Solve this Exploit Allied Modders
 

Before hand I would just like to let you know that I have tried all plugins (kigen, daf, rcon_lock, forlixfloodcheck, smac (and all the plugins that come with it including client protection), zblock, and have even resorted to whitelisting certain ConVars. Although I've tried all that this exploit still has the ability to crash my server and re-crash it on restart.

Here is an example Logging on what this attack looks like -
http://pastebin.com/D9x6FR4A (too big for this post)

Now these bots rejoin over 1000 times in 1 second, they generate random characters, and when I ban an IP address it automatically switches over to a new one.

Not only this, but no steamids show up when the bots rejoin. (I have managed to catch a steamid or two but banning the steamid doesnt help) When the server restarts the bots automatically rejoin once again continually crashing the server.

(Yes I have added css anti-rejoin and other plugins the like) Please help me get this taken care of, I own some pretty popular servers and have run out of ideas on what to do.

If you need more information here is a KAC Log of the attack.
http://pastebin.com/vfmc8hMz

(Please also note that this exploit was created by HaloShadoW)

Re: Solve this Exploit Allied Modders
 

Re: Solve this Exploit Allied Modders
 

Here's is a dump of sm plugins list

30 "SourceMod Anti-Cheat" (0.7.3.0) by GoD-Tony, psychonic

(Please note these plugins are running and my server is still vulnerable)

31 "SMAC Client Protection" (0.7.3.0) by GoD-Tony, psychonic, Kigen
32 "SMAC CS:S Anti-Rejoin" (0.7.3.0) by Kigen

Re: Solve this Exploit Allied Modders
 

I have to ask, what is the value of your smac_antispam_connect cvar set to? (SMAC and KAC had this disabled by default)

This doesn't do what you think it does.

I may be wrong here but this doesn't look like the standard server log.

Re: Solve this Exploit Allied Modders
 

"smac_antispam_connect" = "1" min. 0.000000
- [smac_client.smx] Seconds to prevent someone from restablishing a connection. (0 = Disabled)

We have our own proprietary plugins for logging, for some reason this attack was not showing up in the normal sm command logs, although we were able to see it in console logs, but recently disabled -condebug because of creation of such large files. I can re-enable it, wait for another attack, and send you the console logs if you want.

Re: Solve this Exploit Allied Modders
 

honestly if my server keeps getting attacked I would be willing to let you have access to the server and try to patch this exploit. I have just run out of ideas.

Re: Solve this Exploit Allied Modders
 

How often is your server getting crashed this way?

That would really help determine if it's the same attack as the other thread or something different. Log the attack and get back to me with the file and I'll take a look.

Update to the latest version of SMAC (only need smac.zip and smac_client.smx), and delete your smac.cfg. I'd like to know if any connection spam bans are logged after the next attack.

Re: Solve this Exploit Allied Modders
 

Don't bother banning IP because in my logs they keep changing every so often. But the SteamIDs stay the same.

^here what I got don't know if same person but that's his steamid


EDIT:

Here's another from my other server

EDIT2:

And another:

Also these are a little old from 11/3/11 and up. I am not sure if I had anti connection spam loaded or if it even crashed the server at all.

Anyone who want to ban them type this into console:

Re: Solve this Exploit Allied Modders
 

Your log spam looks like the issue discussed over here. Especially with the SteamID and no crashes. Following the instructions there should help block it.

Re: Solve this Exploit Allied Modders
 

Yea I have since then. I don't see what is different about this guys issue though (except for the fact player steamids don't show, which could be a server side issue).