If the "hack" is simply to use another instance of AC then the portable version for Windows at PortableApps.com would be a perfect solution. You can "install" that as many times as you'd like to different folders. It's self-contained so it looks like a completely new instance from a programatic stand-point.
If you'd setup several instances beforehand you wouldn't even need 15 seconds, just launch a new instance and you're good to go. If that is the case then this is a serious flaw in AC, because you'd still be using the same IP address (as seen above). If this was done on purpose I can only assume it would be to allow for the possibility of a legitimate user being re-issued that same IP at some future point. It's pretty odd though and I can't imagine it's as simple as that.
Posts: 1,436
Threads: 7
Joined: Jun 2010
A questions to the devs: can valid_client() be spoofed?
Posts: 1,981
Threads: 63
Joined: Jun 2010
I don't think. Need confirmation ?
|
