Private server all weapons unlock inclusive special forces

[Moke]

Re: Private server all weapons unlock inclusive special forces

Yes. It works....

It doesnt matter if you have SF installed or not, and it doenst matter if you have done the "account trick" or not...

ALL guns are availeble... All normal BF2 unlocks and all SF unlocks (those availeble in BF2 servers offcourse)

You can see for yourself

Yadworld (In Denmark)
IP : 195.184.104.99:16567


EDIT : Its an unranked server, if anybody where in doubt.

[CaptJordus]

Re: Private server all weapons unlock inclusive special forces

I seriously would not trust that information.

Nor would I.

This opens up dude and his server with IP information for everyone playing on that server.

and a convenient WIDE OPEN Front door of Port 16567.

[Moke]

Re: Private server all weapons unlock inclusive special forces

Nor would I.

This opens up dude and his server with IP information for everyone playing on that server.

and a convenient WIDE OPEN Front door of Port 16567.

Im sorry... I dont get it....

Its not excactly hard to find IP and port of a BF2 server.... Any server open, will also have the port open (and the BF2 exe file waiting in the other end)

Im far from a security expert.. so plz explain it to me..thnxs

[Vorticity]

Re: Private server all weapons unlock inclusive special forces

Hey, long time lurker, first time poster. I run a private BF1942/BF2 server, and I can't see how Haldi's instructions are any different for those of us running redirects to other servers (or to our own servers.) All his directions do is point the game client to a different stats server, and all the different stats server can do is print different weapon unlock values. You can see how the scripts work here: http://bf2.fun-o-matic.org/index.php...getunlocksinfo

This wouldn't remotely be a security issue - if Haldi's server tried to do anything other than serve up unlocks, you'd know because BF2 would barf trying to load the unlocks, or at worst, not unlock anything. Haven't tried it yet, but it sounds like somebody's connected to his server, and it unlocked stuff, so it's not a security issue.

That being said, I run my own redirect to my server, and yeah, Haldi, I'd like to see the modifications to the script, so I can modify mine. Can you post the .aspx?

[Moke]

Re: Private server all weapons unlock inclusive special forces

This wouldn't remotely be a security issue - if Haldi's server tried to do anything other than serve up unlocks, you'd know because BF2 would barf trying to load the unlocks, or at worst, not unlock anything. Haven't tried it yet, but it sounds like somebody's connected to his server, and it unlocked stuff, so it's not a security issue.

This I what I thought too.... but not having much knowledge about IT secutiy, I appriciate you verifying :)

[thehed]

Re: Private server all weapons unlock inclusive special forces

Hmmm
I don't find the Thread at the moment, but this script is from her:
#!/usr/bin/perl

my @ids=qw/11 22 33 44 55 66 77/;

sub main();
sub main() {
my $time=time;

print "Content-type: text/plain\n\n";
print "O\n";
print "H\tpid\tnick\tasof\n";
print "D\t12345678\tUNLOCKED\t$time\n";
print "H\tenlisted\tofficer\n";
print "D\t0\t0\n";
print "H\tid\tstate\n";
for (@ids) {
print "D\t$_\ts\n";
}
print "\$\t103\t\$\n";
}

main();

That's the old one, it answer on 11 with n on 22 with n on 33 with .....so on to 77. If i go to http://www.bat-clan.be/bf2urltester.php and test this string:
http://bf2web.gamespy.com/ASP/getawa...x?pid=43512059 (<---this is my pid number i have the most sf weapons free) then i becom this answer.
0.1 1134132539
H id kit name descr
D 11 0 Chsht_protecta Protecta shotgun with slugs
D 22 1 Usrif_g3a3 H&K G3
D 33 2 USSHT_Jackhammer Jackhammer shotgun
D 44 3 Usrif_sa80 SA-80
D 55 4 Usrif_g36c G36C
D 66 5 RULMG_PKM PKM
D 77 6 USSNI_M95_Barret Barret M82A2 (.50 cal rifle)
D 88 1 sasrif_fn2000 FN2000
D 99 2 sasrif_mp7 MP-7
D 111 3 sasrif_g36e G36E
D 222 4 usrif_fnscarl FN SCAR - L
D 333 5 sasrif_mg36 MG36
$

The counter goes not only to 77, it goes to 333 (maybe to 555?)

I think i change the first line from my @ids=qw/11 22 33 44 55 66 77/ to my @ids=qw/11 22 33 44 55 66 77 88 99 111 222 333/

Cant try it at the moment (@Work), but i am sure this is not all. I do not understand Perlscripts. Any help??

