Printable View
Hello,
In the last few days my server been hacked over 10 times..
When I enabled the CLSAFE Everyone get dc when they try log.
I guess its because the "100" after it.
The speed attack and all that stuff I understand that there is nothing to do only ban ip
but the hacks I had today its kind of GM hacks.
when I try to log when my ip is not in hotuk I get DC then how the hackers do it?
what can I do?
I really need your help guys, Thanks!
This is wrong, because of the way you word it.
Nobody can log as GM, unless you list them as GM.
If they do something wrong, you take them out of hotuk and deny GM privileges.
How do you know which GM? Check LogAdmin\(Admin)[date].logI can't spawn monsters in Ric with GM level 3... this was me testing it.Code:16:18:10 - ID( bobsobol ) Name( John ) IP( 192.168.1.66 ) AdminLv( 4 )> /@get wa101
16:19:23 - ID( bobsobol ) Name( John ) IP( 192.168.1.66 ) AdminLv( 4 )> /monster "Bargon" 3
16:19:32 - ID( bobsobol ) Name( John ) IP( 192.168.1.66 ) AdminLv( 4 )> /monster "Hoppy" 1
16:21:53 - ID( bobsobol ) Name( John ) IP( 192.168.1.66 ) AdminLv( 4 )> /monster "Hopy" 5
16:22:42 - ID( bobsobol ) Name( John ) IP( 192.168.1.66 ) AdminLv( 4 )> /monster "Hopy" 15
If the events you experience don't show in the log (and you ARE *REC_ADMIN_CMD) then it isn't GM commands, and IS a hack, the kind there is nothing you can do about except BAN IPs.
The same way they hack attack speed, power, gold, defence, XP, teleport, fly-hack, speed-hack etc... totally unrelated to GM.Quote:
Originally Posted by tnrh1
14:55:34 - ID( ockap ) Name( OckaP ) IP( 78.84.233.161 ) AdminLv( 1 )> /monster Sweety
this guy is not a staff member and not apear in hotuk= hacker.
explain me
Well, at least you have his IP (he is from Latva or probably using a proxy because I never heard of this country lol)
Lol but moon, I cant go sleep! i wake up and people tell me you had a hacker in the night he did events exp events droped items mature things..
i ban him in the morning but another one coming after him I cant be on the computer for 24/7 i need to sleep somtimes..and i am sure you dont haave this error maybe you can share you knowledge with me its so imporatnt to me guys. really.
Thanks very much!
[ame=http://en.wikipedia.org/wiki/Latvia]Latvia[/ame] a nation in the north of the continent of Europe bordering between East and Western Europe, East of Sweden, and North of Russia.
Retake your Geography Moons. XDSo you could ban 78.84.128.1 - 78.84.255.255 and get everyone on LTC-HOME in his/her region of Latvia... or send an abuse mail to Janis.Jansons@lattelekom.lv and inform them of the evil actions of one of their IPs. (we only rent them from our ISP)Code:% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '78.84.128.1 - 78.84.255.255'
inetnum: 78.84.128.1 - 78.84.255.255
netname: LTC-HOME
descr: Address pool for LTC-HOME customers
country: LV
admin-c: ET555-RIPE
tech-c: JJ777-RIPE
status: ASSIGNED PA
mnt-by: LTK
mnt-lower: LTK
mnt-routes: LTK
source: RIPE # Filtered
person: Edgars Tone
address: SIA "Lattelekom"
address: 9. Citadeles Str.
address: Riga,LV-1010
address: LATVIA
mnt-by: LTK
phone: +371 7325227
e-mail: Ansis.Ailis@lattelecom.lv
nic-hdl: ET555-RIPE
source: RIPE # Filtered
person: Janis Jansons
address: SIA "Lattelekom"
address: 9. Citadeles Str.
address: Riga,LV-1002
mnt-by: LTK
phone: +371 9420819
e-mail: Janis.Jansons@lattelekom.lv
nic-hdl: JJ777-RIPE
source: RIPE # Filtered
% Information related to '78.84.0.0/16AS12578'
route: 78.84.0.0/16
descr: LATTELEKOM
origin: AS12578
mnt-by: LTK
source: RIPE # Filtered
But since the late 90s ISPs can't be arsed to do much.
