Exploit

piquepique Join Date: 2002-11-21 Member: 9541Members
edited November 2003 in General Server Discussion
To all server admins. There is an exploit out there that allows a user to download any file off of the server...including server.cfg and any users.ini file you have. There are several ways to fix this:

1. sv_allowdownload 0 This is the perfect fix except that clients cant download custom maps or sounds. unfortunate but a lot better than having your rcon stolen.

2. Dont set an rcon password, make sure you use only WONIDS in the users.ini (this should ALWAYS be done) and use amx or adminmod to do rcon commands. This works except for the fact that exploiters can still crash the server by requesting large files.

3. change your default config to a cfg other than server.cfg...im not sure of the exact command to do this but you can make for example onosdiehaha.cfg to be your default server config. If exploiters dont know what file to download...they cant download it. again, as in #2, exploiters can still crash the server.


Choose what you want to do, i suggest #1, but...its not my call

o and please dont pm me or anything...im not telling anyone the exploit...except maybe flayra...but im sure he knows about it.
Off Topic Disagree Agree Awesome

Comments

  • FlippyGcFlippyGc Join Date: 2003-02-09 Member: 13325Members
    1) Its for Stam Servers only I Believe.
    2) They already released a server side patch the next day when it was discovered so the exploit is no more.

    Please do research before posting.
    Off Topic Disagree Agree Awesome
  • sawcesawce Join Date: 2002-12-14 Member: 10787Members
    To my knowledge, WON servers are just as vulnerable as Steam servers are. Also, the only patch I know of is for Steam. I've not yet seen a patch for WON servers (which the majority of 2.01 servers are).

    Also, why so harsh? He's being nice informing people of this. Yes, there was a post about this already, but it's since been buried in other threads. The guy obviously just registered here to inform people about it (his post count indicates this, at least). I think he deserves a little respect.
    Off Topic Disagree Agree Awesome
  • piquepique Join Date: 2002-11-21 Member: 9541Members
    edited November 2003
    <!--QuoteBegin--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->1) Its for Stam Servers only I Believe.
    2) They already released a server side patch the next day when it was discovered so the exploit is no more.

    Please do research before posting. <!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd-->

    please do YOUR research before posting. Its not only steam, TRUST ME on that. The exploit still exsits and VERY few servers are secure.


    and if there was a post on this already...admins obviously didn't get the picture or ddin't check it. Ive seen maybe 4 ns servers out of 50 that have it fixed
    Off Topic Disagree Agree Awesome
  • HypergripHypergrip Suspect Germany Join Date: 2002-11-23 Member: 9689Members, NS1 Playtester, Contributor
    old news
    Off Topic Disagree Agree Awesome
  • piquepique Join Date: 2002-11-21 Member: 9541Members
    thats what everyone keeps telling me...well then if its so old why can i get rcon to so many servers still?
    Off Topic Disagree Agree Awesome
  • SariselSarisel .::&#39; ( O ) &#39;;:-. .-.:;&#39; ( O ) &#39;::. Join Date: 2003-07-30 Member: 18557Members, Constellation
    edited November 2003
    because not enough people spend their time looking for rcon passwords of servers - if there were more people causing damage and annoying server admins by stealing rcon, then a more rigorous approach would be taken

    which is pretty much what you have accomplished by stealing the rcon from my clan's server
    Off Topic Disagree Agree Awesome
Sign In or Register to comment.