search

shanapu / MyJailbreak

A rewrite of Franugs Special Jailbreak and merge of eccas, ESK0s & zipcores Jailbreak Warden
https://forums.alliedmods.net/showthread.php?t=283212
GNU General Public License v3.0
51 stars 36 forks source link

Crash exploit when warden fix #376

Open azalty opened 3 years ago

azalty commented 3 years ago

Fixes #371

Basically, it calls the OnClientDisconnected event for the Handcuffs module BEFORE triggering the event where the warden is removed, and it sets the new global bool g_bClientIsDisconnecting to true for the client. When this bool is set to true, it will NOT strip the taser from the player.

This should fix this exploit:

  1. Become warden
  2. Make youself kicked from the server by sending too much commands with the built-in server kick, for example by spamming "sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w" (it works with every command that is from sourcemod, or some others that the server needs to reply to)
  3. It will call a function to say that the warden was removed, calling StripZeus() on him. In normal conditions, it should fail because of IsValidClient(). The thing is OnClientDisconnect is called BEFORE the client is fully disconnected, so he still passes the check.
  4. StripZeus() forces the client to send a client command (with FakeClientCommand()), making him kicked once again because of spamming. This is weird because it doesn't occur on a local server, the client is only kicked once. On a server that is not in LAN, it seems the client is kicked multiple times because of that.
  5. client is kicked -> calls OnClientDisconnect again -> infinite loop -> crash

Not tested yet. It might be needed to apply this fix for the deputy too. Since I don't use it on my server, I can't know. If this exploit still exists with the deputy, please comment here or post a new issue with crash logs.

azalty commented 3 years ago

Tested and working as far as I can tell. I wasn't able to crash my server.