HLDS Exploits II

[Disk2]

Insomniac wrote..

hardly anyone has MS-DOS on their computers nowadays...so deltree is a bad example isnt it....

If you are trying to be sarcastic or something and not a nit-picking ass then I apologize. I was merely trying to make a point that files can be deleted, and that was the first thing that came to mind. True, that command is not on NT/2000, but I think my point was still made.



What was your reason for bringing this up again? To show that I made a little syntax error while still getting my point across?

[SinaC]

cheetarah654 wrote..

anyways, id ont understand why people are obsessed with finding ways to exploit things. so childish

beating the system.

[Simplex]

Disk2 wrote..

If you are trying to be sarcastic or something and not a nit-picking ass then I apologize. I was merely trying to make a point that files can be deleted, and that was the first thing that came to mind. True, that command is not on NT/2000, but I think my point was still made.



What was your reason for bringing this up again? To show that I made a little syntax error while still getting my point across?

It is important to note that a computer that is running NT/2000/XP cannot be formatted from the command line without user intervention. Older machines can try to run "format c: /AUTOTEST /U" and that'll seriously mess stuff up. This is a really technical exploit and it's good to be exacting. Slip-ups like that are why we have these exploits -- code that wasn't scrutinized enough.



Then again, since they have shell access, the attacker can just hit "y" anyway.

Added @ [time="1042352060"]

And to uninstall Admin-mod, without getting rid of all the configs you have, do what they say in the FAQ, not in the link above:

Just open your mods liblist.gam file (in cstrike you would open cstrike/liblist.gam) and change the:



gamedll "dlls\admin.dll"



back to your mods dll file (look in the mods dll dir for the filename).

For cstrike the new gamedll line should read like this:



gamedll "dlls\mp.dll"

[DarkViper311]

rizzuh wrote..

This post has nothing to do with your config, it has to do with someone taking control of your computer.

I wish i had control of my computer...........fucking piece of shit pc.......meh......i dont get much sleep nowadays so im gonna try and get and early night,im tired.........which is why im ranting about a bunch of useless nonsense,now g'night

[BGreen420]

DarkViper311 wrote..

I wish i had control of my computer...........fucking piece of shit pc.......meh......i dont get much sleep nowadays so im gonna try and get and early night,im tired.........which is why im ranting about a bunch of useless nonsense,now g'night

k, that was scary.

[BoNeLeSS]

Steam liked me because of this... If a serious bug has been found the fix is distributed automaticaly...



BTW... This ppl of security focus didn't talk about this with e autors of Clanmod and Adminmod (and I assumme neither VALVe) before publishing this. Whats the point of doing that?



Alfred, from Adminmod:

The author of this Admin Mod exploit didn't bother to contact me (which is odd, as contacting the authors of the mentioned program is generally accepted practice....)



As the bugtraq message says, its not actually a bug in Admin Mod itself BUT we may be able to stop the exploit (by limiting string lengths). Unfortunately people could just then write their own metamod plugins to run the exploit ( or use other 3rd party mods).



That said, given that the user needs an RCON password to run the exploit I would say its reasonably low risk AS LONG as you play on servers you trust. However, (as always) if you rely on data on your PC don't connect to any remote servers AND make sure you always have current backups.

Houndawg from UA:

That's ok Alfred, UA wasn't contacted about the CM one. Nor, did anyone on the team know about it since it was old OLO code. =| Anyway, we should have a fix for CM posted within the next 24 hours.

[sniv]

omg getting hacked while you're playing a game... ugh

[thor2488]

Simplex wrote..

gamedll "dlls\admin.dll"

If you have the latest version, it would be something like



addons\metamod\dlls\metamod.dll



but whatever. Disabling metamod would solve the problems more than disabling individual metamod plugins.

[Delta|Cpt.Terran]

N1ghtSt@lker wrote..

this bug will allow admins (if they're going to be stupid enough) to control your computer. by controling your computer, they can do anything you can on your computer. this could include reformatting your computer. :O

oh my gawd...evil queefs. I feel like running aorund in circles, ranting and protesting till this blows over or something now.

[Stylez]

i say we get a mob together and burn adminmod at the stake

[-Dice]

And since we all know that CS players are largely preteen script kiddies, there's a good chance someone's going to be hurt here.

[KhAoS]

thank god i play on my own clan server. I think I'm safe, but hey you never know. I'm gonna be very scared if my computer locks up while playing CS now.

[MikeJ]

They should of waited till after CS 1.6 beta was released before finding this exploit, i bet this pushesh the beta release back

[fusioned]

People behind a router on a dynamic-ip (single address) connection should be ok, as outside traffic will end up trying to connect to the router - and fail.



People with a decent firewall installed should also be reasonably ok - as long as it is setup properly.



People playing n00d ... well, I pity you.

[orion]

This is good that this is being reported, but also...



Wont more people want to find out how to use these exploits, now that they know they exist?



Eventually these people will find out, but like it also reports, These exploits are being taken care of.