Raised This Month: $ Target: $400
 0% 

D-FENS - Patch for upload/download server file exploit. (Updated 05-10-2010)


Post New Thread Reply   
 
Thread Tools Display Modes
eXDee
Member
Join Date: May 2009
Old 02-20-2010 , 00:42   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #221

We still got hit, repeatedly, even after having the following config:
-rcon in command line (not in server.cfg)
-server.cfg renamed)
-dfens
-rconlock
-kac
-Uninstalled eventscripts/estools
They could still simply retreive the rcon password or any file on the server. And yes dfens was loaded, it didnt log any kind of files being retreived related to it either (not that it matters, rcon was in command line)
We checked FTP logs with the game provider. Nothing.
In the end we've reloaded the server, possibly some kind of rootkit installed (even though we checked everywhere).

Any idea at ALL how someone can get the rcon password when the only way to see it is through gamepanel in the commandline? (which they definitely arent using)
eXDee is offline
rambomst
SourceMod Donor
Join Date: Nov 2009
Location: Sydney, Australia
Old 02-20-2010 , 01:01   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #222

eXDee! Your sI Aye I am TG's Tech anyway when installing D-FENS did you remember to edit the .vdf and add the correct location for the .dll?
__________________
rambomst is offline
Allstar
Junior Member
Join Date: Feb 2009
Old 02-22-2010 , 08:48   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #223

eXDee are you using sourcebans?

We recently had a problem on all our servers where a rogue hacker messed up a good bunch of our stuff by gaining the rcon passwords through the sb.

We think the problem was even though we ran the updater to go to the latest 1.4.6 some bits didn't update properly so we had a mix of old (in some cases very old 1.4.2) and new files. Annoyingly in most places it was showing it as 1.4.6 so we didn't figure this out until it was too late!

Since we've verified the update we ('knock on wood') haven't had any problems yet.
Allstar is offline
noodleboy347
AlliedModders Donor
Join Date: Mar 2009
Old 02-23-2010 , 23:41   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #224

Apologies if this has been asked/explained before, but how do I load this on Linux? What should be in the vdf?
noodleboy347 is offline
lekzero
Member
Join Date: Jul 2009
Old 02-24-2010 , 15:44   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #225

Are you the root from the server? If yes, maybe itīs madness but check for problems in your own PC.

Quote:
Originally Posted by eXDee View Post
We still got hit, repeatedly, even after having the following config:
-rcon in command line (not in server.cfg)
-server.cfg renamed)
-dfens
-rconlock
-kac
-Uninstalled eventscripts/estools
They could still simply retreive the rcon password or any file on the server. And yes dfens was loaded, it didnt log any kind of files being retreived related to it either (not that it matters, rcon was in command line)
We checked FTP logs with the game provider. Nothing.
In the end we've reloaded the server, possibly some kind of rootkit installed (even though we checked everywhere).

Any idea at ALL how someone can get the rcon password when the only way to see it is through gamepanel in the commandline? (which they definitely arent using)
lekzero is offline
Allstar
Junior Member
Join Date: Feb 2009
Old 02-26-2010 , 08:47   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #226

Quote:
Originally Posted by noodleboy347 View Post
Apologies if this has been asked/explained before, but how do I load this on Linux? What should be in the vdf?
I've only installed this on Windows but I'd guess this is the procedure:

Follow this link and download the binaries to your addons folder: linux binaries

Modifying your vdf depends on what you're running on the server:

add: dfens_mm_i486_l4d.so (If you're running L4D)
add: dfens_mm_i486_ob.so (If you're running Orange Box, TF2 etc)
add: dfens_mm_i486_og.so (If you're running anything else, CSS etc)

Hopefully that should work.
Allstar is offline
empmdk
Junior Member
Join Date: Mar 2010
Old 03-06-2010 , 23:48   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #227

In my log I get the following:
Code:
[META] Failed to load plugin addons/D-FENS/bin/dfens_mm_i486_og: File not found
This is for CSS and have it pointed to the dfens_mm_i486_og_i486.so file
empmdk is offline
Allstar
Junior Member
Join Date: Feb 2009
Old 03-07-2010 , 06:48   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #228

Quote:
Originally Posted by empmdk View Post
In my log I get the following:
Code:
[META] Failed to load plugin addons/D-FENS/bin/dfens_mm_i486_og: File not found
This is for CSS and have it pointed to the dfens_mm_i486_og_i486.so file
Are you pointing it at this: dfens_mm_i486_og_i486.so or this: dfens_mm_i486_og.so?

It should be: dfens_mm_i486_og.so

Also you should check the install path, the linux binaries don't include all the addons sub-directorys by default. Do you have a D-FENS folder in your addons directory?
Allstar is offline
empmdk
Junior Member
Join Date: Mar 2010
Old 03-07-2010 , 09:06   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #229

Quote:
Originally Posted by Allstar View Post
Are you pointing it at this: dfens_mm_i486_og_i486.so or this: dfens_mm_i486_og.so?

It should be: dfens_mm_i486_og.so

Also you should check the install path, the linux binaries don't include all the addons sub-directorys by default. Do you have a D-FENS folder in your addons directory?
Its going to "dfens_mm_i486_og.so". I do have a D-FENS folder in addons with the Linux binaries in the bin folder.

The D-FENS.vdf inside metamod has the following:
Code:
"Metamod Plugin"
{
	"alias"		"D-FENS"
	"file"		"addons/D-FENS/bin/"
}
empmdk is offline
Allstar
Junior Member
Join Date: Feb 2009
Old 03-07-2010 , 10:23   Re: D-FENS - Patch for upload/download server file exploit. (Updated 11-29-2009)
Reply With Quote #230

You need to have the vdf point towards the file.

So edit your vdf like this:

Code:
"Metamod Plugin"
{
    "alias"        "D-FENS"
    "file"        "addons/D-FENS/bin/dfens_mm_i486_og.so"
}
Allstar is offline
Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 19:22.


Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Theme made by Freecode