His server is running HLStats, which most prob logs in more detail :)
Paul
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of hondaman
Sent: Sat 08 January 2005 19:35
To: [email protected]
Subject: Re: [hlds_linux] Server Crash Exploit Part 2
Interesting. Players said that on one of our servers, some
guy came in
last night with the name "shawn has joined the game" and spammed it or
something "hundreds of times"
I checked the linux server logs, and sure enough:
Jan 7 23:36:22 HardGaming kernel: srcds_amd_css1[3704]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Jan 7 23:36:37 HardGaming kernel: srcds_amd_css1[5226]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Jan 7 23:38:07 HardGaming kernel: srcds_amd_css1[5229]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
What I dont understand is why you where able to get the logs
of this guy
joining and parting? My server didnt log it, and hasnt ever
logged it.
Ronny Schedel wrote:
I have the same problem. A user is banned and he floods the server
with connections, as you can see here:
http://www.kifferstuebchen.de/index.php?showpage=livestats&?ac
cid=cshlstats03&showpage=livestats&%3Faccid=cshlstats03>
&mode=playerhistory&player=160174&page=1
After some time, the server crashes. Hopefully this will be fixed
as soon as possible.
Greets
Ronny
When did it get fixed? A quick look at my server logs shows this:
Jan 2 16:33:55 HardGaming kernel: srcds_amd[1893]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Jan 4 18:28:30 HardGaming kernel: srcds_amd[9442]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Jan 4 21:18:41 HardGaming kernel: srcds_amd[25931]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Jan 4 23:03:08 HardGaming kernel: srcds_amd[3263]: segfault at
00000000f948b4a8 rip 0000000000826423 rsp 00000000ffff9764 error 6
Jan 5 21:45:12 HardGaming kernel: srcds_amd[21407]: segfault at
0000000010f10c9c rip 000000000082cde9 rsp 00000000ffff9e38 error 4
Jan 6 04:14:03 HardGaming kernel: srcds_amd[24604]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 09:08:10 HardGaming kernel: srcds_amd[27309]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 09:57:24 HardGaming kernel: srcds_amd[30962]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 10:42:44 HardGaming kernel: srcds_amd[31549]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 11:24:01 HardGaming kernel: srcds_amd[32159]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 12:23:04 HardGaming kernel: srcds_amd[32635]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 16:11:11 HardGaming kernel: srcds_amd[955]: segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb170 error 4
Jan 6 16:42:16 HardGaming kernel: srcds_amd_css6[4914]:
segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100 error 4
Jan 6 18:22:27 HardGaming kernel: srcds_amd_css2[4678]:
segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan 6 23:27:34 HardGaming kernel: srcds_amd_css5[3103]:
segfault at
00000000000001f7 rip 00000000f2e7ef10 rsp 00000000ffffb070 error 4
Jan 7 10:51:03 HardGaming kernel: srcds_amd_css2[6333]:
segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan 7 14:17:43 HardGaming kernel: srcds_amd_css2[18739]:
segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan 7 17:48:55 HardGaming kernel: srcds_amd_css2[21482]:
segfault at
0000000000000000 rip 00000000f2873390 rsp 00000000ffffb160 error 4
Jan 7 21:33:22 HardGaming kernel: srcds_amd[746]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb110 error 4
Kerry Dorsey wrote:
hondaman wrote:
CS:S
William Warren wrote:
is this CS:S or 1.6?
hondaman wrote:
Just a followup. The very same guy who crashed
7Harbinger in the
steampowered forums is the guy who crashed mine.
Check this out:
*7Harbinger*
Registered: Nov 2004
Posts: 4 *as per your request*
Here you go. This portion of the logfile should do it for you.
L 12/31/2004 - 03:46:54: "Crash This ****ing Server!!!<4><>"
connected,
address "68.60.26.139:27005"
L 12/31/2004 - 03:46:55: "Crash This ****ing Server!!!<4><>"
disconnected (reason "STEAM UserID STEAM_0:1:2540473 is banned
And from my logs:
L 12/31/2004 - 02:28:55:
"Sherrif<2><STEAM_ID_PENDING><>" connected,
address "68.60.26.139:27005"
L 12/31/2004 - 02:30:28:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"
hondaman wrote:
no
Kingsley Foreman wrote:
are u using any plugins?
