Metin2 Adminpage Buffer Exploit Fix

Luigina' Alıntı:

Adminpage 'yi zaten kullanan olacağını pek düşünmüyorum benim filesimde komple deaktif zaten.
Fakat filesinde adminpage kodları bulunan sunucu sahibi arkadaşlar için çözümü aşağıdadır.
Yapılan işlem şu sunucuza paket yollayıp buffer size arttırıyorlar bi süre sonra core rami 3.3gb 'yi geçtikten sonra ch otomatik düşüyor.
2 gün önce "ElsMetin2" 'ye yapıyorlardı bunu saçma sapan şeyler sunmuşlar çözümü aşağıda.
Piyasada gezen PACKET_FLOOD_FIX ANTI_PACKET_FLOOD gibi şeyler saçma sapan şeylerdir bunları kurmayın çünkü gereksiz.

Konuyu blierek özenerek hazırlamadım mantığı anlamışsınızdır. Normalde zaten bu tür şeyleri paylaşan birisi değilim fakat benden izinsiz benim işlemlerimi paylaştıkları için kendim paylaşıyorum.

[CODE lang="cpp" title="input.cpp"]Input.cpp içerisinde

if (bHeader == HEADER_CG_TEXT)

// bu kısmı bulun.

if (bHeader == HEADER_CG_TEXT)
{
++c_pData;
const char * c_pSep;

if (!(c_pSep = strchr(c_pData, '\n'))) // \n을 찾는다.
return -1;

if (*(c_pSep - 1) == '\r')
--c_pSep;

std::string stResult;
std::string stBuf;
stBuf.assign(c_pData, 0, c_pSep - c_pData);

sys_log(0, "SOCKET_CMD: FROM(%s) CMD(%s)", d->GetHostName(), stBuf.c_str());

if (!stBuf.compare("IS_SERVER_UP"))
{
if (g_bNoMoreClient)
stResult = "NO";
else
stResult = "YES";
}
else if (!stBuf.compare("IS_PASSPOD_UP"))
{
if (g_bNoPasspod)
stResult = "NO";
else
stResult = "YES";
}
//else if (!stBuf.compare("SHOWMETHEMONEY"))
else if (stBuf == g_stAdminPagePassword)
{
if (!IsEmptyAdminPage())
{
if (!IsAdminPage(inet_ntoa(d->GetAddr().sin_addr)))
{
char szTmp[64];
snprintf(szTmp, sizeof(szTmp), "WEBADMIN : Wrong Connector : %s", inet_ntoa(d->GetAddr().sin_addr));
stResult += szTmp;
}
else
{
d->SetAdminMode();
stResult = "UNKNOWN";
}
}
else
{
d->SetAdminMode();
stResult = "UNKNOWN";
}
}
else if (!stBuf.compare("USER_COUNT"))
{
char szTmp[64];

if (!IsEmptyAdminPage())
{
if (!IsAdminPage(inet_ntoa(d->GetAddr().sin_addr)))
{
snprintf(szTmp, sizeof(szTmp), "WEBADMIN : Wrong Connector : %s", inet_ntoa(d->GetAddr().sin_addr));
}
else
{
int iTotal;
int * paiEmpireUserCount;
int iLocal;
DESC_MANAGER::instance().GetUserCount(iTotal, &paiEmpireUserCount, iLocal);
snprintf(szTmp, sizeof(szTmp), "%d %d %d %d %d", iTotal, paiEmpireUserCount[1], paiEmpireUserCount[2], paiEmpireUserCount[3], iLocal);
}
}
else
{
int iTotal;
int * paiEmpireUserCount;
int iLocal;
DESC_MANAGER::instance().GetUserCount(iTotal, &paiEmpireUserCount, iLocal);
snprintf(szTmp, sizeof(szTmp), "%d %d %d %d %d", iTotal, paiEmpireUserCount[1], paiEmpireUserCount[2], paiEmpireUserCount[3], iLocal);
}
stResult += szTmp;
}
else if (!stBuf.compare("CHECK_P2P_CONNECTIONS"))
{
std:stringstream oss(std:stringstream:ut);

oss << "P2P CONNECTION NUMBER : " << P2P_MANAGER::instance().GetDescCount() << "\n";
std::string hostNames;
P2P_MANAGER::Instance().GetP2PHostNames(hostNames);
oss << hostNames;
stResult = oss.str();
TPacketGGCheckAwakeness packet;
packet.bHeader = HEADER_GG_CHECK_AWAKENESS;

P2P_MANAGER::instance().Send(&packet, sizeof(packet));
}
else if (!stBuf.compare("PACKET_INFO"))
{
m_pMainPacketInfo->Log("packet_info.txt");
stResult = "OK";
}
else if (!stBuf.compare("PROFILE"))
{
CProfiler::instance().Log("profile.txt");
stResult = "OK";
}
//gift notify delete command
else if (!stBuf.compare(0,15,"DELETE_AWARDID "))
{
char szTmp[64];
std::string msg = stBuf.substr(15,26); // item_award의 id범위?