P.s Yes my english is horrible.

[18Zulukiller]

Re: Private server all weapons unlock inclusive special forces

Yes. It works....

It doesnt matter if you have SF installed or not, and it doenst matter if you have done the "account trick" or not...

ALL guns are availeble... All normal BF2 unlocks and all SF unlocks (those availeble in BF2 servers offcourse)

You can see for yourself

Yadworld (In Denmark)
IP : 195.184.104.99:16567


EDIT : Its an unranked server, if anybody where in doubt.

I joined that server today and actually got to try out all the unlocks and im very greatfull i got the chance to. The SF engineers unlock is a massive improvement on both shotguns wow.

[HALDi]

Re: Private server all weapons unlock inclusive special forces

Tehed, you're absolutely right. You can take the well known perl script and change that line to @ids=qw/11 22 33 44 55 66 77 88 99 111 222 333/ - that will work, but don't forget that also the last line is different. it has to be changed to print "\$\t115\t\$\n"
Anyone who doesn't want to do the work of perl hosting and programming, feel free to use my server as mentioned in the beginning of this thread.

[Steven_lp]

Re: Private server all weapons unlock inclusive special forces

The Tactical Gamer server (unranked) is running with all the weapons unlocked, including SF weapons. Its a fantastic place to play anyway (especially if you're into real teamwork, like BF2 is supposed to be played!), but having access to all the weapons really helps when deciding your next unlock! Details:

http://www.tacticalgamer.com/

Battlefield 2 #1 (64 Player) +70.86.19.218
Battlefield 2 #2 (48 Player) +67.19.26.150

[thehed]

Re: Private server all weapons unlock inclusive special forces

Tbut don't forget that also the last line is different. it has to be changed to print "\$\t115\t\$\n"
Anyone who doesn't want to do the work of perl hosting and programming, feel free to use my server as mentioned in the beginning of this thread.

Thank you. I will try it.

[CaptJordus]

Re: Private server all weapons unlock inclusive special forces

Im sorry... I dont get it....

Its not excactly hard to find IP and port of a BF2 server.... Any server open, will also have the port open (and the BF2 exe file waiting in the other end)

Im far from a security expert.. so plz explain it to me..thnxs

Not the IP of the SERVER, the IP of EVERY player on that server.

It would take some custom scripting and some pretty good knowledge of web scripts, but its possible.

Also, on the ports, when you run bf2.exe you have 16567 open for BF2 to send/recieve incoming TCP traffic, which means if he his running a malicious script on his server, PLUS gets YOUR personal IP information...he can start running malicious commands through port 16567 and bf2.exe.

make sense?


Granted, the guy probably is legitimate and wouldn't try to hurt anyones stuff. It would also take a degree of talent and knowledge to manipulate through bf2.exe, but its def. posssible.

[Vorticity]

Re: Private server all weapons unlock inclusive special forces

Also, on the ports, when you run bf2.exe you have 16567 open for BF2 to send/recieve incoming TCP traffic, which means if he his running a malicious script on his server, PLUS gets YOUR personal IP information...he can start running malicious commands through port 16567 and bf2.exe.

Well, no, that's not how it works at all. Here's how the connect runs - let's say you were playing on my server...

1.) You connect to my server. Your BF2 client sends your PID information so my server can look you up and decide which weapons to unlock.

2.) My server goes to bf2web.gamespy.com with your PID information. If my /etc/hosts file points bf2web.gamespy.com to Haldi's server, the server goes there instead of the real bf2web.gamespy.com. Haldi's server gets *my* IP address, and your PID. The worst thing Haldi gets from you is your PID, which he could get on the forum anyways. :) Haldi *does* get my server's IP address, and could do something like portscan me, but that would trigger my alarms, and I'd go medieval on his ass.

3.) Haldi's server does one of the following: it produces a perfect spoof of the output that the .aspx file that the *real* bf2web.gamespy.com produces, or it doesn't. If Haldi is trying to do something tricky, what will happen is this: my server will ignore it. I've done the packet analysis looking at these spoofed connections (I spoof mine locally)- the *only* thing that my server is looking for is the correctly formatted text file. If Haldi can somehow feed my server the correct information while simultaneously launching an attack, he's gonna have to do it on the return port opened by my initial connection to his box on port 80, and that port (opened by the server) is only listening for the aforementioned formatted text.

If Haldi tries to open another port on my server, he's going to bonk his head on my firewall. If under any circumstance Haldi fails to give me the correctly formatted unlock info, my server will ignore the unlock directive, no unlocks will be performed, and I'll know that something's up. If Haldi can hack his way around all these barriers, then he's like a tiny god, and he could pwn my box even without my permission, and wouldn't be trolling around BF2 forums looking for suckers. :)

At no point does your client .exe ever get involved - it's strictly server-to-server chat at this stage.

4.) My server disconnects from the remote server, and admits your client into the game, unlocking the appropriate weapons. You then enter my server with your uber-weapons that I don't have since I hate playing in pubs, and smear me all over the walls of my own ^@#^%$@^% server.

I hope that explains how the deal works. I haven't had a chance to try out Haldi's server yet, but if I do, I'll do a packet analysis on my side and post results. Odds are, this is all on the up-and-up, though.

cheers,

[CaptJordus]

Re: Private server all weapons unlock inclusive special forces

Well like i said, he would have to manipulate the scripts in order to mess with anything.

But he still could access each remote PC through the other server, being that each PC makes a connection with the game server, and that IP info could be scanned and logged fairly easily.

I wouldnt have figured that EA would have scriptd the servers to only accpet the text response its waiting on, because they sure screw up every other peice of code.

A buffer overflow of response might work, unless they actually scripted against that as well.

Its hard to beleive DICE actually can script security measures when they cant even get the basics of the game right. :laugh:

[Vorticity]

Re: Private server all weapons unlock inclusive special forces

But he still could access each remote PC through the other server, being that each PC makes a connection with the game server, and that IP info could be scanned and logged fairly easily.

I don't think that's ever been demonstrated. Client machines connect *only* to the game server and to EA to verify their CD id. Unless you change your hosts file, you'd never connect to Haldi's server. Haldi's server has only a single port connection to my machine, and the only thing listening on that port is the server looking for the unlock info. Attempting a buffer overrun on that port could crash the server (which I'd immediately know about), and perhaps give Haldi access to the server with the uid of the server, which on my box, is user nobody. I also run the server in a chroot jail, so he'd have no access to the system anyways.

And portscans only tell you what ports on the target machine are listening, not what connections are active. He'd need to gain user access on my box to get a list of IPs that are connected, which he wouldn't be able to do without crashing my server. And anyways, knowing your IP just means he can try other attacks against you later - attempting to attack you through your active BF2 port (which isn't 16567 - that's the server's port, not the client's, and it uses UDP, not TCP/IP) would crash your BF2 client, and you'd know about it. And presumably, you have some kind of firewall protection up at your IP address, either through Windows firewall or through your router, so he'd have to hack through that.

Look, it's just a server port forward - the only person who's likely to be attacked is the server, not any of the connected clients.

I wouldnt have figured that EA would have scriptd the servers to only accpet the text response its waiting on, because they sure screw up every other peice of code.

As anybody who's tried to write their own unlock script will tell you, that's *exactly* what EA has done. My theory is this: they spent *so* much time locking out weapons to gamers that don't want to suck at the teat of EA that they didn't have any time left over to make the game work properly. Security on the server- and client-side are, so far at least, pretty solid - too bad about the buggy-ass game. :)

A buffer overflow of response might work, unless they actually scripted against that as well.

It's pretty easy to code against buffer overflows, Microsoft's multiple failures notwithstanding. But any buffer exploit would have adverse affects that would be immediately noticed by any server admin worth their salt.

Its hard to beleive DICE actually can script security measures when they cant even get the basics of the game right. :laugh:

Well, you got a point *there*. :)

[HALDi]

Re: Private server all weapons unlock inclusive special forces

Thanks Vorticity... I had fun reading your post and I have to say you're right. I find this discussion somehow amusing and I think it's neverending, so I would just like to add the following:
1. If someone has any doubts and thinks he's taking any risk by doing this, he does not have to do it. Who wants uses it and the other don't have to. for the players i have to say, they really don't have to change anything on their pc... this affects the game servers only and if you connect to any bf2 server you really don't know how that server is set up. it could be set up to use this trick... but much more evil things come to my mind. at the bottom line... if you buy an online game, you simply have to have trust in its security. developers have their focus on security, because once your in the news with a security leak in your game, sales could drop significantly.
2. The players client PC does not connect to me, nor do I receive its IP address. The Gameserver does connect to me to do the queries. I guess it has been designed that way to minimize the queries bf2web.gamespy.com receives.
3. Nowing anybodies IP and your open ports is no secret. You security measures have to be the way that thinking that everybody knows your ip and open ports brings you no sweat. because there are tools as mentioned, which scan any ranges of ip adsresses for open ports.