search

RaphielGang / Telegram-Paperplane

The Paperplane userbot project - a Telegram userbot helping to improve your Telegram experience. https://t.me/tgpaperplane
Other
289 stars 1.06k forks source link

Backdoor #199

Closed KitsuneLover69 closed 5 years ago

KitsuneLover69 commented 5 years ago

https://github.com/RaphielGang/Telegram-UserBot/blob/master/userbot/modules/admin.py#L107

https://raw.githubusercontent.com/RaphielGang/databasescape/master/learning-data-root.check

Seriously?

KitsuneLover69 commented 5 years ago

lol, marked as invalid, but the code opens the SQLite database which contains a bunch of UserIDs that enables them to do commands and prevent from being kicked or acted against

KitsuneLover69 commented 5 years ago

well played

baalajimaestro commented 5 years ago

Indeed it does. What's a backdoor here?

KitsuneLover69 commented 5 years ago

which the user probably wont want, and it downloads it on every start so a user can't even get rid of it

KitsuneLover69 commented 5 years ago

this enables privileged execution by specific users, that's the definition of a backdoor

baalajimaestro commented 5 years ago

@KitsuneLover69 As long as the user knows some python, he can get rid of the whole thing if he wants. The code isn't obfuscated, it's all opensource

KitsuneLover69 commented 5 years ago

why does something like this exist tho, if the backdoor users get compromised this could cause some damage

KitsuneLover69 commented 5 years ago

and the fact that this exist at all makes it weird

raphielscape commented 5 years ago

It's used for superuser reasons, also the brain checkers are contributors and devscapes staffs, this issue is invalid due to it's not a backdoor and it's an intended behavior on Paperplane for several reasons.