Re: [hlds_linux] Server Crash Exploit Part 2

hondaman Fri, 07 Jan 2005 19:43:22 -0800

When did it get fixed?   A quick look at my server logs shows this:

Jan  2 16:33:55 HardGaming kernel: srcds_amd[1893]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Jan  4 18:28:30 HardGaming kernel: srcds_amd[9442]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Jan  4 21:18:41 HardGaming kernel: srcds_amd[25931]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Jan  4 23:03:08 HardGaming kernel: srcds_amd[3263]: segfault at
00000000f948b4a8 rip 0000000000826423 rsp 00000000ffff9764 error 6
Jan  5 21:45:12 HardGaming kernel: srcds_amd[21407]: segfault at
0000000010f10c9c rip 000000000082cde9 rsp 00000000ffff9e38 error 4
Jan  6 04:14:03 HardGaming kernel: srcds_amd[24604]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 09:08:10 HardGaming kernel: srcds_amd[27309]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 09:57:24 HardGaming kernel: srcds_amd[30962]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 10:42:44 HardGaming kernel: srcds_amd[31549]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 11:24:01 HardGaming kernel: srcds_amd[32159]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 12:23:04 HardGaming kernel: srcds_amd[32635]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 16:11:11 HardGaming kernel: srcds_amd[955]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan  6 16:42:16 HardGaming kernel: srcds_amd_css6[4914]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Jan  6 18:22:27 HardGaming kernel: srcds_amd_css2[4678]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan  6 23:27:34 HardGaming kernel: srcds_amd_css5[3103]: segfault at
00000000000001f7 rip 00000000f2e7ef10 rsp 00000000ffffb070 error 4
Jan  7 10:51:03 HardGaming kernel: srcds_amd_css2[6333]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan  7 14:17:43 HardGaming kernel: srcds_amd_css2[18739]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan  7 17:48:55 HardGaming kernel: srcds_amd_css2[21482]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan  7 21:33:22 HardGaming kernel: srcds_amd[746]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4

Kerry Dorsey wrote:

hondaman wrote:

CS:S

William Warren wrote:

is this CS:S or 1.6?


hondaman wrote:

Just a followup.  The very same guy who crashed 7Harbinger in the
steampowered forums is the guy who crashed mine.  Check this out:

*7Harbinger*

Registered: Nov 2004
Posts: 4 *as per your request*

Here you go. This portion of the logfile should do it for you.

L 12/31/2004 - 03:46:54: "Crash This ****ing Server!!!<4><>"
connected,
address "68.60.26.139:27005"
L 12/31/2004 - 03:46:55: "Crash This ****ing Server!!!<4><>"
disconnected (reason "STEAM UserID STEAM_0:1:2540473 is banned

And from my logs:

L 12/31/2004 - 02:28:55: "Sherrif<2><STEAM_ID_PENDING><>" connected,
address "68.60.26.139:27005"
L 12/31/2004 - 02:30:28: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"


hondaman wrote:

no

Kingsley Foreman wrote:

are u using any plugins?

----- Original Message -----
From: "hondaman" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Saturday, January 01, 2005 7:27 AM
Subject: Re: [hlds_linux] Server Crash Exploit Part 2

http://forums.steampowered.com/forums/showthread.php?s=&threadid=218309


Second post down.  Guy changed his name to the same as when my
server
crashed.  Im gonna see if I can get the ip from that admin to
check if
its the same guy.

hondaman wrote:

This is a repost of my prior, with formatting fixes and some more
information.

Last night, this is what happened after several people where
banned
for
tking (i dont know if its related, but that was what happened):

Dec 31 00:58:26 HardGaming kernel: srcds_amd[1966]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4

Then after several minutes, this:

Dec 31 02:08:24 HardGaming kernel: srcds_amd[7425]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:09:21 HardGaming kernel: srcds_amd[7476]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:10:26 HardGaming kernel: srcds_amd[7508]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:10:42 HardGaming kernel: srcds_amd[7556]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:12:03 HardGaming kernel: srcds_amd[7561]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:12:18 HardGaming kernel: srcds_amd[7574]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:16:00 HardGaming kernel: srcds_amd[7624]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:16:35 HardGaming kernel: srcds_amd[7659]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:23:01 HardGaming kernel: srcds_amd[7662]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:27:05 HardGaming kernel: srcds_amd[7787]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:27:37 HardGaming kernel: srcds_amd[7886]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:28:26 HardGaming kernel: srcds_amd[7893]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Dec 31 02:37:43 HardGaming kernel: srcds_amd[7922]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4

The CS:S server logs end abruptly after the server restarts.  I
looked
through the logs, but didnt find anything obvious, other than
this guy
who makes references to server crashes:

css1/L1231006.log:L 12/31/2004 - 01:02:34: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "server
crashed?"
css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "yo man, i
manage a
server, my shit crashed to, i think its Valve, you know what
causes
it?"
css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "it crashes
after i
ban peeps"
css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "so whos admin,
need to
know what they think about the server crashes?"

THEN, this guy joins:

L 12/31/2004 - 02:28:37: Log file started (file
"logs/L1231026.log")
(game "/gaming/css1/cstrike") (version "2230")
L 12/31/2004 - 02:28:37: server_cvar: "mp_falldamage" "1"
L 12/31/2004 - 02:28:37: server_cvar: "mp_flashlight" "1"
L 12/31/2004 - 02:28:37: server_cvar: "mp_friendlyfire" "1"
L 12/31/2004 - 02:28:55: "Sherrif<2><STEAM_ID_PENDING><>"
connected,
address "68.60.26.139:27005"
L 12/31/2004 - 02:28:55: World triggered "Round_Start"
L 12/31/2004 - 02:29:02: World triggered "Round_Start"
L 12/31/2004 - 02:29:19: "dogmoney<3><STEAM_ID_PENDING><>"
connected,
address "69.225.242.45:27005"
L 12/31/2004 - 02:29:21: "Sherrif<2><STEAM_0:1:2540473><>"
entered the
game
L 12/31/2004 - 02:29:25:
"Sherrif<2><STEAM_0:1:2540473><Unassigned>"
joined team "TERRORIST"
L 12/31/2004 - 02:29:25:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Got_The_Bomb"
L 12/31/2004 - 02:29:54:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Planted_The_Bomb"
L 12/31/2004 - 02:29:56: "dogmoney<3><STEAM_0:1:3666988><>"
entered
the
game
L 12/31/2004 - 02:30:08:
"dogmoney<3><STEAM_0:1:3666988><Unassigned>"
joined team "CT"
L 12/31/2004 - 02:30:08: World triggered "Game_Commencing"
L 12/31/2004 - 02:30:11:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Got_The_Bomb"
L 12/31/2004 - 02:30:17: World triggered "Round_Start"
L 12/31/2004 - 02:30:28:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"
L 12/31/2004 - 02:30:53: "Crash This Fucking
Server!<2><STEAM_0:1:2540473><TERRORIST>" disconnected (reason
"Disconnect by user.")
L 12/31/2004 - 02:31:56: "dogmoney<3><STEAM_0:1:3666988><CT>"
disconnected (reason "Disconnect by user.")
L 12/31/2004 - 02:31:56: World triggered "Round_Draw" (CT "0") (T
"0")
L 12/31/2004 - 02:31:56: Team "CT" scored "0" with "0" players
L 12/31/2004 - 02:31:56: Team "TERRORIST" scored "0" with "0"
players
L 12/31/2004 - 02:31:56: World triggered "Round_End"
L 12/31/2004 - 02:32:07: World triggered "Round_Start"
L 12/31/2004 - 02:32:08: Log file closed

See his name?  Sorry for the swearing:
L 12/31/2004 - 02:30:28:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"

I grepped that sheffif guys steamid, and this is what I got:

css1/L1231022.log:L 12/31/2004 - 02:17:33:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "hey admin"
css1/L1231022.log:L 12/31/2004 - 02:17:38:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "whats up with the
server?"
css1/L1231022.log:L 12/31/2004 - 02:17:59:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "well listen"
css1/L1231022.log:L 12/31/2004 - 02:18:13:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "i had a friend get
banned"
css1/L1231022.log:L 12/31/2004 - 02:18:18:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "can you unban
him?"
css1/L1231022.log:L 12/31/2004 - 02:18:37:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "couple days ago"
css1/L1231022.log:L 12/31/2004 - 02:18:58:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "then what?"
css1/L1231022.log:L 12/31/2004 - 02:19:33:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "cool"
css1/L1231022.log:L 12/31/2004 - 02:19:50:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "well just to
tell ya
hes
not happy"

hes the same guy who says this:

css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "yo man, i
manage a
server, my shit crashed to, i think its Valve, you know what
causes
it?"
css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "it crashes
after i
ban peeps"
css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "so whos admin,
need to
know what they think about the server crashes?"
css1/L1231006.log:L 12/31/2004 - 01:11:47: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "mine does"
css1/L1231006.log:L 12/31/2004 - 01:11:56: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "every time i ban
some
peeps it goes down"

Then later changes his name to this:

css1/L1231028.log:L 12/31/2004 - 02:33:01: "Crash This Fucking
Server!<4><STEAM_0:1:2540473><>" disconnected (reason
"Disconnect by
user.")

I dont know what to think or do about this, but im absolutley
sure it
was intentional.  I will gladly send whatever logs are
necessary to
track this down.


_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux


--
My "Foundation" verse:
Isa 54:17  No weapon that is formed against thee shall prosper;
and every tongue that shall rise against thee in judgment thou
shalt condemn. This is the heritage of the servants of the LORD,
and their righteousness is of me, saith the LORD.

-- carpe ductum -- "Grab the tape"
CDTT (Certified Duct Tape Technician)

_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

Although the exploit was fixed, have you reported this tool to his ISP
for abuse? He's a complete moron in the Chattanooga, TN area, and, with
excerpts from the two different logs, he's sure to get his service
chopped. Thirty seconds of your time could more than pay back this idiot
for his meddling.

Kerry

_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

Re: [hlds_linux] Server Crash Exploit Part 2

Reply via email to