He uses Comet, that's why. Which is a Java emulator that was previously leaked by "Johno". If you don't trust his mirror website then don't own a hotel or download from there, simples. Johno owns xHosts.uk, so you say you can't trust him?! When he gets peoples logins and 1000's of requests per day and real money flowing around sooo yeah. Johno is 110% Trustworthy.
I'm not sure but...
I find it odd that every time you make a database query, you connect to the database. Wouldn't this cause huge latency issues since every query will need to open a connection to the database? I don't also see where you ever disconnect from the database. Wouldn't you essentially flood the database by never closing the connections? Why isn't there a database manager which instantiates one connection to the database? I see this in every emulator out there. I remember a time at work when somebody did the exact same thing and I ended up fixing it by just instantiating it just once. The queries ended up being 300% faster at the end.
I have a problem, the ads_background don't work. I put the link in & he don't save the link in memory. Any idea of my problem ? Thank youPlusEmu Build Version: PRODUCTION-201601012205-226667486
ads_background is 100% work and saved
is from retroripper.com
check your Database
You must be registered to see links
Don't belive that you can login to all users without a password because of the limit 1 but its true that you can login to accounts some accounts because the set of the auth_ticket after login.Warning!
There is a way to log in on all accounts without password, also there's a way to flood unlimited times in a room. This all is possible with Tanji.
Goodluck with fixing/find out how.
public class SSOTicketEvent : IPacketEvent
{
public void Parse(GameClient Session, ClientPacket Packet)
{
string ticket;
if (Session?.RC4Client == null || Session.GetHabbo() != null || string.IsNullOrEmpty((ticket = Packet.PopString())))
return;
Session.TryAuthenticate(ticket);
}
}Nice, but still easy to bypass. I recommend to create a check which check if the connection IP and user IP are the same if not destroy/disconnect the connection.Don't belive that you can login to all users without a password because of the limit 1 but its true that you can login to accounts some accounts because the set of the auth_ticket after login.
You can fix that simply by replacing the SSOTICKET EVENT:
I don't see anything special by the mute time so I doubt the legitime of this post (It could also be clientside so it looked like he bypassed the flood times)Code:public class SSOTicketEvent : IPacketEvent { public void Parse(GameClient Session, ClientPacket Packet) { string ticket; if (Session?.RC4Client == null || Session.GetHabbo() != null || string.IsNullOrEmpty((ticket = Packet.PopString()))) return; Session.TryAuthenticate(ticket); } }
If your hotel got hacked with this method and you are sure of that just pm me then we look togheter I like mysteries
dbClient.RunQuery("UPDATE `users` SET `online` = '1', `auth_ticket` = '' WHERE `id` = '" + UserId + "' LIMIT 1");
No not really because it is a "bot" protection because it is empty they need to do a new request to get the auth ticket and if you have cloudflare with a browser check is that much harder to do.
public static UserData GetUserData(string SessionTicket, out byte errorCode)dbClient.SetQuery("SELECT `id`,`username`,`rank`,`motto`,`look`,`gender`,`last_online`,`credits`,`activity_points`,`home_room`,`block_newfriends`,`hide_online`,`hide_inroom`,`vip`,`account_created`,`vip_points`,`machine_id`,`volume`,`chat_preference`,`focus_preference`, `pets_muted`,`bots_muted`,`advertising_report_blocked`,`last_change`,`gotw_points`,`ignore_invites`,`time_muted`,`allow_gifts`,`friend_bar_state`,`disable_forced_effects`,`allow_mimic`,`rank_vip` FROM `users` WHERE `auth_ticket` = @sso LIMIT 1");dbClient.SetQuery(
"SELECT users.id,users.username,users.rank,users.motto,users.look,users.gender,users.last_online,users.credits,users.activity_points,users.home_room,users.block_newfriends,users.hide_online,users.hide_inroom,users.vip,users.account_created,users.vip_points,users.machine_id,users.volume,users.chat_preference,users.focus_preference,users.pets_muted,users.bots_muted,users.advertising_report_blocked,users.last_change,users.gotw_points,users.ignore_invites,users.time_muted,users.allow_gifts,users.friend_bar_state,users.disable_forced_effects,users.allow_mimic,users.rank_vip " +
"FROM users " +
"JOIN user_auth_ticket " +
"ON users.id = user_auth_ticket.user_id " +
"WHERE user_auth_ticket.auth_ticket = @sso " +
