AlliedModders

AlliedModders (https://forums.alliedmods.net/index.php)
-   SourceMod Anti-Cheat (https://forums.alliedmods.net/forumdisplay.php?f=133)
-   -   SMAC by-pass hack? (https://forums.alliedmods.net/showthread.php?t=293984)

WebNoob 02-16-2017 15:52
SMAC by-pass hack?
 
Just had the following play on our server:

http://steamcommunity.com/id/suckmygoddamnpenis/

For some reason, we were not able to ban him, and he was using the name " SourceMod Anit-Cheat bypass".

I was able to go and ban him manually via web, but this was really strange.

EDIT: I should also note that his Steam ID was being repoted by the system as:

"STEAM_ID_STOP_IGNORING_RETVALS"

WebNoob 02-16-2017 16:15
Re: SMAC by-pass hack?
 
Added:

Saw this in the SM log after we kicked him from the server (again, we were unable to ban):

L 02/16/2017 - 15:47:15: [basecommands.smx] "XXXXXX<105><[U:1:XXXXXXX]><>" kicked "SourceMod Anit-Cheat bypass<103><STEAM_ID_PENDING><>" (reason "")

Note: These are all VAC-secured servers, etc....so somehow he is able to join/block his Steam ID from appearing in the system? (If so, why doesn't the system prevent him from joining a VAC server to begin with?)

DarkDeviL 02-16-2017 16:16
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by WebNoob (Post 2495959)
EDIT: I should also note that his Steam ID was being repoted by the system as:

"STEAM_ID_STOP_IGNORING_RETVALS"
You are using plugins that aren't doing their "Steam ID" checks properly. In other words, plugins created by lazy people.

Searching for the string that you posted above (either Google or forum search) should give you a better perspective on that issue.

WebNoob 02-16-2017 16:39
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by arne1288 (Post 2495970)
You are using plugins that aren't doing their "Steam ID" checks properly. In other words, plugins created by lazy people.

Searching for the string that you posted above (either Google or forum search) should give you a better perspective on that issue.
So, I guess that includes Sourcebans 1.4.11 - since that plugin is the one we use to ban, and it would not ban that player (?)

DarkDeviL 02-16-2017 18:48
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by WebNoob (Post 2495974)
So, I guess that includes Sourcebans 1.4.11 - since that plugin is the one we use to ban, and it would not ban that player (?)
It is quite old, so without looking into if that had the right things or not - it might also be doing it.

The plugin causing the output of the place where you see "STEAM_ID_STOP_IGNORING_RETVALS" is falling into the category above.


In previous SM versions, you could do like:

Code:
GetClientAuthString(client, steamID, sizeof(steamID));
and in newer:

Code:
GetClientAuthId(client, AuthId_Steam2, steamID, sizeof(steamID))
Both GetClientAuthString and GetClientAuthId have been returning the "true" boolean for a long while to indicate it retrieved a valid Steam ID, and the "false" boolean to indicate that it didn't retrieve a proper Steam ID.

It has been quite common for not just a few - but many "lazy" people to do code like:

Code:
[...]
GetClientAuthId(client, AuthId_Steam2, steamID, sizeof(steamID));
[...]
PrintToChat(client, "Hi %N. Your Steam ID is: %s", steamID);
This basically means you are requesting some data, you don't really care what you get in return, and then try to use it for your purpose anyway.

If you do that, you might end up on seeing "STEAM_ID_STOP_IGNORING_RETVALS" as Steam ID on recent versions of SourceMod.

You should do like:

Code:
[...]
if (GetClientAuthId(client, AuthId_Steam2, steamID, sizeof(steamID))) {
    [...]
    PrintToChat(client, "Hi %N. Your Steam ID is: %s", steamID);
}
This way you will only do things with the Steam ID if GetClientAuthId returns "true: I have a valid Steam ID".

SourceBans 1.4.11 does seem to use the old way, however, the latest code on GitHub seem to be using a mix of checking the return value and not checking the return value around the code.

beetlejuice 03-08-2017 12:40
Re: SMAC by-pass hack?
 
New guy

"STEAM_ID_STOP_IGNORING_RETVALS"

http://steamcommunity.com/id/poon_destroyer/

I dont think it is him at all, just using someone elses steam_id

Btw hacker had connect bot too, autoreconnecting and also coming from different countries at same time.

This is a new hack i guess and should be looked into.

sneaK 03-08-2017 12:51
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by beetlejuice (Post 2501849)
New guy

"STEAM_ID_STOP_IGNORING_RETVALS"

http://steamcommunity.com/id/poon_destroyer/

I dont think it is him at all, just using someone elses steam_id

Btw hacker had connect bot too, autoreconnecting and also coming from different countries at same time.

This is a new hack i guess and should be looked into.
Ensure you are running the latest available version of SM, and its base plugins (important). Shouldn't have this issue on a legitimate Steam-connected game server.

beetlejuice 03-08-2017 14:19
Re: SMAC by-pass hack?
 
smac_validate_auth "0"

^^ I had this set to 0

And i run classic Steam servers , not non-steam.

