[FIX] SQL Silme Açığı

[Bekir Akdemir]

Yeni bir açık çıkmış sanırım çakma lamer-hacker'ların mutluluğu pek uzun sürmeyecek gibi gözüküyor...

2089 Game Core kullananlar için DIFF

game_2089M

0010F5C3: 31 EB
0010F5C4: C0 09

33820 Database Core (Singapore) kullananlar için DIFF


​

This difference file is created by The Interactive Disassembler


db_r33820_32_u
000925A5: 01 00

34083 Game Core (Singapore) kullananlar için DIFF
​

This difference file is created by The Interactive Disassembler


game_r34083_32
0040DFE5: 01 00

Source (2013 YMIR) kullananlar için anlatım

game/src kısmından messenger_manager.cpp dosyası açılır ve aratılır;​

void MessengerManager::RemoveFromList(MessengerManager::keyA account, MessengerManager::keyA companion)

Bu kısım;
​

void MessengerManager::RemoveFromList(MessengerManager::keyA account, MessengerManager::keyA companion)
{
    if (companion.size() == 0)
        return;


    sys_log(1, "Messenger Remove %s %s", account.c_str(), companion.c_str());
    DBManager::instance().Query("DELETE FROM messenger_list%s WHERE account='%s' AND companion = '%s'",
            get_table_postfix(), account.c_str(), companion.c_str());


    __RemoveFromList(account, companion);


    TPacketGGMessenger p2ppck;


    p2ppck.bHeader = HEADER_GG_MESSENGER_REMOVE;
    strlcpy(p2ppck.szAccount, account.c_str(), sizeof(p2ppck.szAccount));
    strlcpy(p2ppck.szCompanion, companion.c_str(), sizeof(p2ppck.szCompanion));
    P2P_MANAGER::instance().Send(&p2ppck, sizeof(TPacketGGMessenger));
}

Bu kod ile değiştirilir;
​

void MessengerManager::RemoveFromList(MessengerManager::keyA account, MessengerManager::keyA companion)
{
    if (companion.empty())
        return;


    // Second fix
    if (m_Relation[account].find(companion) == m_Relation[account].end() || m_InverseRelation[companion].find(account) == m_InverseRelation[companion].end())
    {
        LPCHARACTER ch = CHARACTER_MANAGER::Instance().FindPC(account.c_str());
        if (ch)
        {
            sys_err("MessengerManager::RemoveFromList: %s tries to use messenger sql injection", ch->GetName());
            DBManager::Instance().DirectQuery("UPDATE account.account SET status = 'BAN' WHERE id = %u", ch->GetAID());
            if (ch->GetDesc())
                ch->GetDesc()->DelayedDisconnect(3);
        }
        else
            sys_err("MessengerManager::RemoveFromList: Omg! The ghost tried to use this function!");
        return;
    }


    sys_log(1, "MessengerManager::RemoveFromList: Remove %s %s", account.c_str(), companion.c_str());
    DBManager::instance().Query("DELETE FROM messenger_list%s WHERE account='%s' AND companion = '%s'", get_table_postfix(), account.c_str(), companion.c_str());
    __RemoveFromList(account, companion);
    TPacketGGMessenger p2ppck;
    p2ppck.bHeader = HEADER_GG_MESSENGER_REMOVE;
    strlcpy(p2ppck.szAccount, account.c_str(), sizeof(p2ppck.szAccount));
    strlcpy(p2ppck.szCompanion, companion.c_str(), sizeof(p2ppck.szCompanion));;
    P2P_MANAGER::instance().Send(&p2ppck, sizeof(TPacketGGMessenger));
}

game/src kısmından guild_manager.cpp açılır ve aratılır;
​

DWORD CGuildManager::CreateGuild(TGuildCreateParameter& gcp)

