looks more like someone knows (guessed?) your rcon pw and messed with you.
Is there something else in the logs prior to this? (like rcon from xxxx: Bad
RCON Password or similar)
Ctrl + F for their IP might help finding searching.
----- Original Message -----
From: "Marcel" <[email protected]>
To: "Half-Life dedicated Linux server mailing list"
<[email protected]>
Sent: Tuesday, October 05, 2010 4:04 PM
Subject: [hlds_linux] new exploit? (makes server crash and use 100% cpu)
I have just noticed this (see below) on a srcds_l server running css. After
that the server didn't respond (you aren't even able to enter "quit" to the
console) and it took 100% cpu.
rcon from "xxx.xxx.xxx.xxx:6565": command "status"
rcon from "xxx.xxx.xxx.xxx:6565": command "sv_allow_wait_command 1"
Console: Server hack started
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "Server hack
started"
rcon from "xxx.xxx.xxx.xxx:6565": command "say Server hack started"
Console: Server hacked
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "Server
hacked"
rcon from "xxx.xxx.xxx.xxx:6565": command "say Server hacked"
Console: rcon is now rcon
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "rcon is now
rcon"
rcon from "xxx.xxx.xxx.xxx:6565": command "say rcon is now rcon"
Console: server shutting down
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "server
shutting down"
rcon from "xxx.xxx.xxx.xxx:6565": command "say server shutting down"
Console: 5
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "5"
rcon from "xxx.xxx.xxx.xxx:6565": command "say 5"
Console: 4
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "4"
rcon from "xxx.xxx.xxx.xxx:6565": command "say 4"
Console: 3
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "3"
rcon from "xxx.xxx.xxx.xxx:6565": command "say 3"
Console: 2
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "2"
rcon from "xxx.xxx.xxx.xxx:6565": command "say 2"
Console: 1
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "1"
rcon from "xxx.xxx.xxx.xxx:6565": command "say 1"
Console: SHUTTING DOWN!
L 10/05/2010 - 16:03:45: "Console<0><Console><Console>" say "SHUTTING
DOWN!"
rcon from "xxx.xxx.xxx.xxx:6565": command "say SHUTTING DOWN!"
_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives, please
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux
