HLDS Exploits II

[CSN NewsBot]

SecurityFocus' Bugtraq is housing at least seven various Half-Life related exploits. One is a simple method of crashing HLTV, while the remaining revolve around various HLDS add-ons like AdminMod, statsme, and ClanMod.



Due to poor programming in many cases, arbitrary code can be run on either the server or, with some exploits, on the client. Many of these exploits require rcon access. The easy solution for server operators is to not allow admins to use rcon if you have AdminMod, statsme, or ClanMod installed. You can do this by setting rcon_password to nothing (type ""). If you insist on using rcon and cannot fully trust your admins, then disable/uninstall the add-ons in question until they are upgraded. The best solution for the head admin, of course, is to only give rcon and AdminMod access to people who can be trusted.



AdminMod has at least one major exploit which may not require rcon access, so you may wish to uninstall AdminMod if you are a server operator.



For the client, it is recommended that you only play on servers where you can trust the admins. For now, it is a bit of a risk to join some random wacky server because that admin may, at his will, start a shell session to multiple clients' computers. If your game locks up, turn off your computer quickly.

[MikeJ]

Being behind a firewall will stop them from being able to open a shell session correct? I don't forward any of those ports through my firewall.

[bkrose120]

I heard someone say once that by changing their config to read-only the admin couldn't run admin_client_exec on them, is that true?

[MikeJ]

No. They can still run any command on your client (HL related, not any shell command), but if your config is read only it wont still be in effect next time you start CS. So if they unbind all your keys just restart CS or type exec server.cfg and it's all back. Mine is read only.

[rizzuh]

The admin can still do it but the results will not be saved.



This post has nothing to do with your config, it has to do with someone taking control of your computer.

[|3ear]

Wow nothing againts you, but the way you put that really really really freaked me out!

[Gpig]

Time to install console connector again.

[SinaC]

rcon is like 1 million times better than adminmod. It's all stupid useless programs faults. rcon for lyfe.

[bkrose120]

Well I thought they just take control of the server and then can run commands on your computer in config like an admin by using admin password, but I guess I was wrong

[MikeJ]

Yes they can run commands, but only HL commands like bind "mouse1" "kill" O NOES!



...The exploit allows them to delete your porn folder and such.

[bkrose120]

Oh no, not my PORN folder! AHHHHHHHHHHHH

[Gpig]

MikeJ wrote..

Yes they can run commands, but only HL commands like bind "mouse1" "kill" O NOES!



...The exploit allows them to delete your porn folder and such.

ALL THOSE HOT ASIAN GUYS!!!!!



GONE?!!!



I'm not going to play CS till this blows over.

[Disk2]

-Gpig wrote..

ALL THOSE HOT ASIAN GUYS!!!!!



GONE?!!!



I'm not going to play CS till this blows over.

It won't just "blow over". The sad thing is that VALVe has to release an entire patch for clients and servers to fix the problems. Since they are going to release CS 1.6 at some point in the future they may just wait until then, which would be fucking stupid and flat out dangerous. Think of it...2 or 3 months without being able to play CS with any sense of security.



But knowing VALVe that could very well happen. I'm hoping it won't though...

[Spoonman]

...so you may wish to uninstall AdminMod if you are a server operator.

Better words have not been spoken.

[cHic0!]

Wouldn't it have been much better if the guy's who found these bugs just e-mailed all the detailed stuff to valve and told everyone else to uninstall adminmod and such? Now a whole bunch of people know how to use these exploits.