TPacketDeleteAwardID p;
p.dwID = (DWORD)(atoi(msg.c_str()));
snprintf(szTmp,sizeof(szTmp),"Sent to DB cache to delete ItemAward, id: %d",p.dwID);
//sys_log(0,"%d",p.dwID);
// strlcpy(p.login, msg.c_str(), sizeof(p.login));
db_clientdesc->DBPacket(HEADER_GD_DELETE_AWARDID, 0, &p, sizeof(p));
stResult += szTmp;
}
else
{
stResult = "UNKNOWN";

if (d->IsAdminMode())
{
// 어드민 명령들
if (!stBuf.compare(0, 7, "NOTICE "))
{
std::string msg = stBuf.substr(7, 50);
LogManager::instance().CharLog(0, 0, 0, 1, "NOTICE", msg.c_str(), d->GetHostName());
BroadcastNotice(msg.c_str());
}
else if (!stBuf.compare("CLOSE_PASSPOD"))
{
g_bNoPasspod = true;
stResult += "CLOSE_PASSPOD";
}
else if (!stBuf.compare("OPEN_PASSPOD"))
{
g_bNoPasspod = false;
stResult += "OPEN_PASSPOD";
}
else if (!stBuf.compare("SHUTDOWN"))
{
LogManager::instance().CharLog(0, 0, 0, 2, "SHUTDOWN", "", d->GetHostName());
TPacketGGShutdown p;
p.bHeader = HEADER_GG_SHUTDOWN;
P2P_MANAGER::instance().Send(&p, sizeof(TPacketGGShutdown));
sys_err("Accept shutdown command from %s.", d->GetHostName());
Shutdown(10);
}
else if (!stBuf.compare("SHUTDOWN_ONLY"))
{
LogManager::instance().CharLog(0, 0, 0, 2, "SHUTDOWN", "", d->GetHostName());
sys_err("Accept shutdown only command from %s.", d->GetHostName());
Shutdown(10);
}
else if (!stBuf.compare(0, 3, "DC "))
{
std::string msg = stBuf.substr(3, LOGIN_MAX_LEN);

dev_log(LOG_DEB0, "DC : '%s'", msg.c_str());

TPacketGGDisconnect pgg;

pgg.bHeader = HEADER_GG_DISCONNECT;
strlcpy(pgg.szLogin, msg.c_str(), sizeof(pgg.szLogin));

P2P_MANAGER::instance().Send(&pgg, sizeof(TPacketGGDisconnect));

// delete login key
{
TPacketDC p;
strlcpy(p.login, msg.c_str(), sizeof(p.login));
db_clientdesc->DBPacket(HEADER_GD_DC, 0, &p, sizeof(p));
}
}
else if (!stBuf.compare(0, 10, "RELOAD_CRC"))
{
LoadValidCRCList();

BYTE bHeader = HEADER_GG_RELOAD_CRC_LIST;
P2P_MANAGER::instance().Send(&bHeader, sizeof(BYTE));
stResult = "OK";
}
else if (!stBuf.compare(0, 20, "CHECK_CLIENT_VERSION"))
{
CheckClientVersion();

BYTE bHeader = HEADER_GG_CHECK_CLIENT_VERSION;
P2P_MANAGER::instance().Send(&bHeader, sizeof(BYTE));
stResult = "OK";
}
else if (!stBuf.compare(0, 6, "RELOAD"))
{
if (stBuf.size() == 6)
{
LoadStateUserCount();
db_clientdesc->DBPacket(HEADER_GD_RELOAD_PROTO, 0, NULL, 0);
DBManager::instance().LoadDBString();
}
else
{
char c = stBuf[7];

switch (LOWER(c))
{
case 'u':
LoadStateUserCount();
break;

case 'p':
db_clientdesc->DBPacket(HEADER_GD_RELOAD_PROTO, 0, NULL, 0);
break;

case 's':
DBManager::instance().LoadDBString();
break;

case 'q':
quest::CQuestManager::instance().Reload();
break;

case 'f':
fishing::Initialize();
break;

case 'a':
db_clientdesc->DBPacket(HEADER_GD_RELOAD_ADMIN, 0, NULL, 0);
sys_log(0, "Reloading admin infomation.");
break;
}
}
}
else if (!stBuf.compare(0, 6, "EVENT "))
{
std::istringstream is(stBuf);
std::string strEvent, strFlagName;
long lValue;
is >> strEvent >> strFlagName >> lValue;

if (!is.fail())
{
sys_log(0, "EXTERNAL EVENT FLAG name %s value %d", strFlagName.c_str(), lValue);
quest::CQuestManager::instance().RequestSetEventFlag(strFlagName, lValue);
stResult = "EVENT FLAG CHANGE ";
stResult += strFlagName;
}
else
{
stResult = "EVENT FLAG FAIL";
}
}
// BLOCK_CHAT
else if (!stBuf.compare(0, 11, "BLOCK_CHAT "))
{
std::istringstream is(stBuf);
std::string strBlockChat, strCharName;
long lDuration;
is >> strBlockChat >> strCharName >> lDuration;

if (!is.fail())
{
sys_log(0, "EXTERNAL BLOCK_CHAT name %s duration %d", strCharName.c_str(), lDuration);

do_block_chat(NULL, const_cast<char*>(stBuf.c_str() + 11), 0, 0);

stResult = "BLOCK_CHAT ";
stResult += strCharName;
}
else
{
stResult = "BLOCK_CHAT FAIL";
}
}
// END_OF_BLOCK_CHAT
else if (!stBuf.compare(0, 12, "PRIV_EMPIRE "))
{
int empire, type, value, duration;
std::istringstream is(stBuf);
std::string strPrivEmpire;
is >> strPrivEmpire >> empire >> type >> value >> duration;

// 최대치 10배
value = MINMAX(0, value, 1000);
stResult = "PRIV_EMPIRE FAIL";

if (!is.fail())
{
// check parameter
if (empire < 0 || 3 < empire);
else if (type < 1 || 4 < type);
else if (value < 0);
else if (duration < 0);
else
{
stResult = "PRIV_EMPIRE SUCCEED";

// 시간 단위로 변경
duration = duration * (60 * 60);

sys_log(0, "_give_empire_privileage(empire=%d, type=%d, value=%d, duration=%d) by web",
empire, type, value, duration);
CPrivManager::instance().RequestGiveEmpirePriv(empire, type, value, duration);
}
}
}
else if (!stBuf.compare(0, 15, "BLOCK_EXCEPTION"))
{
// BLOCK_EXCEPTION cmd(add=1, del=2) login
std::istringstream is(stBuf);
std::string dummy_string;
std::string login_string;
int cmd;

is >> dummy_string >> cmd >> login_string;

sys_log(0, "block_exception %s:%d", login_string.c_str(), cmd);
DBManager::instance().RequestBlockException(login_string.c_str(), cmd);
stResult = "BLOCK_EXCEPTION_YES";
}
}
}

sys_log(1, "TEXT %s RESULT %s", stBuf.c_str(), stResult.c_str());
stResult += "\n";
d->Packet(stResult.c_str(), stResult.length());
return (c_pSep - c_pData) + 1;
}

// Yukarıdaki kodu tamamen silin.

else if (bHeader == HEADER_CG_MARK_LOGIN)
{
if (!guild_mark_server)
{
// 끊어버려! - 마크 서버가 아닌데 마크를 요청하려고?
sys_err("Guild Mark login requested but i'm not a mark server!");
d->SetPhase(PHASE_CLOSE);
return 0;
}

// 무조건 인증 --;
sys_log(0, "MARK_SERVER: Login");
d->SetPhase(PHASE_LOGIN);
return 0;
}

// Sonrasında bu kodu aşağıdaki gibi değiştirin.

if (bHeader == HEADER_CG_MARK_LOGIN)
{
if (!guild_mark_server)
{
// 끊어버려! - 마크 서버가 아닌데 마크를 요청하려고?
sys_err("Guild Mark login requested but i'm not a mark server!");
d->SetPhase(PHASE_CLOSE);
return 0;
}

// 무조건 인증 --;
sys_log(0, "MARK_SERVER: Login");
d->SetPhase(PHASE_LOGIN);
return 0;
}

[/CODE]

[CODE lang="cpp" title="packet_info.cpp && packet.h"]packet_info.cpp içerisinde

Set(HEADER_CG_TEXT, sizeof(TPacketCGText), "Text", false);

bu satırı siliniz.

Sonrasında packet.h dosyasına girin.

HEADER_CG_TEXT

bu satırı bulun ve silin.[/CODE]

Genişletmek için tıkla