----- Original Message -----
From: "hondaman" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Saturday, January 01, 2005 7:27 AM
Subject: Re: [hlds_linux] Server Crash Exploit Part 2
http://forums.steampowered.com/forums/showthread.php?s=&thread
id=218309
Second post down. Guy changed his name to the same
as when my
server
crashed. Im gonna see if I can get the ip from
that admin to
check if
its the same guy.
hondaman wrote:
This is a repost of my prior, with formatting
fixes and some
more
information.
Last night, this is what happened after several
people where
banned
for
tking (i dont know if its related, but that was
what happened):
Dec 31 00:58:26 HardGaming kernel:
srcds_amd[1966]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Then after several minutes, this:
Dec 31 02:08:24 HardGaming kernel:
srcds_amd[7425]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:09:21 HardGaming kernel:
srcds_amd[7476]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:10:26 HardGaming kernel:
srcds_amd[7508]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:10:42 HardGaming kernel:
srcds_amd[7556]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:12:03 HardGaming kernel:
srcds_amd[7561]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:12:18 HardGaming kernel:
srcds_amd[7574]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:16:00 HardGaming kernel:
srcds_amd[7624]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:16:35 HardGaming kernel:
srcds_amd[7659]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:23:01 HardGaming kernel:
srcds_amd[7662]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:27:05 HardGaming kernel:
srcds_amd[7787]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:27:37 HardGaming kernel:
srcds_amd[7886]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:28:26 HardGaming kernel:
srcds_amd[7893]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
Dec 31 02:37:43 HardGaming kernel:
srcds_amd[7922]: segfault at
0000000000000000 rip 00000000f7b26a1b rsp 00000000ffffb100
error 4
The CS:S server logs end abruptly after the server
restarts. I
looked
through the logs, but didnt find anything obvious,
other than
this guy
who makes references to server crashes:
css1/L1231006.log:L 12/31/2004 - 01:02:34: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>"
say_team "server
crashed?"
css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>"
say_team "yo man, i
manage a
server, my shit crashed to, i think its Valve, you
know what
causes
it?"
css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>"
say_team "it crashes
after i
ban peeps"
css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say
"so whos admin,
need to
know what they think about the server crashes?"
THEN, this guy joins:
L 12/31/2004 - 02:28:37: Log file started (file
"logs/L1231026.log")
(game "/gaming/css1/cstrike") (version "2230")
L 12/31/2004 - 02:28:37: server_cvar: "mp_falldamage" "1"
L 12/31/2004 - 02:28:37: server_cvar: "mp_flashlight" "1"
L 12/31/2004 - 02:28:37: server_cvar: "mp_friendlyfire" "1"
L 12/31/2004 - 02:28:55: "Sherrif<2><STEAM_ID_PENDING><>"
connected,
address "68.60.26.139:27005"
L 12/31/2004 - 02:28:55: World triggered "Round_Start"
L 12/31/2004 - 02:29:02: World triggered "Round_Start"
L 12/31/2004 - 02:29:19: "dogmoney<3><STEAM_ID_PENDING><>"
connected,
address "69.225.242.45:27005"
L 12/31/2004 - 02:29:21: "Sherrif<2><STEAM_0:1:2540473><>"
entered the
game
L 12/31/2004 - 02:29:25:
"Sherrif<2><STEAM_0:1:2540473><Unassigned>"
joined team "TERRORIST"
L 12/31/2004 - 02:29:25:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Got_The_Bomb"
L 12/31/2004 - 02:29:54:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Planted_The_Bomb"
L 12/31/2004 - 02:29:56: "dogmoney<3><STEAM_0:1:3666988><>"
entered
the
game
L 12/31/2004 - 02:30:08:
"dogmoney<3><STEAM_0:1:3666988><Unassigned>"
joined team "CT"
L 12/31/2004 - 02:30:08: World triggered "Game_Commencing"
L 12/31/2004 - 02:30:11:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
triggered "Got_The_Bomb"
L 12/31/2004 - 02:30:17: World triggered "Round_Start"
L 12/31/2004 - 02:30:28:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"
L 12/31/2004 - 02:30:53: "Crash This Fucking
Server!<2><STEAM_0:1:2540473><TERRORIST>"
disconnected (reason
"Disconnect by user.")
