Interesting. Players said that on one of our servers, some guy came in last night with the name "shawn has joined the game" and spammed it or something "hundreds of times" I checked the linux server logs, and sure enough:
Jan 7 23:36:22 HardGaming kernel: srcds_amd_css1[3704]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Jan 7 23:36:37 HardGaming kernel: srcds_amd_css1[5226]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Jan 7 23:38:07 HardGaming kernel: srcds_amd_css1[5229]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
What I dont understand is why you where able to get the logs of this guy joining and parting? My server didnt log it, and hasnt ever logged it.
Ronny Schedel wrote:
I have the same problem. A user is banned and he floods the server with connections, as you can see here: http://www.kifferstuebchen.de/index.php?showpage=livestats&?accid=cshlstats03&showpage=livestats&%3Faccid=cshlstats03&mode=playerhistory&player=160174&page=1
After some time, the server crashes. Hopefully this will be fixed as soon as possible.
Greets Ronny
When did it get fixed? A quick look at my server logs shows this:
Jan 2 16:33:55 HardGaming kernel: srcds_amd[1893]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4 Jan 4 18:28:30 HardGaming kernel: srcds_amd[9442]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4 Jan 4 21:18:41 HardGaming kernel: srcds_amd[25931]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4 Jan 4 23:03:08 HardGaming kernel: srcds_amd[3263]: segfault at 00000000f948b4a8 rip 0000000000826423 rsp 00000000ffff9764 error 6 Jan 5 21:45:12 HardGaming kernel: srcds_amd[21407]: segfault at 0000000010f10c9c rip 000000000082cde9 rsp 00000000ffff9e38 error 4 Jan 6 04:14:03 HardGaming kernel: srcds_amd[24604]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 09:08:10 HardGaming kernel: srcds_amd[27309]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 09:57:24 HardGaming kernel: srcds_amd[30962]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 10:42:44 HardGaming kernel: srcds_amd[31549]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 11:24:01 HardGaming kernel: srcds_amd[32159]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 12:23:04 HardGaming kernel: srcds_amd[32635]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 16:11:11 HardGaming kernel: srcds_amd[955]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4 Jan 6 16:42:16 HardGaming kernel: srcds_amd_css6[4914]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Jan 6 18:22:27 HardGaming kernel: srcds_amd_css2[4678]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4 Jan 6 23:27:34 HardGaming kernel: srcds_amd_css5[3103]: segfault at 00000000000001f7 rip 00000000f2e7ef10 rsp 00000000ffffb070 error 4 Jan 7 10:51:03 HardGaming kernel: srcds_amd_css2[6333]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4 Jan 7 14:17:43 HardGaming kernel: srcds_amd_css2[18739]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4 Jan 7 17:48:55 HardGaming kernel: srcds_amd_css2[21482]: segfault at 0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4 Jan 7 21:33:22 HardGaming kernel: srcds_amd[746]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Kerry Dorsey wrote:
hondaman wrote:
CS:S
William Warren wrote:
is this CS:S or 1.6?
hondaman wrote:
Just a followup. The very same guy who crashed 7Harbinger in the steampowered forums is the guy who crashed mine. Check this out:
*7Harbinger*
Registered: Nov 2004 Posts: 4 *as per your request*
Here you go. This portion of the logfile should do it for you.
L 12/31/2004 - 03:46:54: "Crash This ****ing Server!!!<4><>" connected, address "68.60.26.139:27005" L 12/31/2004 - 03:46:55: "Crash This ****ing Server!!!<4><>" disconnected (reason "STEAM UserID STEAM_0:1:2540473 is banned
And from my logs:
L 12/31/2004 - 02:28:55: "Sherrif<2><STEAM_ID_PENDING><>" connected, address "68.60.26.139:27005" L 12/31/2004 - 02:30:28: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" changed name to "Crash This Fucking Server!"
hondaman wrote:
no
Kingsley Foreman wrote:
are u using any plugins?
----- Original Message ----- From: "hondaman" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Saturday, January 01, 2005 7:27 AM Subject: Re: [hlds_linux] Server Crash Exploit Part 2
http://forums.steampowered.com/forums/showthread.php?s=&threadid=218309
Second post down. Guy changed his name to the same as when my server crashed. Im gonna see if I can get the ip from that admin to check if its the same guy.
hondaman wrote:
This is a repost of my prior, with formatting fixes and some more information.
Last night, this is what happened after several people where banned for tking (i dont know if its related, but that was what happened):
Dec 31 00:58:26 HardGaming kernel: srcds_amd[1966]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Then after several minutes, this:
Dec 31 02:08:24 HardGaming kernel: srcds_amd[7425]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:09:21 HardGaming kernel: srcds_amd[7476]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:10:26 HardGaming kernel: srcds_amd[7508]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:10:42 HardGaming kernel: srcds_amd[7556]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:12:03 HardGaming kernel: srcds_amd[7561]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:12:18 HardGaming kernel: srcds_amd[7574]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:16:00 HardGaming kernel: srcds_amd[7624]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:16:35 HardGaming kernel: srcds_amd[7659]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:23:01 HardGaming kernel: srcds_amd[7662]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:27:05 HardGaming kernel: srcds_amd[7787]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:27:37 HardGaming kernel: srcds_amd[7886]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:28:26 HardGaming kernel: srcds_amd[7893]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4 Dec 31 02:37:43 HardGaming kernel: srcds_amd[7922]: segfault at 0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
The CS:S server logs end abruptly after the server restarts. I looked through the logs, but didnt find anything obvious, other than this guy who makes references to server crashes:
css1/L1231006.log:L 12/31/2004 - 01:02:34: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "server crashed?" css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "yo man, i manage a server, my shit crashed to, i think its Valve, you know what causes it?" css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "it crashes after i ban peeps" css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "so whos admin, need to know what they think about the server crashes?"
THEN, this guy joins:
L 12/31/2004 - 02:28:37: Log file started (file "logs/L1231026.log") (game "/gaming/css1/cstrike") (version "2230") L 12/31/2004 - 02:28:37: server_cvar: "mp_falldamage" "1" L 12/31/2004 - 02:28:37: server_cvar: "mp_flashlight" "1" L 12/31/2004 - 02:28:37: server_cvar: "mp_friendlyfire" "1" L 12/31/2004 - 02:28:55: "Sherrif<2><STEAM_ID_PENDING><>" connected, address "68.60.26.139:27005" L 12/31/2004 - 02:28:55: World triggered "Round_Start" L 12/31/2004 - 02:29:02: World triggered "Round_Start" L 12/31/2004 - 02:29:19: "dogmoney<3><STEAM_ID_PENDING><>" connected, address "69.225.242.45:27005" L 12/31/2004 - 02:29:21: "Sherrif<2><STEAM_0:1:2540473><>" entered the game L 12/31/2004 - 02:29:25: "Sherrif<2><STEAM_0:1:2540473><Unassigned>" joined team "TERRORIST" L 12/31/2004 - 02:29:25: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" triggered "Got_The_Bomb" L 12/31/2004 - 02:29:54: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" triggered "Planted_The_Bomb" L 12/31/2004 - 02:29:56: "dogmoney<3><STEAM_0:1:3666988><>" entered the game L 12/31/2004 - 02:30:08: "dogmoney<3><STEAM_0:1:3666988><Unassigned>" joined team "CT" L 12/31/2004 - 02:30:08: World triggered "Game_Commencing" L 12/31/2004 - 02:30:11: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" triggered "Got_The_Bomb" L 12/31/2004 - 02:30:17: World triggered "Round_Start" L 12/31/2004 - 02:30:28: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" changed name to "Crash This Fucking Server!" L 12/31/2004 - 02:30:53: "Crash This Fucking Server!<2><STEAM_0:1:2540473><TERRORIST>" disconnected (reason "Disconnect by user.") L 12/31/2004 - 02:31:56: "dogmoney<3><STEAM_0:1:3666988><CT>" disconnected (reason "Disconnect by user.") L 12/31/2004 - 02:31:56: World triggered "Round_Draw" (CT "0") (T "0") L 12/31/2004 - 02:31:56: Team "CT" scored "0" with "0" players L 12/31/2004 - 02:31:56: Team "TERRORIST" scored "0" with "0" players L 12/31/2004 - 02:31:56: World triggered "Round_End" L 12/31/2004 - 02:32:07: World triggered "Round_Start" L 12/31/2004 - 02:32:08: Log file closed
See his name? Sorry for the swearing: L 12/31/2004 - 02:30:28: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" changed name to "Crash This Fucking Server!"
I grepped that sheffif guys steamid, and this is what I got:
css1/L1231022.log:L 12/31/2004 - 02:17:33: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "hey admin" css1/L1231022.log:L 12/31/2004 - 02:17:38: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "whats up with the server?" css1/L1231022.log:L 12/31/2004 - 02:17:59: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "well listen" css1/L1231022.log:L 12/31/2004 - 02:18:13: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "i had a friend get banned" css1/L1231022.log:L 12/31/2004 - 02:18:18: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "can you unban him?" css1/L1231022.log:L 12/31/2004 - 02:18:37: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "couple days ago" css1/L1231022.log:L 12/31/2004 - 02:18:58: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "then what?" css1/L1231022.log:L 12/31/2004 - 02:19:33: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "cool" css1/L1231022.log:L 12/31/2004 - 02:19:50: "Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "well just to tell ya hes not happy"
hes the same guy who says this:
css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "yo man, i manage a server, my shit crashed to, i think its Valve, you know what causes it?" css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say_team "it crashes after i ban peeps" css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "so whos admin, need to know what they think about the server crashes?" css1/L1231006.log:L 12/31/2004 - 01:11:47: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "mine does" css1/L1231006.log:L 12/31/2004 - 01:11:56: "D@ Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "every time i ban some peeps it goes down"
Then later changes his name to this:
css1/L1231028.log:L 12/31/2004 - 02:33:01: "Crash This Fucking Server!<4><STEAM_0:1:2540473><>" disconnected (reason "Disconnect by user.")
I dont know what to think or do about this, but im absolutley sure it was intentional. I will gladly send whatever logs are necessary to track this down.
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
-- My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.
-- carpe ductum -- "Grab the tape" CDTT (Certified Duct Tape Technician)
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
Although the exploit was fixed, have you reported this tool to his ISP for abuse? He's a complete moron in the Chattanooga, TN area, and, with excerpts from the two different logs, he's sure to get his service chopped. Thirty seconds of your time could more than pay back this idiot for his meddling.
Kerry
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