I changed it to smac_validate_auth "1" now and lets see.

But he was coming from different countries too and yelling on my admins "you cant do shit you faggots, i rule here"

PS. I never had this happen before and my mods retreive steam_id properly...i checked.

pubhero 03-13-2017 15:35
Re: SMAC by-pass hack?
 
Hi.
What game? And what part from the SMAC bypassed that player?
If CS:S and autotrigger bypass, the solution are very easy.
If you running a normal server (not surf, not zombie) you can setting these values in your server.cfg and the speedhack, bunny hop will be ended. :D
If he try using that shit, you will see. Thats all.

sv_enablebunnyhopping 0
sv_airaccelerate 1
sv_max_usercmd_future_ticks 1

bobotov 09-27-2017 21:22
Re: SMAC by-pass hack?
 
Aww man. I really hate to bump threads like this, but since it's on the first page, I may as well.

I was that guy in the OP, /id/suckmygoddamnpenis/

It's really simple, really. Set your steam to offline mode and join a community server via connect [ip here] in console

No one can ban you, and I'm pretty sure the server I was on was neonheights.

This exploit has apparently been around for 4 years? It works on tf2, but not on csgo.

Mitchell 09-28-2017 09:57
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by arne1288 (Post 2495970)
You are using plugins that aren't doing their "Steam ID" checks properly. In other words, plugins created by lazy people.
Sounds like a pain in the ass to guard against.
What should the plugins do, kick players that don't validate?
Can this method ever return "STEAM_ID_STOP_IGNORING_RETVALS" after the player has already connected and has previously stored his steamid?
Some gameplay factors require retrieving the steamid, so should we continuously keep trying to get the player's steamid and force them in spectator until it returns true?
I have never really encountered this but if it were to happen i'd rather just kick the player then trying to figure out a way to retrieve player stats after they have already been playing for a given period of time.
Any other documentation when this will be returned?

bobotov 09-28-2017 17:32
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by Mitchell (Post 2551282)
Any other documentation when this will be returned?
When I decide to do it again.

TheXeon 09-28-2017 18:52
Re: SMAC by-pass hack?
 
Had a fun run-in with ya @bobotov. The whole time I was trying to block the IP through ufw or IPTables, that didn't work for whatever reason.

I feel like Sourcebans++'s SourceSleuth should have done a bit of checking (since sm_banip does work and your IP was correctly added to the DB) and at least kicked. addip from the server console didn't work, that might just be me rusty with it though.

EDIT: The whole time it was STEAM_ID_STOP_IGNORING_RETVALS. I feel like trying to get people's auth every few seconds might be a bit much, thing below is proof-of-concept and working(?)

EDIT 2: THIS DOESNT WORK, USE https://forums.alliedmods.net/showpo...2&postcount=25

bobotov 09-28-2017 19:14
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by TheXeon (Post 2551357)
Had a fun run-in with ya @bobotov. The whole time I was trying to block the IP through ufw or IPTables, that didn't work for whatever reason.

I feel like Sourcebans++'s SourceSleuth should have done a bit of checking (since sm_banip does work and your IP was correctly added to the DB) and at least kicked. addip from the server console didn't work, that might just be me rusty with it though.
Was the server I was on Wonderland?

And hi. :D

TheXeon 09-28-2017 19:24
Re: SMAC by-pass hack?
 
Care to help me test out the pseudofix? No, you weren't on Wonderland XD

bobotov 09-28-2017 19:26
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by TheXeon (Post 2551361)
Care to help me test out the pseudofix? No, you weren't on Wonderland XD
Yea sure. Give me the ip.

TheXeon 09-28-2017 19:30
Re: SMAC by-pass hack?
 
~sig or url on proof-of-concept?

bobotov 09-28-2017 19:35
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by TheXeon (Post 2551363)
~sig or url on proof-of-concept?
What do you mean?

TheXeon 09-28-2017 19:37
Re: SMAC by-pass hack?
 
IP: neogenesisnetwork.net or 104.153.106.174, guess my signature isn't showing up.

bobotov 09-28-2017 19:38
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by TheXeon (Post 2551366)
IP: neogenesisnetwork.net or 104.153.106.174, guess my signature isn't showing up.
Huh. It's not letting me connect. This tends to happen sometimes while I'm doing this method. Let me restart stuff and try again.

TheXeon 09-28-2017 19:42
Re: SMAC by-pass hack?
 
Don't tell me ufw and iptables feel like working now ://////

bobotov 09-28-2017 19:44
Re: SMAC by-pass hack?
 
Connected.

bobotov 09-28-2017 19:52
Re: SMAC by-pass hack?
 
We had a talk and he tested some stuff on me.

Looks like it ain't working. The only servers who have been able to successfully ban me was Team Cream servers.

That was long ago, though.

Edit: I tested on them again. They were able to ban me.

bobotov 09-29-2017 01:10
Re: SMAC by-pass hack?
 
