[jonnzus]

Originally Posted by jazz37 motd.txt chmod 500 ;)

Does it make motd.txt only readable?

[YamiKaitou]

500 is Read+Execute for the File Owner only

[The AlmIghTy]

please help, I am unable to scroll down or side ways in motd of any server I join

[YamiKaitou]

Originally Posted by The AlmIghTy please help, I am unable to scroll down or side ways in motd of any server I join

That's normal

[B3N4K]

I have same problem. It's not backdoor in any plugin because:
I have 3 servers. 2 of them are hacked, one is not. There is no plugin that is on both 2 hacked servers and isn't on 3rd (not hacked) server. They share all same plugins plus the two hacked have some mod plugins, each of them is different on every server. (So ti make it possible there would have to be at least 2 plugins with backdoor activated at the same time all around the world.)

I didn't ever gave anyone access to SSH or RCON. Never ever. My RCON is 20 random chars long (i don't use it so i made it complex) so it wasn't bruteforced. And also it's bullshit that this problem is because of someone having access to my server because many people from all around the world have this problem and i guess we don't have any friend in common who we all gave access to our servers to.

Here is my 3rd party plugins on 1st hacked server:

rpg_mod.amxx debug
xredirect-beta.amxx
one_name.amxx
galileo.amxx
resetscore.amxx
amx_ip.amxx
ultimate_chat.amxx
hlstatsx_commands_cstrike.amxx

And 2nd hacked server:

cs_prop_hunt.amxx
xredirect-beta.amxx
one_name.amxx
galileo.amxx
invisible_spectator.amxx
resetscore.amxx
amx_ip.amxx
ultimate_chat.amxx
hlstatsx_commands_cstrike.amxx

and 3rd NOT hacked server

ultimate_chat.amxx
amx_ip.amxx
galileo.amxx
invisible_spectator.amxx
one_name.amxx
resetscore.amxx
admin_freelook.amxx
ad_manager.amxx
ultimate_chat.amxx
peepingTom2.amxx
ptb.amxx
xredirect-beta.amxx
hlstatsx_commands_cstrike.amxx

As you can see there is NO plugin that both 2 first servers have and 3rd doesn't. So no backdoor.

Edit: Also can't be rcon because i have different rcon on every of these servers and it started happening at the same time. And there is simply no chance that they bruteforced 2 completely random and different 20 characters long rcon in the same moment.

Because of this i assume it's some new exploit.

[YamiKaitou]

Okay, so, have you tried the following steps?

1) Change any and all passwords related to file access for the server (ie, FTP, SSH, local access, etc)
2) Change the RCON password, or disable it if you do not use it
3) Disable Metamod


If after doing all 3 and it still happens, then maybe we will believe you.

[B3N4K]

I was asking for help not for trust..

1) Don't have FTP because i use SFTP (FTP over SSH), SSH is encrypted by RSA key so no chance anyone is getting there (and also there is different key, user and password for each server so again no chance anyone would bruteforce or whatever 2 in the same moment), there is no local access to the computer since it doesn't have even keyboard or monitor connected. It's server.
2) I did. Let's wait what happens now. (but again - it won't be rcon because every server has different rcon and there is simply no chance anyone bruteforced 2 rcons in the same moment)

So let's wait..

[jonnzus]

Originally Posted by B3N4K I was asking for help not for trust.. 1) Don't have FTP because i use SFTP (FTP over SSH), SSH is encrypted by RSA key so no chance anyone is getting there (and also there is different key, user and password for each server so again no chance anyone would bruteforce or whatever 2 in the same moment), there is no local access to the computer since it doesn't have even keyboard or monitor connected. It's server. 2) I did. Let's wait what happens now. (but again - it won't be rcon because every server has different rcon and there is simply no chance anyone bruteforced 2 rcons in the same moment) So let's wait..

Keylogger in your computer?
And does ur vps are in linux based system or windows?

[B3N4K]

No keylogger.. How could keylogger log my RSA key for gods sake? At least i know now where i WON'T get any useful help in the future about these things..

It really is new exploit. Source: http://forum.i3d.net/hlds-valve-linu...w-exploit.html

Fixed in last HLDS so i will just go update..

[Powerlord]

Originally Posted by B3N4K No keylogger.. How could keylogger log my RSA key for gods sake? At least i know now where i WON'T get any useful help in the future about these things..

Well, for one, if they managed to get a keylogger on your PC, they certainly have the ability to download arbitrary files from your PC such as your private key, then use a keylogger to get the password to said private key when you type it.