Bu kısım;
​

DWORD CGuildManager::CreateGuild(TGuildCreateParameter& gcp)
{
    if (!gcp.master)
        return 0;


    if (!check_name(gcp.name))
    {
        gcp.master->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("<길ë“œ> 길ë“œ 이ë¦â€žì´ ì í•©í•˜ì§â‚¬ ì•ŠìÅ µë‹ˆë‹¤."));
        return 0;
    }


    std::auto_ptr<SQLMsg> pmsg(DBManager::instance().DirectQuery("SELECT COUNT(*) FROM guild%s WHERE name = '%s'",
                get_table_postfix(), gcp.name));


    if (pmsg->Get()->uiNumRows > 0)
    {
        MYSQL_ROW row = mysql_fetch_row(pmsg->Get()->pSQLResult);


        if (!(row[0] && row[0][0] == '0'))
        {
            gcp.master->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("<길ë“œ> 이미 ê°â„¢ìâ‚¬ 이ë¦â€žìËœ 길ë“œê°â‚¬ ìžË†ìÅ µë‹ˆë‹¤."));
            return 0;
        }
    }
    else
    {
        gcp.master->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("<길ë“œ> 길ë“œ를 ìƒì„±í•  수 ì—†ìÅ µë‹ˆë‹¤."));
        return 0;
    }


    // new CGuild(gcp) queries guild tables and tell dbcache to notice other game servers.
    // other game server calls CGuildManager::LoadGuild to load guild.
    CGuild * pg = M2_NEW CGuild(gcp);
    m_mapGuild.insert(std::make_pair(pg->GetID(), pg));
    return pg->GetID();
}

Bu kod ile değiştirilir.
​

DWORD CGuildManager::CreateGuild(TGuildCreateParameter& gcp)
{
    if (!gcp.master)
        return 0;


    if (!check_name(gcp.name))
    {
        gcp.master->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("<길ë“œ> 길ë“œ 이ë¦â€žì´ ì í•©í•˜ì§â‚¬ ì•ŠìÅ µë‹ˆë‹¤."));
        return 0;
    }
    static char __escape_name[GUILD_NAME_MAX_LEN * 2 + 1];
    DBManager::instance().EscapeString(__escape_name, sizeof(__escape_name), static_cast<const char *>(gcp.name),
    sizeof(gcp.name));
    std::auto_ptr<SQLMsg> pmsg(DBManager::instance().DirectQuery("SELECT COUNT(*) FROM guild%s WHERE name = '%s'",
                get_table_postfix(), __escape_name));


    if (pmsg->Get()->uiNumRows > 0)
    {
        MYSQL_ROW row = mysql_fetch_row(pmsg->Get()->pSQLResult);


        if (!(row[0] && row[0][0] == '0'))
        {
            gcp.master->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("<길ë“œ> 이미 ê°â„¢ìâ‚¬ 이ë¦â€žìËœ 길ë“œê°â‚¬ ìžË†ìÅ µë‹ˆë‹¤."));
            return 0;
        }
    }
    else
    {
        gcp.master->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("<길ë“œ> 길ë“œ를 ìƒì„±í•  수 ì—†ìÅ µë‹ˆë‹¤."));
        return 0;
    }


    // new CGuild(gcp) queries guild tables and tell dbcache to notice other game servers.
    // other game server calls CGuildManager::LoadGuild to load guild.
    CGuild * pg = M2_NEW CGuild(gcp);
    m_mapGuild.insert(std::make_pair(pg->GetID(), pg));
    return pg->GetID();
}

 

[ABE YOK BEYAA]

http://www.turkmmo.com/c-c-python/3391535-c-sqlinject-fix.html

http://www.turkmmo.com/c-c-python/3391602-diff-sql-inject-acigi-34k.html

 

[Bekir Akdemir]

http://www.turkmmo.com/c-c-python/3391535-c-sqlinject-fix.html

http://www.turkmmo.com/c-c-python/3391602-diff-sql-inject-acigi-34k.html

napak ölek mi qrdş bekle lonca ile yapılanı da ekleyim konuya

 

[Pelin Melek Aslan]

Alıntı dışındakiler konuya eklenti yapılmıştır.

Konuya devam edebilirsiniz..

 

[Bekir Akdemir]

Diff ve source anlatım paylaşılandan farklıdır. Güncel