-TWC| Forum
Server info "code injection"? - Printable Version

+- -TWC| Forum (https://board.twcclan.org)
+-- Forum: Servers & teams (https://board.twcclan.org/forum-17.html)
+--- Forum: Enemy Territory (https://board.twcclan.org/forum-18.html)
+--- Thread: Server info "code injection"? (/thread-9213.html)

Server info "code injection"? - Mystik - 10-03-2021

So, it appears that some crafty polaks have found a way to inject some code into server info (not sure which, and how). That might not even be how they are achieving this, but that's what seems the most likely to me.

Basically they are making clients instantly connect to their server when clicking "Serverlist" on your ET. You can test this yourself, I had 2 people test and they got connected there as well.

This is the server on TB: https://et.trackbase.net/server/polskieswiry and the IP is 51.83.191.245.

What I'm interested in is; how are they doing this? In my ~12 years of playing ET, I don't recall this ever happening before.

Here are some log entries, not sure if these help. All I can gather from these is that when the servers are loaded on serverlist, the connect happens. The first "ERROR" line would indicate they are trying something weird with connection protocols?

Code:
Requesting servers from the master... CL_ServersResponsePacket 99 servers parsed (total 99) CL_ServersResponsePacket 99 servers parsed (total 198) CL_ServersResponsePacket 99 servers parsed (total 297) CL_ServersResponsePacket 23 servers parsed (total 320) ******************** ERROR: ET://51.83.191.245:27960 ******************** RE_Shutdown( 0 ) Hunk_Clear: reset the hunk ok ----- R_Init -----

And then a bit later

Code:
----- finished R_Init ----- Server is full, redirect to: 51.83.191.245:27960 Resolving etmaster.idsoftware.com etmaster.idsoftware.com resolved to 198.20.216.55:27951 51.83.191.245:27960 resolved to 51.83.191.245:27960 ^5PunkBuster Client: Failed to resolve etguidauth.evenbalance.com ^5PunkBuster Client: Connected to Server 51.83.191.245:27960

And here are the .pk3 their server requires:

Code:
Need paks: nitmod/`.pk3 nitmod/_sound.pk3 nitmod/^^.pk3 nitmod/^32-7^2Please_wait.pk3 nitmod/^32-6^2Please_wait.pk3 nitmod/^32-4^2Please_wait.pk3 nitmod/^32-3^2Please_wait.pk3 nitmod/^32-2^2Please_wait.pk3 nitmod/^32-1^2Please_wait.pk3 nitmod/^32-0^2Please_wait.pk3 nitmod/^31-9^2Please_wait.pk3 nitmod/^31-7^2Please_wait.pk3 nitmod/^31-6^2Please_wait.pk3 nitmod/^31-5^2Please_wait.pk3 nitmod/^31-4^2Please_wait.pk3 nitmod/^31-2^2Please_wait.pk3 nitmod/^31-1^2Please_wait.pk3 nitmod/^31-0^2Please_wait.pk3 nitmod/z_less-snow_4_fd+rg.pk3 nitmod/zaza.pk3 nitmod/xx.pk3 nitmod/twiks.pk3 nitmod/sypa.pk3 nitmod/SOUND.pk3 nitmod/samson.pk3 nitmod/moniq.pk3 nitmod/madii.pk3 nitmod/jumper.pk3 nitmod/Filter.pk3 nitmod/desi.pk3 etmain/`.pk3 Need paks: @nitmod/`.pk3@nitmod/`.pk3@nitmod/_sound.pk3@nitmod/_sound.pk3@nitmod/^^.pk3@nitmod/^^.pk3@nitmod/^32-7^2Please_wait.pk3@nitmod/^32-7^2Please_wait.pk3@nitmod/^32-6^2Please_wait.pk3@nitmod/^32-6^2Please_wait.pk3@nitmod/^32-4^2Please_wait.pk3@nitmod/^32-4^2Please_wait.pk3@nitmod/^32-3^2Please_wait.pk3@nitmod/^32-3^2Please_wait.pk3@nitmod/^32-2^2Please_wait.pk3@nitmod/^32-2^2Please_wait.pk3@nitmod/^32-1^2Please_wait.pk3@nitmod/^32-1^2Please_wait.pk3@nitmod/^32-0^2Please_wait.pk3@nitmod/^32-0^2Please_wait.pk3@nitmod/^31-9^2Please_wait.pk3@nitmod/^31-9^2Please_wait.pk3@nitmod/^31-7^2Please_wait.pk3@nitmod/^31-7^2Please_wait.pk3@nitmod/^31-6^2Please_wait.pk3@nitmod/^31-6^2Please_wait.pk3@nitmod/^31-5^2Please_wait.pk3@nitmod/^31-5^2Please_wait.pk3@nitmod/^31-4^2Please_wait.pk3@nitmod/^31-4^2Please_wait.pk3@nitmod/^31-2^2Please_wait.pk3@nitmod/^31-2^2Please_wait.pk3@nitmod/^31-1^2Please_wait.pk3@nitmod/^31-1^2Please_wait.pk3@nitmod/^31-0^2Please_wait.pk3@nitmod/^31-0^2Please_wait.pk3@nitmod/z_less-snow_4_fd+rg.pk3@n Need paks: @nitmod/`.pk3@nitmod/`.pk3@nitmod/_sound.pk3@nitmod/_sound.pk3@nitmod/^^.pk3@nitmod/^^.pk3@nitmod/^32-7^2Please_wait.pk3@nitmod/^32-7^2Please_wait.pk3@nitmod/^32-6^2Please_wait.pk3@nitmod/^32-6^2Please_wait.pk3@nitmod/^32-4^2Please_wait.pk3@nitmod/^32-4^2Please_wait.pk3@nitmod/^32-3^2Please_wait.pk3@nitmod/^32-3^2Please_wait.pk3@nitmod/^32-2^2Please_wait.pk3@nitmod/^32-2^2Please_wait.pk3@nitmod/^32-1^2Please_wait.pk3@nitmod/^32-1^2Please_wait.pk3@nitmod/^32-0^2Please_wait.pk3@nitmod/^32-0^2Please_wait.pk3@nitmod/^31-9^2Please_wait.pk3@nitmod/^31-9^2Please_wait.pk3@nitmod/^31-7^2Please_wait.pk3@nitmod/^31-7^2Please_wait.pk3@nitmod/^31-6^2Please_wait.pk3@nitmod/^31-6^2Please_wait.pk3@nitmod/^31-5^2Please_wait.pk3@nitmod/^31-5^2Please_wait.pk3@nitmod/^31-4^2Please_wait.pk3@nitmod/^31-4^2Please_wait.pk3@nitmod/^31-2^2Please_wait.pk3@nitmod/^31-2^2Please_wait.pk3@nitmod/^31-1^2Please_wait.pk3@nitmod/^31-1^2Please_wait.pk3@nitmod/^31-0^2Please_wait.pk3@nitmod/^31-0^2Please_wait.pk3@nitmod/z_less-snow_4_fd+rg.pk3@n

Some conflicting IP info, but definitely hosted @ OVH.
[Image: BfLhQ.png]

Code:
Start: 2021-03-10T19:08:34+0000 Loss Snt Last Avg Best Wrst StDev 1.|-- 10.0.10.1 0.0% 4 0.1 0.1 0.1 0.1 0.0 2.|-- 62.115.47.24 0.0% 4 2.3 10.3 2.3 30.1 13.2 3.|-- 62.115.116.16 0.0% 4 0.5 0.4 0.4 0.5 0.0 4.|-- 62.115.114.90 0.0% 4 0.7 0.7 0.6 0.7 0.1 5.|-- 62.115.124.119 0.0% 4 0.7 8.9 0.7 33.0 16.1 6.|-- 178.33.100.250 0.0% 4 1.2 1.1 0.9 1.2 0.1 7.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 8.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 9.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 10.|-- 91.121.215.117 0.0% 4 1.8 2.0 1.8 2.3 0.2 11.|-- 213.251.130.53 0.0% 4 1.5 1.5 1.5 1.5 0.0 12.|-- 178.33.99.161 0.0% 4 1.5 1.5 1.4 1.5 0.0 13.|-- 178.33.99.162 0.0% 4 1.5 1.5 1.5 1.5 0.0 14.|-- 178.33.99.163 0.0% 4 1.5 1.5 1.5 1.6 0.0 15.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 16.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 17.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 18.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 19.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 20.|-- ??? 100.0 4 0.0 0.0 0.0 0.0 0.0 21.|-- 51.83.191.245 0.0% 4 20.9 25.2 20.9 38.1 8.6

I'm far to lazy to do any nmap etc. and find out if this is a dedicated server and if they are hosting other shit as well on it, but hey if you are not, have fun! Biggrin

If someone is interested, please reverse engineer how they are doing this. Also if you know of some nice tricks of how to make ET servers crash, maybe this is a candidate, you know; just to test how crafty they really are. (I don't mean DDoS or anything similar here, that's illegal. There are many other ways to make ET server go byebye Wink )

RE: Server info "code injection"? - Lanttu - 10-03-2021

ja pierdole

RE: Server info "code injection"? - SadNesS - 10-03-2021

had that several times and again today, but i haven't visited any other servers except TWC and eg since my reinstallation of et. and so i'm interested in how it works and don't give up until i know Biggrin

i'll take a closer look and let you know. if someone in etmain has a pk3 or another from the ip or the clan, i would ask for it. you can send me it!

challenge accepted Instagib

RE: Server info "code injection"? - Mystik - 11-03-2021

Here are patched ET binaries from Fearless Assassins released in 2018. These fix masterlist hijackings and other fake redirect servers etc.

https://fearless-assassins.com/files/file/1755-et-masterlist-hacking-and-redirect-fix-for-players/

http://wolfenstein4ever.de/index.php/news/wolfenstein-enemy-territory/et-misc/item/1648-et-masterlist-hacking-and-redirect-fix-for-players

Also ETLegacy is not affected if you can deal with it's caveats like the ~~~~.pk3 file system incompatibility etc.

PS. I take no responsibility about these files, FA and daredevil are legit peeps but if you are sus, don't DL.

RE: Server info "code injection"? - JuliannOldskool - 11-03-2021

2 days ago I saw the movie ‘ who am I ‘ on Netflix really good hacker movie , now I’m interested in this stuff someone teach me how to hack