Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash exploit when warden fix #376

Open
wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

Crash exploit when warden fix #376

wants to merge 3 commits into from

Conversation

azalty
Copy link

@azalty azalty commented Feb 1, 2021

Fixes #371

Basically, it calls the OnClientDisconnected event for the Handcuffs module BEFORE triggering the event where the warden is removed, and it sets the new global bool g_bClientIsDisconnecting to true for the client. When this bool is set to true, it will NOT strip the taser from the player.

This should fix this exploit:

  1. Become warden
  2. Make youself kicked from the server by sending too much commands with the built-in server kick, for example by spamming "sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w;sm_w" (it works with every command that is from sourcemod, or some others that the server needs to reply to)
  3. It will call a function to say that the warden was removed, calling StripZeus() on him. In normal conditions, it should fail because of IsValidClient(). The thing is OnClientDisconnect is called BEFORE the client is fully disconnected, so he still passes the check.
  4. StripZeus() forces the client to send a client command (with FakeClientCommand()), making him kicked once again because of spamming. This is weird because it doesn't occur on a local server, the client is only kicked once. On a server that is not in LAN, it seems the client is kicked multiple times because of that.
  5. client is kicked -> calls OnClientDisconnect again -> infinite loop -> crash

Not tested yet. It might be needed to apply this fix for the deputy too. Since I don't use it on my server, I can't know. If this exploit still exists with the deputy, please comment here or post a new issue with crash logs.

@azalty azalty mentioned this pull request Feb 1, 2021
@azalty
Copy link
Author

azalty commented Feb 2, 2021

Tested and working as far as I can tell. I wasn't able to crash my server.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant