AlliedModders - CS:GO Server Crash Exploit

AlliedModders (https://forums.alliedmods.net/index.php)

- Source Servers (SRCDS) (https://forums.alliedmods.net/forumdisplay.php?f=130)

- - CS:GO Server Crash Exploit (https://forums.alliedmods.net/showthread.php?t=284184)

CS:GO Server Crash Exploit

Hi there,
I run a small community with around 5 servers and they have recently been targeted by a rival group
that goes around crashing community servers. As far as I know they use AW's teleport shoot crash bug
for which no working plugin nor patch was released. For reference, look at: YouTube Video.

From the technical standpoint, the server receives extremely large viewangles by simply editing usercmd viewangles.

PHP Code:


		
			
//FYI this is c++ not pawn or sourcepawn
//Essentially this function modifies the player viewangles to send an impossibly high x and y viewangle
//What this translates into is the server unable to handle physics calculations
void teleport_function(CUserCmd * pCmd)
{
    pCmd->viewangles.y = std::numeric_limits<float>::quiet_NaN();
    pCmd->viewangles.x = std::numeric_limits<float>::quiet_NaN();
}

So far the applications I've discovered of such devious hacks were that they shoot or jump while
spamming extremely high angles. This results in a server crash. SRCDS will continue to run, but the
server will be "stuck" and players will receive a timeout.

Solutions thus far:
Searched for similar crash reports and found plenty, none have a viable solution.
Reference: https://forums.alliedmods.net/showthread.php?t=276958

Attempt at a fix: https://forums.alliedmods.net/showthread.php?t=276936
Current status: does not prevent this

SMAC log:

Code:

20:13:32: [smac_eyetest.smx | 0.8.6.0] XXXX (ID: STEAM_1:1:XXYY | IP: TYUU) is suspected of cheating with their eye angles. Eye Angles: 205089 205089 205089

20:31:25: [smac_eyetest.smx | 0.8.6.0] XXXX (ID: STEAM_1:1:XXYY | IP: TTYU) is suspected of cheating with their eye angles. Eye Angles: -10058801942080820000000000000000000 -10058801942080820000000000000000000 -10058801942080820000000000000000000

As you can see, SMAC eyetest does detect the aforementioned change in angles, but before it can respond with a ban(next cmd executed) the server already hangs.

---

Does anyone have a viable solution?
Thanks.

----------------------------------

Possible fix to the problem:
1. Add remove out of map weapons plugin to patch Aimware's teleport exploit(partially)
2. Add cmdfix extension(source code also available should you desire to further modify it)
3. Remove bullets from all weapons(that means no sv_infinite_ammo et al gun plugins)
4. Block spam of ping and status queries by restricting them to admin+ users:

Code:

#include <sourcemod>
#pragma semicolon 1

/*
* This plugin will NOT stop your servers from getting crashed, however, it will prevent the
* status/ping cmd spam that causes extreme server instability that /may/ lead to or help spawn a crash.
* 
* To edit the flag checked, scroll down to [Action:block] and replace ADMFLAG_GENERIC with your preferatus.
*
* CHANGELOG:
* 1.1:
* - Will ignore worldplayer(console) command blocking
* - Will ignore fakeplayer(bot) command blocking
*
* 1.0:
* - Initial Release
*/

public Plugin myinfo =
{
    name = "[DS] Status/Ping Restrictor",
    author = "xero, Maxximou5",
    description = "Restricts status/ping access to generic admins. Idea to block these commands by community member named v0id.",
    version = "1.1",
    url = "http://xero.pw"
};

public OnPluginStart()
{
    RegConsoleCmd("status", block);
    RegConsoleCmd("ping", block);
}

public Action block(client, args)
{
    if(!(0 < client <= MaxClients) || !(GetUserFlagBits(client) & ADMFLAG_GENERIC)) return Plugin_Stop;
    
    PrintToConsole(client, "[DS] Admin+ detected, granting access to the requested command."); //optional just for minor debug to know that something preprocesses the blocked commands
    return Plugin_Continue;
}

Afterword: This is not a permanent fix, and I understand that any server that runs a gun gamemode such as casual, deathmatch, 1v1, zombie, et al, will not have the capacity to remove bullets. However, this combination has worked for my servers thus far and it is the only viable alternative until Valve patches this(although severe client monitoring is required to functionally rid the game of crashers.) In short, pressure Valve to turn its lazy eye towards community servers once more here.