Luigi Auriemma

Hi, I host a 1.00 server and a kid seems to aquire my rcon password.
I have changed and changed and changed it. I have sv_AllowDownload 0, and g_CallVote 0.
How can I protect myself from this?

He says he did it through the msgboom crash, do I need to patch my server? I don't know how to do this with the msgboom.. Can someone help?
He also seems to get complete access of the server directory. It can't be a trojan because this is a paid server and he also commented in my games log that he has done this to 4 other servers.

I don't know what to do, I am considering contacting his ISP and letting them see the transcript of the games.log.
In the games.log he states he gains full control of the computer.

He uploaded a file to the server: cdf32OLE.exe.

I have reason to believe that he is a member of this forum.

well that doesn't really seem possible unless he is a server admin playing a prank on another server admin
if ur renting the server, i suggest u change ur login password for the server so no one but u knows it so only u can upload and change stuff

i don't think he acquired ur rcon or uploaded anything through 'msgboom crash' because that is just a simple cmd overflow

really the only thing is just change ur login for the server, u might have given it out to the wrong person and they might be doing this or have given it out... so do that and tell me what happens :)

He indeed uploaded it.
Apparently he did the same to 3 other servers.

In my server path was his executable, it was also inside System32. As well as a batch file that disabled firewall and created an ftp / ran telnet.

So he did indeed use a massive exploit through the quake 3 engine.

I should add that no one else has the server password, or the rconpassword.

Taken from his source code:

again, how about this, remove the rcon from the server so there is no password, just leave it blank... change it in the .cfg from rconpassword "blahblah" to just ""
and again, just change ur server password and login to something else and see if that works, because this method ur describing seems too improbable
u are renting the server, right? and from who?

in jedi academy is perfectly possible to execude malicious code through the /say overflow bug:
http://aluigi.org/adv/jamsgbof-adv.txt

and this is the patch I wrote:
http://aluigi.org/patches/jamsgfix.txt

I don't know if it works also on 1.00 but you can try

well then i guess i was wrong xD

are u hosting a linux or windows server?

how would u have his source code?

*edit*

his? i don't know who u are referring to
1.0 doesn't have a released source code btw, all editing on 1.0 is done through reverse engineering & hex editing

Taken from his source code:
Code:
printf("This program makes a script that can be executed\n");
printf("from the client game console that will give the server\n");
printf("a too big string throug the /say command and the local buffer \n");
printf("overflows, and the return adress is overwritten to point at a place \n");
printf("in the local buffer we just overflowed, witch has been filled with \n");
printf("user specified shellcode in raw binary format.\n\n");


^

How could he take it from his source code LOL, he would NEED the source code, and why would a person who hacked his server give him that lol

anyways he just used buffer overflow 2 exec malicious code..like aluigi said

what was the name of the "hacker"? Maybe i know him, i have some "connections" in 1.00, this sounds really weird. How he could upload the .exe?, at my opinion he need to find out the username and password of the root server, this is, at linux systems, in the "shadow" and "passwd" file, but the shadow file is just server side, and not downloadable, so its impossible to findout a root password (bout brute force), in this engine.

Can you tell me what code he executed with the buffer overflow o.0 i really want to know how this works ^^ i googled a bit and find out that the buffer can be filled with 0x0 since the buffer is full and then after the whole 0x0 i have to put a jump call or something that will be executed than by the server with the privilegs of the user who run the server. Is this right ^^ ? And now the ultimate question how or where can i find a code that have such a effect?

it's a buffer-overflow vulnerability so you must understand how works the exploiting of stack based overflows: things like overwriting the return address, jmp esp, ascii encoded shellcode and so on.

if you don't have basics of assembly and programming (for doing some tests), give up.

Guilty :P

And yes, i did exploit the /say bof, if you have the sourceyou propably got it from noa or axis, or you ARE axis or noa, but i assume you're the admin of god underworld 2.

I have to say it made my day when i just strolled in here and i find you scratching your heads trying to figure out how cdf32OLE.exe got into the computer.

drunk/high/mad that night post edited lol

-.- it's not under any definition a virus.

& the source is here, i beat multiplayer with it, so i dont need it anymore :P

http://lamerlord.lamer.la/files/jk3saybof.c

and it's not all over the internet, only on pastebin and on my box.

I believe this is kid would be the definition of "arrogant". I don't see any need for flames over what he had posted, why are you offended so much by it?

Sorry, I was really fucked up that night, looked back at that idiotic post today lol. I have no grudges against anybody, just edited my post.