[.:cs.stambeto:.]

Can you tell me some solution of this new exploit because I can not see my console server from the flood.

rcon 1430000571 "2446" echo XBrute by ZeaL L 06/24/2013 - 20:18:44: Bad Rcon: "rcon 1430000571 "2446" echo XBrute by ZeaL" from "194.44.115.184:27005" Bad rcon_password. No password set for this server. Bad Rcon from 79.112.153.19:27006: rcon 1868345902 "24452445" echo XBrute by ZeaL L 06/24/2013 - 20:18:49: Bad Rcon: "rcon 1868345902 "24452445" echo XBrute by Ze aL" from "79.112.153.19:27006" Bad rcon_password. No password set for this server. Bad Rcon from 178.89.63.219:27007: rcon 306058196 "24312431" echo XBrute by ZeaL L 06/24/2013 - 20:18:55: Bad Rcon: "rcon 306058196 "24312431" echo XBrute by Zea L" from "178.89.63.219:27007" Bad rcon_password. No password set for this server. Bad Rcon from 178.172.242.26:27006: rcon 660417837 "24462446" echo XBrute by ZeaL L 06/24/2013 - 20:19:06: Bad Rcon: "rcon 660417837 "24462446" echo XBrute by Zea L" from "178.172.242.26:27006" Bad rcon_password. No password set for this server. Bad Rcon from 46.247.232.37:27010: rcon 581538785 "24422442" echo XBrute by ZeaL L 06/24/2013 - 20:19:14: Bad Rcon: "rcon 581538785 "24422442" echo XBrute by Zea L" from "46.247.232.37:27010" Bad rcon_password. No password set for this server. Bad Rcon from 80.80.193.121:27006: rcon 429559347 "244244244" echo XBrute by ZeaL L 06/24/2013 - 20:19:17: Bad Rcon: "rcon 429559347 "244244244" echo XBrute by Ze aL" from "80.80.193.121:27006" Bad rcon_password. No password set for this server. Bad Rcon from 86.122.39.35:27006: rcon 1749029682 "2447" echo XBrute by ZeaL L 06/24/2013 - 20:190: Bad Rcon: "rcon 1749029682 "2447" echo XBrute by ZeaL" from "86.122.39.35:27006" Bad rcon_password. No password set for this server. Bad Rcon from 94.242.23.26:27006: rcon 1912807624 "2445" echo XBrute by ZeaL L 06/24/2013 - 20:190: Bad Rcon: "rcon 1912807624 "2445" echo XBrute by ZeaL" from "94.242.23.26:27006" Bad rcon_password. No password set for this server.

[^SmileY]

It is curious about same exploit for various servers and different IPS for each test of rcon??
The rcon is not a problem, but the exploit..

And it detecting various ips ports?

[yokomo]

Last HLDS update have an exploit :S, with 1 command you can crash the server ( only using last HLDS update )

Any proof of what are you saying above? with 1 command, that is cool. "rcon quit".

Ya same to me, it's hard to ban this exploit since it comes with many ips, how the hell it can change ip so fast. It's true not worry about this since the random password is stupid, but i hate the spams in server console.. Valve need to block this shit.

[YamiKaitou]

Originally Posted by yokomo how the hell it can change ip so fast

Probably all spoofed IPs

[Kia]

I remember a plugin which prevents that flooding, but I don't remember it's name.
Disabling the rcon won't help as you will get this messages anyway.

[XpoHuk]

Originally Posted by Kia I remember a plugin which prevents that flooding, but I don't remember it's name. Disabling the rcon won't help as you will get this messages anyway.

anti_hlbrute_v1.1

[DC32]

Alright, thanks guys

btw, a little off-topic thing, where can i learn AMXX coding?

[Kia]

AlliedMods

[seriousspot]

again new info about exploit, the infected .exe infects users - infected users controlled by zeal(center) they attacking random servers that listed on various masterlists, i guess this is what i call botnet, tested myself on vmware

[Kia]

i guess this is what i call botnet

Correct. The other people (called slaves) have a RAT (Remote Administration Tool) installed which is controlled by one person.