Actually, back to your original postThat's really good compared to most of the PT servers I've worked with... usually they are banning 4 - 12 IPs, Ranges and user accounts a day when not under mass attack. Typical figures are around 3 - 6 a week from logs, 2 a day from GMs and the rest caught by automatic sweeps.Quote:
In the last few days my server been hacked over 10 times.
That's the thing you need to figure out... how to get banning to happen automatically without you being there all the time.
Each server I know of does it differently, mostly because what shows up in logs that one considers to be a hack is what another considers normal VIP / Donator usage, not to mention the XP alerts if you shrink the XP:level table.
They are probably using a "hotuk.ini" in their client folder, and your server is not auto-kicking players that attempt to log in with a hotuk.ini, either rename the hotuk.ini to something else (by that means hex it both server side and client side), or just enable it so that it auto-kicks players that aren't in your gm list that use a hotuk.ini (that I don't remember how to do).
Yea, it's something you usually do when you start your server, and then forget about... he should have it set though, as it kicks him if he takes his IP out of the server hotuk.
lol, like i said when i take off my ip from hotuk i get dc but seems that they dont get!
rename it can be a solution but that would take time..release another patch so there is no another solution?ty guys.
---------- Post added at 12:49 AM ---------- Previous post was at 12:49 AM ----------
lol, like i said when i take off my ip from hotuk i get dc but seems that they dont get!
rename it can be a solution but that would take time..release another patch so there is no another solution?ty guys.
That "rename hotuk" idea will only work if you cannot connect to your server via another client... try connecting with QF1873 after modifying the IP at the end of the file... if that works, any modification you make to your exe is pointless. :wink:
I have done that for my own server our client side uses a different .ini other than hotuk, and our server sided hotuk.ini is a different name as well. They are both working, it's not hard you just gotta rename it with a Hex editor.
I'm not saying it's hard, just that there is not point if you let players connect with any old client... how hard it is to distribute a new client depends on how automated your update system is... and so long as you don't stop players connecting with the old client they aren't going to bother getting the update anyway.
Especially the hackers you are trying to stop. XD
That's why you use the "Checksum protection" to only allow the game.exe you want to be able to connect to your server. That's obvious, I mean if nobody used that anyone could just used a hacked game.exe to connect to your server which would be pointless. When I do client updates on my server, I remove the old checksum and add the new one from the new game.exe which requires them to use the new game.exe or they get auto-kicked as soon as they log in the server.
Exactly... And have you ever seen a client resolve to the the checksum "100"?
What I can't find any more is how you locate the correct checksum for your current client. I've read it here somewhere, but my search skillz are letting me down now too. :(: I sux. :'(
As soon as you release it you log in with an account that's not in your hotuk.ini and you will be auto dc'd automatically then you search on the day-month.log the account you logged in at you should get a line with the checksum error and the number. Then you add that number to your hotuk and make it kick all players that don't have that checksum.
Thanks Air Bourne. That works nice, and would stop people from getting automatic level 1. Don't know if it helps against the cross server exploit though, it should due to diff server hotuk though.
####NOTE: MY SUGGESTIONS ARE FOR BOTH CROSS-SERVER LINKING AND FOR HOTUK MISUSE.####
There are several things you can do in this situation. Firstly, if the person doing the cross-exploiting is a novice, then change the port of your server. This would require the attacker to do some work, which they may or may not want to bother doing.
Secondly, you can try CHANGING the commands so that even if they do manage to get on your server with the hotuk working, they will be UNABLE to use any valid commands (for the most part). This means that only your staff members will know the commands (and it will require re-memorizing them). You could simply alter the prefix even.
