[tankkar]

Ok first i was informed by main admin of
|IC| UltimateZombie: Reloaded|100mbps Unrestricted|UltraFast D/L|Custom Skins|Ranked|64slot|66tick Issues
that i was attempting to run a explout to get admin
05/06/2010 - 179:02: Unexpected CVar Reply: Red (ID: STEAM_0:1:********** | IP: ***.***.***,**) replied with unexpected convar "SmAdminTakeover"
steamid/ip hidden for safety

i do not hack i never hacked in my life, i asked a few player in the server to see if they knew, that didnt help me much
i do map/skin/script. i do know my knowledge of scripts/exploits so i know what to stay away from
i do have custom skins and custom GUI that i made, nothing dangerous, i do have a few .cfg files that have common scripting in it.
that is actually good scripting ex* doing deathrun_tribute in one push of a key (not hacks, just tons of binds)

i Googled for this "SmAdminTakeover" it said the hack files are located in the cfg folder, so i checked there to see if something sus but no luck.
l i found a site where a guy had same prob as me, but he got banned, but his last post makes him looks sus by saying o well im uninstalling bye, and not even defending, so it not really evidence
http://www.ahpkicksass.com/e107_plug...5.0#post_91849

is there a kac or similar unknown bugs or maby others that have been banned from this?
i really don't want to be banned from severs from this..
pls post on ideas, or know common issues that may solve these probs

[Kevin_b_er]

You didn't quote the whole line, which is quite important. There's more text after 'replied with unexpected convar "convar"' that needs to be seen to know anything.

Source code that generates that line:
KAC_Log("Unexpected CVar Reply: %s (ID: %s | IP: %s) replied with unexpected convar \"%s\" (not expecting; result \"%s\") with value \"%s\".", f_sName, f_sAuthID, f_sIP, cvarName, g_sQueryResult[result], cvarValue);

Do you see the rest of the stuff? Yeah, where is it?

[Kigen]

That is a out-of-sync log reply which means nothing.

Unfortunately, there are a lot of admins that mis-interpret what KAC is logging. Cause remember, its in the Beta stage so it logs a lot of stuff.

That log means nothing.

This is what a valid detection looks like:

L 05/02/2010 - 19:52:51: Bad CVar return: NameHere (ID: STEAM_0:1:000000 | IP: 123.456.78.9) has convar "SmAdminTakeover" (value "", return Not valid) when it shouldn't exist.

[Sandfly]

Hey there Kigen, thanks for posting .. tankkar / Red is one of our players on |IC| UltimateZombie: Reloaded.

I truncated the message log to fit within our Forums code box parameters, but in their entirety, here are the logged action files. As discussed, they are the valid detection actions, straight from the KAC.log.

Running latest update on KAC 1.2.1 - checked with Master Database only 20 minutes ago - all updated.

All along, I have said that while I cannot for sure say if Red is executing these command lines that SMAdminTakeover require (a manual typing of that line in console with the relevant script exploit package), KAC is certainly detecting the presence of it from his point of origin, and is reporting it as such in those KAC log files, and a genuine SourceMod plugin will not execute such a line or have any need to in terms of gaining Admin in any server.

There's only one way that the phrase SMAdminTakeover even exists to my knowledge anyway, and that is through the net script exploit pack which contains both that and the ManiAdminTakeover exploits ... either way, it cannot be anything to do with genuine SourceMod plugins, or anything associated with allowable command line scripts in any CSS game that I am aware of.

Bottom line is that I wouldn't want him or any player detected, banned or kicked etc for something he is either not doing, or unaware he is doing. The offset to that, however, is that KAC cannot just generate a named detection out of thin air - not something as exploit-specific as SMAdminTakeover or ManiAdminTakeover etc.

Something must be causing it to report that as a valid detection in the KAC logfile & the only origin of those above script exploit lines is from a well known exploit pack - certainly as far as I am aware.

Either way, your clarification on this is much appreciated.

Cheers mate.

L 05/06/2010 - 17:07:28: Unexpected CVar Reply: Red (ID: STEAM_0:1******* | IP: *******) replied with unexpected convar "beetlesmod_version" (not expecting; result "Not found") with value "".
L 05/06/2010 - 17:35:44: Unexpected CVar Reply: Red (ID: STEAM_0:1******* | IP: *******) replied with unexpected convar "openscript_version" (not expecting; result "Not found") with value "".
L 05/06/2010 - 17:39:02: Unexpected CVar Reply: Red (ID: STEAM_0:1******* | IP: *******) replied with unexpected convar "SmAdminTakeover" (not expecting; result "Not found") with value "".


L 05/06/2010 - 17:58:11: Unexpected CVar Reply: Red (ID: STEAM_0:1******* | IP: 1*******) replied with unexpected convar "metamod_version" (not expecting; result "Not found") with value "".
L 05/06/2010 - 17:58:11: Unexpected CVar Reply: Red (ID: STEAM_0:1******* | IP: *******) replied with unexpected convar "metamod_version" (not expecting; result "Not found") with value "".
L 05/06/2010 - 17:58:11: Unexpected CVar Reply: Red (ID: STEAM_0:1******* | IP: *******) replied with unexpected convar "metamod_version" (not expecting; result "Not found") with value "".

[Kevin_b_er]

In all those cases the client replied unexpectedly with convar info. This happens a lot in KAC and probably could stand to be improved imo.

If "cvar1" and "cvar2" are both queried, there's a chance "cvar2" comes in before "cvar1". This can confuse KAC and it logs all those oddities.

What all of those are are replies to the convar query with the result "Not Found". So all of these results are normal that you just listed, since none of those cvars should exist, especially not smadmintakeover.

Hope this helps.

[Kigen]

None of those logs warrant bans.

KAC will auto-ban for anything that is worth of a ban.

Unexpected CVar replies is really like a bug with KAC rather than anything else. You shouldn't be banning people that KAC logs for that. KAC itself just logs it so that I know the problem exists. Actual cheaters are banned by KAC automatically so you don't have to look over logs.