Ok so this also works on skial

When I trigger an SMAC ban on myself, the sourcebans page shows

STEAM_ID_STOP_IGNORING_RETVALS

STEAM_0:0:0

76561197960265728 <---- profile link, but it leads to nothing



https://puu.sh/xLy18/a5ddcc561f.png

Oh, and I can still join their other servers. I believe after a while I can join the one I was banned from.

Admins also try to manually ban me from the server via the Sourcebans page, but it doesn't do crap because I have no steamid in the server!

TheXeon 09-29-2017 01:31
Re: SMAC by-pass hack?
 
EDIT 2018-04-12:
This hack of a method has been fixed and optimized, integrated into an auto-updating central plugin:
Source
Download Link
Spoiler

TheXeon 09-29-2017 03:29
Re: SMAC by-pass hack?
 
The weird thing is, and I guess this is expected behavior, but Connect can get the SteamIDs just fine. I guess now we just need to figure out a way to force it on a client or something, iunno. An extension or native that would force IDs would fix a bunch of other problems too.

DarkDeviL 09-29-2017 10:51
Re: SMAC by-pass hack?
 
If
Code:
GetClientAuthId(client, AuthId_Steam2, auth, sizeof(auth)
returns FALSE, then
Code:
IsAuthorized(client);
should return FALSE too according to my experiments in the past, though that was with CS:S.

If GetClientAuthId returns FALSE, and you're still using the contents of "auth", that is when when you're getting "STEAM_ID_STOP_IGNORING_RETVALS", it should not be returning TRUE at the same time as providing "STEAM_ID_STOP_IGNORING_RETVALS".

Even the very old GetClientAuthString, says the same as the newer GetClientAuthId:

Code:
Return:
True on success, false otherwise.
&&

Code:
Return Value

True on success, false otherwise.

Many years ago, I started out with some plugins here from AM, then I changed to my own plugins, and/or re-built them to suit my needs better.

Many of them was using like the above example I made in POST #5.

I ended up on having a lot of issues, sometimes with empty or invalid Steam ID's, and when I finally saw the documentaiton, I found that the plugins wasn't doing things according to the API (checking TRUE vs FALSE return value)

I then changed things from:

Code:
GetClientAuthString(client, SteamID, sizeof(SteamID));
PrintToChat(client, "Your Steam ID is: %s", SteamID);
to

Code:
new bool:bSteam32 = GetClientAuthString(client, SteamID, sizeof(SteamID));
if (bSteam32) {
  /* Do whatever I wanted to do with SteamID here */
  PrintToChat(client, "Your Steam ID is: %s", SteamID);
} else {
  LogError("Something failed here ... bla bla bla");
  PrintToChat(client, "Something went wrong when looking up your Steam ID, sorry.");
}
Since then, there was NEVER any problems retrieving the correct Steam ID any more on those third party plugins after they were re-built this way.

I don't intend to be rude, but for plugin creators, the thing is very simple - make sure to follow the documentation 100%. That worked for me when creating my plugins, as well as when fixing broken plugins created by others.

For the above "temp fix", I would rather suggest kicking people, like SMAC does, if the player hasn't validated within like 15, 30, 45 or 60 seconds - depending on what you prefer. 15 seconds should usually be enough, unless the Steam network is down.

OnClientPostAdminCheck will never be called, if Steam network is down (or STEAM_ID_PENDING / STEAM_ID_STOP_IGNORING_RETVALS), and therefore I usually suggest using that one for "on-connect" things when you need to know who they really are.

bobotov 09-29-2017 13:42
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by TheXeon (Post 2551402)
Made another "temp-fix". Invoked the glitch on myself and tried it. Below are some relevant lines that were the only thing that seemed to work.

Code:
if (!GetClientAuthId(client, AuthId_Steam2, auth, sizeof(auth)) || StrContains("STEAM_ID_STOP_IGNORING_RETVALS", auth, false) != -1) // Had to check for both
And attached is what I ended up with.

Code:
Spoiler
Look nice. Wanna test today?

TheXeon 09-29-2017 13:46
Re: SMAC by-pass hack?
 
Makes sense. Just did a bit of checking with below:

Spoiler

and it seemed to reach 3 consecutively. Do you know if downned Steam servers might trip up GetClientAuthId? If it does, then would kicking also false-positive?

TheXeon 09-29-2017 13:48
Re: SMAC by-pass hack?
 
Go for it. It's been live and worked for me all last night. I just am really unsure about false-positives if Steam servers are down.

bobotov 09-29-2017 14:23
Re: SMAC by-pass hack?
 
Quote:
Originally Posted by TheXeon (Post 2551535)
Go for it. It's been live and worked for me all last night. I just am really unsure about false-positives if Steam servers are down.
Yep. It works. I get kicked with this message

Disconnect: Your client has failed to authorize in time. Please reconnect or restart your game.

:D

Now I'm starting to get bored of this for now. I'll do this again when I feel like it. You should release the plugin you made.


All times are GMT -4. The time now is 08:41.

Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.