Another option is using the program I released called PT PROTECTOR. You can have it trigger a ban on any staff member who does not have your IP address or the IP address of a different staff member. This works only if you have static IP addresses that do not change. Alternatively, you could have it ban every username that uses an admin command that is NOT one of your staff members. This is less effective though because with cross-server connecting you can use any name you want. Simply have PT protector watch the admin logs and add admin commands to the "error log" catcher in PT Protector (even though this isn't an error). Making it very general helps, i.e. have it ban any weird IP or name that causes the word "AdminLv" to show up. One problem with this though is that it only bans accounts and not IPs (didn't get around to implementing that one yet), but the source code is designed so that you can EASILY implement banning IP addresses via "BlackUser". In fact, 99% of the code to do it I've already written within the program. You'd use the function I labeled "SaveFileFromTB" and integrate it into the procedure I some reason labeled as "porky". This area is commented a bit so that it's easy to tell what each line does. You could add the code after the "If Check4.Value = 1 Then: Beep" piece so that IP exceptions and username exceptions are dealt with first and the IP itself is already parsed using the variable "IP" so...yeah...Pretty easy.
Also, a correctly configured server Hotuk is suppose to help prevent cross-server connecting. Specify ALL IP addresses using all the functions you can. It's been awhile since I've dabbled in this stuff so I don't remember the specific functions to ensure are being used, but here are some--
Note: I do not recall the flags for all of these commands. Assume that some of them do NOT require any flags, or that some require more than one.Code:*DEBUG_ID 127.0.0.1
*DEBUG_IP 127.0.0.1
*ADMIN_IP 127.0.0.1
*ADMINISTRATOR_IP 127.0.0.1
*GAME_SERVER Name ip ip ip
*SERVER_LINK_IP
*AREA_SERVER ip
*TT_DATA_SERVER ip
*LOGIN_SERVER_IP
*SYSTEM_IP
*CL_PROTECT
*DISCONNECT_CLSAFE_CODE
*LAN_SERVER ip
*CONNECT_SERVER ip
Obviously a lot of those aren't needed. Specify as much as you can in your hotuk.
Removing the hotuk from the game.exe's released is also easy. You can null it out through a hex editor (ctrl+f "hotuk", 00's) or even rename it. This doesn't prevent someone from using a different exe (or even an older one of yours) so a CRC check would be recommended.
ALSO, Quantumfusion made a program to help prevent cross-server linking. A trial version was floating around, but it was CRACKED. You can find it on the net. How does it work -- is something you may be wondering. Well, it simply connects to your SQL database and checks one of the tables (I honestly do not remember which one, it's been so long...) and then blocks the IP using a firewall OCX or DLL (included, don't remember which it was). The program was called Excalibur and there was an alternate one by him called Ultimate Defense (or something like that). I don't support stealing these, but as I said...they are on the net.
YET another option, which would require lengthy programming, would be to make a local proxy for your server so that it can inspect everything easily. This CAN be done with a packet sniffer (the inspecting part), but then your left without the ability to manipulate the packets to their fullest extent (doing so without a local proxy is a BITCH!). You can watch all commands this way -- so woot. Simply say "no" to bad IP's or usernames that try to use admin commands.
ANOTHER method, though this one is aimed at server linking (and people using other clients to connect to your server), would be to change the encryption of your client. I've never done this before, but Shagpub certainly has (making PTV connect to KPT). I believe RPT did it and so did UPT.
Anyway, my post has official reached the size of one of bobsobol's posts :P: So that's enough out of me!
Awesome. This should go into a tutorial.
I have connected the current PTV client to KPT ET 2.2. I wouldn't call it encryption... but I can guide that too... don't know if that wouldn't make it too easy for hackers though. What do the regulars say?
Sooner or later my Mod-PT server will have that externalised in a DLL so you can add a real encryption to your servers, right now I just have DLLs for EPT, jPT, KPT & PTV... and some are more successful than others.
That sounds like it'd be an awesome guide. It may sacrifice some security, but overall it would be beneficial for when working with other clients and having them connect elsewhere. I'll probably move this thread when it becomes inactive and direct it to the tutorials area.
External DLL's would be great. Looking forward to it!
WOW how much i missed while i was sleeping,
1. i am happy to notice that i didnt got hacked in the night
2. i am going to secure my pt when i get back from school
good job guys really thanks, ill update you how its going.