"LIMIT 1"
);dbClient.RunQuery("UPDATE `users` SET `online` = '1', `auth_ticket` = '' WHERE `id` = '" + UserId + "' LIMIT 1");dbClient.RunQuery("UPDATE `users` SET `online` = '1' WHERE `id` = '" + UserId + "' LIMIT 1");
dbClient.RunQuery("DELETE FROM `user_auth_ticket` WHERE `user_id` = '" + UserId + "' LIMIT 1");public static void PerformShutDown()dbClient.RunQuery("UPDATE `users` SET online = '0', `auth_ticket` = NULL");dbClient.RunQuery("TRUNCATE `user_auth_ticket`");
dbClient.RunQuery("UPDATE `users` SET online = '0'");-- ----------------------------
-- Table structure for `user_auth_ticket`
-- ----------------------------
DROP TABLE IF EXISTS `user_auth_ticket`;
CREATE TABLE `user_auth_ticket` (
`user_id` int(11) NOT NULL,
`auth_ticket` varchar(60) NOT NULL,
PRIMARY KEY (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;final public function createSSO($k)
{
global $engine;
$sessionKey = 'RevCMS-' . rand(9, 9999999).'/'.substr(sha1(time()).'/'.rand(9,9999999).'/'.rand(9,9999999).'/'.rand(9,9999999),0,33);
if($engine->num_rows("SELECT * FROM user_auth_ticket WHERE user_id = '" . $k . "' LIMIT 1") > 0) {
$engine->query("UPDATE user_auth_ticket SET auth_ticket = '" . $sessionKey . "' WHERE user_id = '" . $k . "'");
} else {
$engine->query("INSERT INTO user_auth_ticket (user_id, auth_ticket) VALUES ('" . $k . "', '" . $sessionKey ."')");
}
return $sessionKey;
unset($sessionKey);
}$users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);
$template->setParams('sso', $users->createSSO($_SESSION['user']['id']));
For a better more secure Authenticate you can leave the contents in "SSOTicketEvent.cs" as they are (the check for the empty string wont be needed, but you can keep it if you choose to).
In UserDataFactory.cs look for the function:
Code:public static UserData GetUserData(string SessionTicket, out byte errorCode)
Change the first query:
Code:dbClient.SetQuery("SELECT `id`,`username`,`rank`,`motto`,`look`,`gender`,`last_online`,`credits`,`activity_points`,`home_room`,`block_newfriends`,`hide_online`,`hide_inroom`,`vip`,`account_created`,`vip_points`,`machine_id`,`volume`,`chat_preference`,`focus_preference`, `pets_muted`,`bots_muted`,`advertising_report_blocked`,`last_change`,`gotw_points`,`ignore_invites`,`time_muted`,`allow_gifts`,`friend_bar_state`,`disable_forced_effects`,`allow_mimic`,`rank_vip` FROM `users` WHERE `auth_ticket` = @sso LIMIT 1");
To this:
Code:dbClient.SetQuery( "SELECT users.id,users.username,users.rank,users.motto,users.look,users.gender,users.last_online,users.credits,users.activity_points,users.home_room,users.block_newfriends,users.hide_online,users.hide_inroom,users.vip,users.account_created,users.vip_points,users.machine_id,users.volume,users.chat_preference,users.focus_preference,users.pets_muted,users.bots_muted,users.advertising_report_blocked,users.last_change,users.gotw_points,users.ignore_invites,users.time_muted,users.allow_gifts,users.friend_bar_state,users.disable_forced_effects,users.allow_mimic,users.rank_vip " + "FROM users " + "JOIN user_auth_ticket " + "ON users.id = user_auth_ticket.user_id " + "WHERE user_auth_ticket.auth_ticket = @sso " + "LIMIT 1" );
Then further down look for:
Code:dbClient.RunQuery("UPDATE `users` SET `online` = '1', `auth_ticket` = '' WHERE `id` = '" + UserId + "' LIMIT 1");
and change it to:
Code:dbClient.RunQuery("UPDATE `users` SET `online` = '1' WHERE `id` = '" + UserId + "' LIMIT 1"); dbClient.RunQuery("DELETE FROM `user_auth_ticket` WHERE `user_id` = '" + UserId + "' LIMIT 1");
Inside PlusEnviroment.cs look for this function:
Code:public static void PerformShutDown()
Change:
Code:dbClient.RunQuery("UPDATE `users` SET online = '0', `auth_ticket` = NULL");
To:
Code:dbClient.RunQuery("TRUNCATE `user_auth_ticket`"); dbClient.RunQuery("UPDATE `users` SET online = '0'");
Finally run this database query:
Code:-- ---------------------------- -- Table structure for `user_auth_ticket` -- ---------------------------- DROP TABLE IF EXISTS `user_auth_ticket`; CREATE TABLE `user_auth_ticket` ( `user_id` int(11) NOT NULL, `auth_ticket` varchar(60) NOT NULL, PRIMARY KEY (`user_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
This way you'll only be creating a session ticket when the user connects to the hotel and removing it straight after (not setting the ticket to null or empty), thus making it impossible to "randomly" sign in onto other users accounts, unless you manually set the ticket ofc
All you need to do is change how your SSO tickets get created to insert them into that table and you're good to go.
Hopefully this helped.