L 12/31/2004 - 02:31:56:
"dogmoney<3><STEAM_0:1:3666988><CT>"
disconnected (reason "Disconnect by user.")
L 12/31/2004 - 02:31:56: World triggered "Round_Draw" (CT
"0") (T
"0")
L 12/31/2004 - 02:31:56: Team "CT" scored "0" with
"0" players
L 12/31/2004 - 02:31:56: Team "TERRORIST" scored
"0" with "0"
players
L 12/31/2004 - 02:31:56: World triggered "Round_End"
L 12/31/2004 - 02:32:07: World triggered "Round_Start"
L 12/31/2004 - 02:32:08: Log file closed
See his name? Sorry for the swearing:
L 12/31/2004 - 02:30:28:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>"
changed name to "Crash This Fucking Server!"
I grepped that sheffif guys steamid, and this is
what I got:
css1/L1231022.log:L 12/31/2004 - 02:17:33:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "hey admin"
css1/L1231022.log:L 12/31/2004 - 02:17:38:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say
"whats up with
the
server?"
css1/L1231022.log:L 12/31/2004 - 02:17:59:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say
"well listen"
css1/L1231022.log:L 12/31/2004 - 02:18:13:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "i had a
friend get
banned"
css1/L1231022.log:L 12/31/2004 - 02:18:18:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say
"can you unban
him?"
css1/L1231022.log:L 12/31/2004 - 02:18:37:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say
"couple days ago"
css1/L1231022.log:L 12/31/2004 - 02:18:58:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "then what?"
css1/L1231022.log:L 12/31/2004 - 02:19:33:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say "cool"
css1/L1231022.log:L 12/31/2004 - 02:19:50:
"Sherrif<2><STEAM_0:1:2540473><TERRORIST>" say
"well just to
tell ya
hes
not happy"
hes the same guy who says this:
css1/L1231006.log:L 12/31/2004 - 01:05:17: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>"
say_team "yo man, i
manage a
server, my shit crashed to, i think its Valve, you
know what
causes
it?"
css1/L1231006.log:L 12/31/2004 - 01:05:49: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>"
say_team "it crashes
after i
ban peeps"
css1/L1231006.log:L 12/31/2004 - 01:11:31: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say
"so whos admin,
need to
know what they think about the server crashes?"
css1/L1231006.log:L 12/31/2004 - 01:11:47: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say "mine does"
css1/L1231006.log:L 12/31/2004 - 01:11:56: "D@
Sniper!!<27><STEAM_0:1:2540473><TERRORIST>" say
"every time i
ban
some
peeps it goes down"
Then later changes his name to this:
css1/L1231028.log:L 12/31/2004 - 02:33:01: "Crash
This Fucking
Server!<4><STEAM_0:1:2540473><>" disconnected (reason
"Disconnect by
user.")
I dont know what to think or do about this, but im
absolutley
sure it
was intentional. I will gladly send whatever logs are
necessary to
track this down.
_______________________________________________
To unsubscribe, edit your list preferences, or
view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
--
My "Foundation" verse:
Isa 54:17 No weapon that is formed against thee shall prosper;
and every tongue that shall rise against thee in judgment thou
shalt condemn. This is the heritage of the servants of the LORD,
and their righteousness is of me, saith the LORD.
-- carpe ductum -- "Grab the tape"
CDTT (Certified Duct Tape Technician)
_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the
list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
Although the exploit was fixed, have you reported this
tool to his ISP
for abuse? He's a complete moron in the Chattanooga, TN
area, and, with
excerpts from the two different logs, he's sure to get his service
chopped. Thirty seconds of your time could more than pay back this
idiot
for his meddling.
Kerry
_______________________________________________
To unsubscribe, edit your list preferences, or view the
list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the
list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the
list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list
archives, please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
