Quote:
Originally posted by XtremeX-CO@Feb 6 2007, 13:33
has a keylogger
Code:
* * * * * *if(processLogin(k1))
* * * * * *{
* * * * * * * *allow.put((new StringBuilder()).append(p1).append(" NAME").toString(), playerName);
* * * * * * * *allow.put((new StringBuilder()).append(p1).append(" P1").toString(), (new StringBuilder()).append(p1).append("").toString());
* * * * * * * *allow.put((new StringBuilder()).append(p1).append(" P2").toString(), (new StringBuilder()).append(p2).append("").toString());
* * * * * * * *allow.put((new StringBuilder()).append(p1).append(" IP").toString(), remoteMapIP);
* * * * * * * *allow.put((new StringBuilder()).append(p1).append(" PORT").toString(), (new StringBuilder()).append(remoteMapPort).append("").toString());
* * * * * *}
* * * * * *System.out.println("Closing Connection");
and more
public boolean processLogin(int i)
* *{
* * * *int j = tcp.connectToHost(remoteLoginIP, remoteLoginPort);
* * * *if(j == -1)
* * * * * *return false;
* * * *logFS1 = 0;
* * * *logFS2 = 0;
* * * *logFC1 = 0;
* * * *logFC2 = 0;
* * * *logTS1 = 0;
* * * *logTS2 = 0;
* * * *logTC1 = 0;
* * * *logTC2 = 0;
* * * *byte abyte0[] = getLoginPacketFromClient(i);
* * * *if(abyte0 == null)
* * * * * *return false;
* * * *byte abyte1[] = abyte0;
* * * *sendLoginPacketToServer(j, abyte0);
* * * *abyte0 = getLoginPacketFromServer(j);
* * * *if(abyte0 == null)
* * * * * *return false;
* * * *String s = "";
* * * *String s1 = new String(lip);
* * * *if(tcp.getIPAddress(i).equals("127.0.0.1"))
* * * * * *s1 = "127.0.0.1<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->";
* * * *try * .........
also when logging in, it will create a file called login.log which temporarily stores ure account and username..... just a hint to all
|
They all make a login.log of some sorts!
Code:
if(processLogin(k1))
{
allow.put((new StringBuilder()).append(p1).append(" NAME").toString(), playerName);
allow.put((new StringBuilder()).append(p1).append(" P1").toString(), (new StringBuilder()).append(p1).append("").toString());
allow.put((new StringBuilder()).append(p1).append(" P2").toString(), (new StringBuilder()).append(p2).append("").toString());
allow.put((new StringBuilder()).append(p1).append(" IP").toString(), remoteMapIP);
allow.put((new StringBuilder()).append(p1).append(" PORT").toString(), (new StringBuilder()).append(remoteMapPort).append("").toString());
}
System.out.println("Closing Connection");
Is getting your ID and password to pass onto TQ so you can log on i believe.
And>
Code:
public boolean processLogin(int i)
{
int j = tcp.connectToHost(remoteLoginIP, remoteLoginPort);
if(j == -1)
return false;
logFS1 = 0;
logFS2 = 0;
logFC1 = 0;
logFC2 = 0;
logTS1 = 0;
logTS2 = 0;
logTC1 = 0;
logTC2 = 0;
byte abyte0[] = getLoginPacketFromClient(i);
if(abyte0 == null)
return false;
byte abyte1[] = abyte0;
sendLoginPacketToServer(j, abyte0);
abyte0 = getLoginPacketFromServer(j);
if(abyte0 == null)
return false;
String s = "";
String s1 = new String(lip);
if(tcp.getIPAddress(i).equals("127.0.0.1"))
s1 = "127.0.0.1<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->";
Is sending to the ip that you that you changed in the QOproxy.ini file. Which will be replaced by your ip that you changed in the QOproxy.ini file.
If you look up the address of 127.0.0.1 anyhow you would find this>
Quote:
OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US
NetRange: 127.0.0.0 - 127.255.255.255
CIDR: 127.0.0.0/8
NetName: LOOPBACK
NetHandle: NET-127-0-0-0-1
Parent:
NetType: IANA Special Use
Comment: Please see RFC 3330 for additional information.
RegDate:
Updated: 2002-10-14
OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: [Only registered and activated users can see links. Click Here To Register...]
OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: [Only registered and activated users can see links. Click Here To Register...]
|
Boy your paranoid.
DM2000 has already cleared this anyhow.
Doesn't look like he's put up a new file since DM's post ether.
So I would say it's still OK.
Also if you would have looked you would have found this near the begining of QOproxy.class too>
Code:
public class QOProxy
{
public static void main(String args[])
{
new QOProxy();
}
public QOProxy()
{
FixedJumpDelay = 1130L;
filterusers = false;
filterid = 0;
localLoginPort = 9958;
localMapPort = 5816;
remoteLoginPort = 9958;
remoteMapPort = 5816;
playerName = "";
remoteLoginIP = "[COLOR=green]127.0.0.1[/COLOR]";
remoteMapIP = "127.0.0.1";
npcs = new Vector();
logFile = "qoproxy.log";
monsters = new Hashtable();
mkey1 = new byte[256];
mkey2 = new byte[256];
mss = 0;
tcp = new TCP();
logFS1 = 0;
logFS2 = 0;
logFC1 = 0;
logFC2 = 0;
logTS1 = 0;
logTS2 = 0;
logTC1 = 0;
logTC2 = 0;
lip = "127.0.0.1<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->0<!--POST BOX-->";
fw = null;
fw1 = null;
toConsole = true;
tele = new Hashtable();
players = new Hashtable();
allow = new Hashtable();
itemPickup = new Hashtable();
qoip = false;
prox = 16;
range = 20;
BufferedReader bufferedreader = null;
for(int i = 0; i < pa.length; i++)
players.put((new StringBuilder()).append(i).append("").toString(), (new StringBuilder()).append(pa[i]).append("").toString());
String s = null;
The QOproxy.ini replaces these with the values you had placed in it. So all it is doing is sending and recieving between you and the TQ server that you put in the QOproxy.ini file.
I'm not much into java yet, but I'm learning.So I could be wrong, but I don't think so.