So recently I was looking for a proper guide on how to secure a server from the exploint that had been recently found and released and I've found pretty much nothing. Since I managed to fix it I will release a guide on how to secure a server that can be running not only on 1 but even on n machines.
So the problem is the connection that can be created to any of the exes from outside programs.
1. Enabling the Firewall.
Any of the machines that has access to the DB should have their Firewall enabled. - This purely blocks any unwanted program from connecting to any of your programs/exes.
2. Blocking the default settings of the executables.
Blockout any of the server exes from accepting outside connection on all of the machines you are using. This will stop ANY connection to them. This way no one even you (for now) will be able to launch anything that connects to them successfuly. (Gatеway Server on hw2,hw3,hwn will not be able to connect to Global Manager on hw1).
This is done from
There just Delete all of the rules that are for any part of the server executables.
3. Allowing the computers we want to connect.
Now since we blocked all of the connections we should add the computers we want to allow to connect to us.
Again go to
There you should add a specific rule for each of the exes.
How to:
1. Chose New Rule
2. Chose Program
3. Enter the path to the exe - Global Manager in example -
4. Chose Allow the connection
5. Mark all of the types which to apply to - Domain, Private and Public.
6. Enter Name and Description (optional) and Finish.
Now you have created a rule for one of your exes. This should be done for each and every specific exe that you want to run. Now it's time to add the computers we want to allow to connect to this exe.
How to:
Again go to
There you should find the rule you have created.
1. Double Click it to open the Properties tab.
2. Go to Advanced tab and for Edge traversal choose Block edge traversal.
3. Go to Protocols and Ports tab and choose which protocols and ports you want to manage. You can simply choose All.
4. Go to Scope tab. Chose These ip adresses for both Local and Remote Connections.
5. Add your Local and Remote machines IPs. This way they will be able to connect the exe you are managing.
6. Click apply and OK and you are done.
This is a must to to any of the exes running if you want to be able to use them after Step 2.
This should be done on all of the running machines to make sure you have secured any probable hole in the security.
4. Allowing the machines we want to connect to our DB.
You should now allow your other machines to connect to your DB. This is due to that the Game Server for example must have a DB connection.
How to:
1. Chose New Rule
2. Chose Port
3. Enter the port that you want to open - check what's your MSSQL port.
4. Chose Allow the connection
5. Mark all of the types which to apply to - Domain, Private and Public.
6. Enter Name and Description (optional) and Finish.
So at the current momment you are allowing any computer to be able to connect to your DB. To create a Scope of computers that should be allowed to do that you should enter them to the Scope tab of the rule.
How to:
Again go to
There you should find the rule you have created.
1. Double Click it to open the Properties tab.
2. Go to Advanced tab and for Edge traversal choose Block edge traversal.
3. Go to Protocols and Ports tab and choose which protocols and ports you want to manage. You can simply choose All.
4. Go to Scope tab. Chose These ip adresses for both Local and Remote Connections.
5. Add your Local and Remote machines IPs. This way they will be able to connect the exe you are managing.
6. Click apply and OK and you are done.
Now you should be able to run properly all of your machines with all of their executables, but at that point no one will be able to connect to your server since you have blocked the login and game server ports.
5. Allowing players to connect.
This is done on the same principle as in Step 4, but this time you should enter the ports of your Login and Game Servers and you should not create a scope of computers but just leave the rule allowing any connection to these ports.
If you have done this right your server should be secure enought. At this point no one will be able to connect to anything but the Login and Game Servers.
This guide is a must to for anyone that wants to start a server and haven't done it by himself.
I've posted it here since the Private SRO Exploits/Hacks/Bots/Guides approval takes years -_-
The exploit:
The exploit is a basic missunderstanding of any of the server exes that can be connected to the DB - including the Certification manager and w/e you created or added to your network. By simple connection to any of them you can manage to get DB access and do whatever you want. So the problem is the connection that can be created to any of the exes from outside programs.
The fix:
1. Enabling the Firewall.
Any of the machines that has access to the DB should have their Firewall enabled. - This purely blocks any unwanted program from connecting to any of your programs/exes.
2. Blocking the default settings of the executables.
Blockout any of the server exes from accepting outside connection on all of the machines you are using. This will stop ANY connection to them. This way no one even you (for now) will be able to launch anything that connects to them successfuly. (Gatеway Server on hw2,hw3,hwn will not be able to connect to Global Manager on hw1).
This is done from
Code:
Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules
3. Allowing the computers we want to connect.
Now since we blocked all of the connections we should add the computers we want to allow to connect to us.
Again go to
Code:
Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules
How to:
1. Chose New Rule
2. Chose Program
3. Enter the path to the exe - Global Manager in example -
Code:
D:\uberleetsrserver\bin\GlobalManager.exe
5. Mark all of the types which to apply to - Domain, Private and Public.
6. Enter Name and Description (optional) and Finish.
Now you have created a rule for one of your exes. This should be done for each and every specific exe that you want to run. Now it's time to add the computers we want to allow to connect to this exe.
How to:
Again go to
Code:
Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules
1. Double Click it to open the Properties tab.
2. Go to Advanced tab and for Edge traversal choose Block edge traversal.
3. Go to Protocols and Ports tab and choose which protocols and ports you want to manage. You can simply choose All.
4. Go to Scope tab. Chose These ip adresses for both Local and Remote Connections.
5. Add your Local and Remote machines IPs. This way they will be able to connect the exe you are managing.
6. Click apply and OK and you are done.
This is a must to to any of the exes running if you want to be able to use them after Step 2.
This should be done on all of the running machines to make sure you have secured any probable hole in the security.
4. Allowing the machines we want to connect to our DB.
You should now allow your other machines to connect to your DB. This is due to that the Game Server for example must have a DB connection.
How to:
1. Chose New Rule
2. Chose Port
3. Enter the port that you want to open - check what's your MSSQL port.
4. Chose Allow the connection
5. Mark all of the types which to apply to - Domain, Private and Public.
6. Enter Name and Description (optional) and Finish.
So at the current momment you are allowing any computer to be able to connect to your DB. To create a Scope of computers that should be allowed to do that you should enter them to the Scope tab of the rule.
How to:
Again go to
Code:
Control Panel\System and Security\Windows Firewall ->Advanced Settings ->Inbound Rules
1. Double Click it to open the Properties tab.
2. Go to Advanced tab and for Edge traversal choose Block edge traversal.
3. Go to Protocols and Ports tab and choose which protocols and ports you want to manage. You can simply choose All.
4. Go to Scope tab. Chose These ip adresses for both Local and Remote Connections.
5. Add your Local and Remote machines IPs. This way they will be able to connect the exe you are managing.
6. Click apply and OK and you are done.
Now you should be able to run properly all of your machines with all of their executables, but at that point no one will be able to connect to your server since you have blocked the login and game server ports.
5. Allowing players to connect.
This is done on the same principle as in Step 4, but this time you should enter the ports of your Login and Game Servers and you should not create a scope of computers but just leave the rule allowing any connection to these ports.
If you have done this right your server should be secure enought. At this point no one will be able to connect to anything but the Login and Game Servers.
This guide is a must to for anyone that wants to start a server and haven't done it by himself.
I've posted it here since the Private SRO Exploits/Hacks/Bots/Guides approval takes years -_-
