search

citizenfx / fivem

The source code for the Cfx.re modification frameworks, such as FiveM, RedM and LibertyM, as well as FXServer.
https://cfx.re/
3.48k stars 2.06k forks source link

! Exploit crashing players on every server #1356

Closed adversaru closed 2 years ago

adversaru commented 2 years ago

Hi, we have a problem. A new "exploit" has appeared, if it can be called that, a simple execution of the PlaySound function crashes certain players in range of the one executing the command ( using executors ) On one server 5 crashed, on another even 130 crashed at once.

Warning: I leave here the code in order to receive solutions.

for i=1, 100 do
           PlaySound(-1, 'Checkpoint_Hit', 'GTAO_FM_Events_Soundset', true)
           PlaySound(-1, 'Boss_Blipped', 'GTAO_Magnate_Hunt_Boss_SoundSet', true)
           PlaySound(-1, 'All', 'SHORT_PLAYER_SWITCH_SOUND_SET', true)
end
blattersturm commented 2 years ago

Do you have any reproduction steps other than this code? Where to place this code for a test, any crash details, anything?

adversaru commented 2 years ago

Do you have any reproduction steps other than this code? Where to place this code for a test, any crash details, anything?

You can use an executor to run that code from client-side, i tested it using a cheat that have this feature. The crash happens instantly as the code is executed, game closes without giving any error.

blattersturm commented 2 years ago

What is 'an executor' and where to find such? Again, providing more info would help. :/

Other than that, it's unlikely you're going to see this issue resolved if you don't provide info.

adversaru commented 2 years ago

What is 'an executor' and where to find such? Again, providing more info would help. :/

Other than that, it's unlikely you're going to see this issue resolved if you don't provide info.

I have used Eulen. image

blattersturm commented 2 years ago

Do you have a link to this 'Eulen' program at all? Or any other repro method?

adversaru commented 2 years ago

Do you have a link to this 'Eulen' program at all? Or any other repro method?

Eulen is a paid-cheat, atm i don't really know a free executor. There's a bunch of it but they are all paid-soft.

blattersturm commented 2 years ago

Do you have a link or a contact method for the author so they can provide more info?

FlavioMoretti commented 2 years ago

I think that if you put the snippet just in a regular client.lua script (without cheating) your game would also crash?

FlavioMoretti commented 2 years ago

The only thing you should do is make it some way that it is only executed by one player (to immitate a cheat menu, to check if the other players that arent executing the code are also crashing.

adversaru commented 2 years ago

Do you have a link or a contact method for the author so they can provide more info?

No, several people have joined my server and crashed players. My Anticheat took screenshots of them, I saw the Lua menu they were using, got hold of it and identified the code they were using to crash players. The code i sent here.

FlavioMoretti commented 2 years ago

Do you have a link or a contact method for the author so they can provide more info?

I also think that a cheat provider whose goal is to irritate people on fivem, won't give any info about making the cheat menu less irritating.

Nexxed commented 2 years ago

Do you have a link or a contact method for the author so they can provide more info?

No, several people have joined my server and crashed players. My Anticheat took screenshots of them, I saw the Lua menu they were using, got hold of it and identified the code they were using to crash players. The code i sent here.

Have you verified and confirmed that the code is the culprit by testing it by yourself with some participants?

adversaru commented 2 years ago

Yes. I have tested it with my staff-team, they are all crashing the way i said, without any error.

Nexxed commented 2 years ago

Can you send a screenshot of the crash dialog that's presented to them? Any information about the crash is helpful, and so far you haven't provided anything other than the snippet of code that's supposedly causing the crash.

blattersturm commented 2 years ago

Locking this issue report for now, too many people trying to involve themselves here.

blattersturm commented 2 years ago

To people trying to make new issue reports about this: don't. You're not helping by doing such.

This is already tracked internally as of ~20 days ago, but it didn't get picked up for some reason. I'm also unable to pick this up myself at this time, so instead internal parties have been reminded again.