[Exploit] Summon any monster at any server without gm account

OPCODE :
0x34BB

Hello everyone, today I just discovered that we can summon any monster at any server without gm account, you can also spawn NPC, sorry for the server where I've spawn those monster. It was just a test.

Proof of concept:



As you can see on the second video, it's not only client side.

I guess it's JGuard and NaviFilter which are used on those server.

I'm really sorry again for KeonSro, I've spawned roc, I should have spawn something else, sorry again.
(I contacted GM of both server for restart them)

gz man good stuff

Thanks for letting me know , ( Fixed )

I wonder which exploit is this, there was a shard manager exploit that I used to use years ago. Is that it?

Awesome :topnep:
Would be nice if you release the fix tho (exploit opt) :)

It was a good idea to post this. Now the people will know this is a thing and will have it fixed in no time instead of having a rogue group abusing this

Quote:

Originally Posted by PortalDark It was a good idea to post this. Now the people will know this is a thing and will have it fixed in no time instead of having a rogue group abusing this

The Opcode was posted here [Only registered and activated users can see links. Click Here To Register...] btw. they removed it ^-^

Quote:

Originally Posted by b0ykoe The Opcode was posted here [Only registered and activated users can see links. Click Here To Register...] btw. they removed it ^-^

Yes was a stupid move from my part, I was just sharing what I've discovered and I didn't know that the client can inject this packet, I thought joymax will secure it by verifing who is sending the packet, it's not the case.

I think it comes down to devs being inconsistent with the opcodes.

The AgentServer filters all incoming packets based on some rules:
First it filters all framework opcodes (0x2000->0x2FFF, 0x6000->0x6FFF, 0xA000, 0xAFFF) with the some exceptions:
Second it removes all acknowledges (0x8000, 0x9000, 0xA000, 0xB000) and any opcode > 0x07FF in their respective group.

0x9000 is only allowed in _OnMsgReceivedBeforeHandshake().

So the remaining allowed opcode ranges are:
‬

The exploit happens to be within this range, good luck :P

Well
i just woke up and saw this on my server :lul:
[Only registered and activated users can see links. Click Here To Register...]

Finally exposed.. BB me no play :D

Shouldn't work on servers that block unknown opcodes.

so how we can block it?

Quote:

Originally Posted by Hercules* so how we can block it?

Don't trust random filters

Thanks for sharing this. So far, no issues detected with all unknown opcodes blocked. :D

Quote:

Originally Posted by sonzenbi Well i just woke up and saw this on my server :lul: [Only registered and activated users can see links. Click Here To Register...]

Fix -> (0xA003)