Solution against Crash

[PwrDex]

Yo guys!

I got the final solution, this topic contains enough help to solve that anyone can afford! For my part, this topic can be closed. Since this approach can open new doors for further attacks, so will not be sharing!

Restored Hints:

Spoiler

today i have started a researching:
process command: 10

this doing a crash...

i will catch now the incoming packets..

IDA installed and now isntalling visual c# 2008 for Minerva's Packet Logger

***I hear something about a config files.. Only need modify something in config files... Tomorrow morning i begin the analyze and capture the packets...

 

[y0cata]

"SYS_MAINCMDEXTD = 10" check EP3 source u can get a lot info for registered packets and procedures.

 

[PX2000]

The best solution of the crash is to make a proxy to filter the command being received by the open ports cabal services. Because I tried, even a packet that needs to be used on bin <-> bin communication can be send via internet.

A proxy that decrypt the receive packets send by clients, scan the decrypted packets for bin2bin command flag, if found 1 then drop if not then encrypt the packet again then send to bin..

or a proxy that check if the packet send by the client is crypted or not.. most crashers send the packets not encrypted..

I tried wireshard to scan traffic to my login server using a client but I cannot see any cabal packet structure in wireshark but when I send a packet to my loginserver with a cabal packet structure using autoit TCPSend it is recognized by loginserver.

any idea?

 

[Komachi]

Likely that this is a buffer overflow attack, an attack in the Buff Overflow will be very difficult to contain these attacks in our case because we do not have the source code of the server binaries to change the allocation of bytes of packets.

The attacker flood a buffer in the channel port of the server and the server can not decrypt the buffer due to the extensive size, and causes disruption of the server connection and locking "Crasher".

 

[estsoft]

or a proxy that check if the packet send by the client is crypted or not.. most crashers send the packets not encrypted..

You don't need to make a proxy to do that. You are all making things far more complicated than they need to be.

Likely that this is a buffer overflow attack, an attack in the Buff Overflow will be very difficult to contain these attacks in our case because we do not have the source code of the server binaries to change the allocation of bytes of packets.

The attacker flood a buffer in the channel port of the server and the server can not decrypt the buffer due to the extensive size, and causes disruption of the server connection and locking "Crasher".

That is incorrect.

 

[y0cata]

You don't need to make a proxy to do that. You are all making things far more
complicated than they need to be.

That is incorrect.

* SYS : SystemCommand
* CSC : ClientServerCommunication
* REQ : ClientRequest
* NFY : ServerNotify
* IPC : InterProcessCommunication
* ITC : InterThreadCommunication
* RES : RequestStructure
* NFS : NotifyStructure
* IPS : InterProcessStructure
* ITS : InterThreadStructure
* C2S : Client To Server
* S2C : Server To Client
* W2D : WorldSvr To DBAgent
* D2W : DBAgent To WorldSvr

only 4-5 of those packets must be open for the internet (for client comunication) other are used only for bin<->bin connection but if they are open for the internet ppl can send them and execute commands that normally only the bins must execute.

The attacker can change loginsvr version and magic key. Normally the DBAgent send the packet with version and magic key to the loginsvr but because the packet is open for the internet the attacker sends it and he refresh/change the version and magic key.


so a proxy or some type of firewall will be the right thing to do.

 

[Komachi]

It would be smart of the attacker do this in official server, to fully capture passwords and have access to the server where they are the most updated files from Cabal. Doing this with server private server even with competitors will only bring further problems for him because if he is the only server that remains among all it will end up being sued by advocates of ESTsoft corporation, would be more advantage to him to help all the to be selfish and hurt everyone to take advantage.

 

[PunkS7yle]

It would be smart of the attacker do this in official server, to fully capture passwords and have access to the server where they are the most updated files from Cabal. Doing this with server private server even with competitors will only bring further problems for him because if he is the only server that remains among all it will end up being sued by advocates of ESTsoft corporation, would be more advantage to him to help all the to be selfish and hurt everyone to take advantage.

Official patched it because me and OmegaArma crashed it for months.

 

[estsoft]

Official patched it because OmegaArma and I crashed it for months.

fixed

 

[MentaL]

a little birdy told me that estsoft (Yamachi) aka Michael Kelly released a nice tool publicly to crash all Cabal servers except his own at forge-dev.com.

 

[estsoft]

That little birdy is wrong. You should look more carefully at where your information comes from.

FYI, the release on epvp was not me, either. It's simply someone using the same name. Go request the connection info yourself. Oh, and forge-dev isn't a public forum, so you're wrong on that aspect, too. There are no crashing tools there, either.

Your reaction doesn't surprise me, though. You seem to have a nasty habit of jumping to conclusions very quickly with very little to back it up.

EDIT: I also don't run a server. Another thing you got wrong.

 

[PunkS7yle]

a little birdy told me that estsoft (Yamachi) aka Michael Kelly released a nice tool publicly to crash all Cabal servers except his own at forge-dev.com.

Unless I'm blind I don't see any. Maybe your bird's full of **** ?

fixed

Fk u I type what I want.

 

[Caspere]

If Yamachi was not here long ago this are on this pitty forum would not exist so show some respect.

 

[PwrDex]

I do not care who is doing all of this but we need to find the solution ...
Anyone who lives in this childish desires to know its just congratulate. In other sections, see MU Online, could work against a similar problem together.

 

[cadena]

a little birdy told me that estsoft (Yamachi) aka Michael Kelly released a nice tool publicly to crash all Cabal servers except his own at forge-dev.com.

Instead of establishing an accusation without proofs and a subsequent fight, why don't you designate a new moderator of this section that is full of conflicts?

 

[PunkS7yle]

Instead of establishing an accusation without proofs and a subsequent fight, why don't you designate a new moderator of this section that is full of conflicts?

cuz they don't give no shits hue hue

 

[PX2000]

a little birdy told me that estsoft (Yamachi) aka Michael Kelly released a nice tool publicly to crash all Cabal servers except his own at forge-dev.com.

Any mod can give this guy a infraction, he is posting a wrong info on a wrong thread..

Hehehe peace MentaL

 

[jaguar666]

MentaL said "a little birdy told me that estsoft (Yamachi) aka Michael Kelly released a nice tool publicly"

estsoft replied "FYI, the release on epvp was not me, either. It's simply someone using the same name"

in short estsoft affirming that he is Yamachi

 

[Kome Keto]

@jaguar666, @estsoft and another guy here in forum ( the one with 3dS conversion script ) are @Yamachi, but not the one on ellitepvpers, since Yamachi is not banned there he is using his account, so he didnt share anything, only his 3ds script to help you guys adding new stuff to game...

 

[jaguar666]

estsoft here is not the one on ellitepvpers, since Yamachi is not banned there he is using his account, so he didnt share anything, only his 3ds script to help you guys adding new stuff to game...

I agree with that but what i'm tellin is estsoft here in rz is Yamachi.

Welcome back Yamachi!!!