are u using any plugins?

----- Original Message -----
From: "hondaman" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Saturday, January 01, 2005 7:27 AM
Subject: Re: [hlds_linux] Server Crash Exploit Part 2


http://forums.steampowered.com/forums/showthread.php?s=&threadid=218309

Second post down.  Guy changed his name to the same as when my server
crashed.  Im gonna see if I can get the ip from that admin to check if
its the same guy.

hondaman wrote:

This is a repost of my prior, with formatting fixes and some more
information.

Last night, this is what happened after several people where banned for
tking (i dont know if its related, but that was what happened):

Dec 31 00:58:26 HardGaming kernel: srcds_amd[1966]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4

Then after several minutes, this:

Dec 31 02:08:24 HardGaming kernel: srcds_amd[7425]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:09:21 HardGaming kernel: srcds_amd[7476]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:10:26 HardGaming kernel: srcds_amd[7508]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:10:42 HardGaming kernel: srcds_amd[7556]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:12:03 HardGaming kernel: srcds_amd[7561]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:12:18 HardGaming kernel: srcds_amd[7574]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:16:00 HardGaming kernel: srcds_amd[7624]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:16:35 HardGaming kernel: srcds_amd[7659]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:23:01 HardGaming kernel: srcds_amd[7662]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:27:05 HardGaming kernel: srcds_amd[7787]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:27:37 HardGaming kernel: srcds_amd[7886]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:28:26 HardGaming kernel: srcds_amd[7893]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:37:43 HardGaming kernel: srcds_amd[7922]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4

The CS:S server logs end abruptly after the server restarts.  I looked
through the logs, but didnt find anything obvious, other than this guy
who makes references to server crashes:

css1/L1231006.log:L 12/31/2004 - 01:02:34: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "server crashed?"
css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "yo man, i manage a
server, my shit crashed to, i think its Valve, you know what causes it?"
css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "it crashes after i
ban peeps"
css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "so whos admin, need to
know what they think about the server crashes?"

THEN, this guy joins:

L 12/31/2004 - 02:28:37: Log file started (file "logs/L1231026.log")
(game "/gaming/css1/cstrike") (version "2230")
L 12/31/2004 - 02:28:37: server_cvar: "mp_falldamage" "1"
L 12/31/2004 - 02:28:37: server_cvar: "mp_flashlight" "1"
L 12/31/2004 - 02:28:37: server_cvar: "mp_friendlyfire" "1"
L 12/31/2004 - 02:28:55: "Sherrif<2><STEAM_ID_PENDING><>" connected,
address "68.60.26.139:27005"
L 12/31/2004 - 02:28:55: World triggered "Round_Start"
L 12/31/2004 - 02:29:02: World triggered "Round_Start"
L 12/31/2004 - 02:29:19: "dogmoney<3><STEAM_ID_PENDING><>" connected,
address "69.225.242.45:27005"
L 12/31/2004 - 02:29:21: "Sherrif<2><STEAM_0:1:2540473><>" entered the
game
L 12/31/2004 - 02:29:25: "Sherrif<2><STEAM_0:1:2540473><Unassigned>"
joined team "TERRORIST"
L 12/31/2004 - 02:29:25: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Got_The_Bomb"
L 12/31/2004 - 02:29:54: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Planted_The_Bomb"
L 12/31/2004 - 02:29:56: "dogmoney<3><STEAM_0:1:3666988><>" entered the
game
L 12/31/2004 - 02:30:08: "dogmoney<3><STEAM_0:1:3666988><Unassigned>"
joined team "CT"
L 12/31/2004 - 02:30:08: World triggered "Game_Commencing"
L 12/31/2004 - 02:30:11: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Got_The_Bomb"
L 12/31/2004 - 02:30:17: World triggered "Round_Start"
L 12/31/2004 - 02:30:28: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"
L 12/31/2004 - 02:30:53: "Crash This Fucking
Server!<2><STEAM_0:1:2540473><TERRORIST>" disconnected (reason
"Disconnect by user.")
L 12/31/2004 - 02:31:56: "dogmoney<3><STEAM_0:1:3666988><CT>"
disconnected (reason "Disconnect by user.")
L 12/31/2004 - 02:31:56: World triggered "Round_Draw" (CT "0") (T "0")
L 12/31/2004 - 02:31:56: Team "CT" scored "0" with "0" players
L 12/31/2004 - 02:31:56: Team "TERRORIST" scored "0" with "0" players
L 12/31/2004 - 02:31:56: World triggered "Round_End"
L 12/31/2004 - 02:32:07: World triggered "Round_Start"
L 12/31/2004 - 02:32:08: Log file closed

See his name?  Sorry for the swearing:
L 12/31/2004 - 02:30:28: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"

I grepped that sheffif guys steamid, and this is what I got:

css1/L1231022.log:L 12/31/2004 - 02:17:33:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "hey admin"
css1/L1231022.log:L 12/31/2004 - 02:17:38:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "whats up with the
server?"
css1/L1231022.log:L 12/31/2004 - 02:17:59:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "well listen"
css1/L1231022.log:L 12/31/2004 - 02:18:13:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "i had a friend get
banned"
css1/L1231022.log:L 12/31/2004 - 02:18:18:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "can you unban him?"
css1/L1231022.log:L 12/31/2004 - 02:18:37:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "couple days ago"
css1/L1231022.log:L 12/31/2004 - 02:18:58:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "then what?"
css1/L1231022.log:L 12/31/2004 - 02:19:33:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "cool"
css1/L1231022.log:L 12/31/2004 - 02:19:50:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "well just to tell ya hes
not happy"

hes the same guy who says this:

css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "yo man, i manage a
server, my shit crashed to, i think its Valve, you know what causes it?"
css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "it crashes after i
ban peeps"
css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "so whos admin, need to
know what they think about the server crashes?"
css1/L1231006.log:L 12/31/2004 - 01:11:47: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "mine does"
css1/L1231006.log:L 12/31/2004 - 01:11:56: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "every time i ban some
peeps it goes down"

Then later changes his name to this:

css1/L1231028.log:L 12/31/2004 - 02:33:01: "Crash This Fucking
Server!<4><STEAM_0:1:2540473><>" disconnected (reason "Disconnect by
user.")

I dont know what to think or do about this, but im absolutley sure it
was intentional.  I will gladly send whatever logs are necessary to
track this down.










_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux





_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux




_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

Reply via email to