[RELEASE][FIX] GameServer Crash/Runtime Error Exploit

sarkoplata · 10/29/2017, 20:52

Hello everyone,

This is yet an unknown one (atleast for me and my environment) so I wanted to share this before more people lose their mind. It's a really strong exploit and will crash your gameserver with only 1 packet.
And the fix is also that easy.
Just block the 0x3510 opcode and you'll be fine.

PHP Code:



if(_pck.Opcode == 0x3510) continue;

Because the attackers used it wisely, we thought it was an error caused by the database. We wasted hours in front of PC (to fix this on BlackPearl) and then we decided to search the packets one by one to see the malicious one.

Hope you use it for good

.

tombalaci46 · 10/29/2017, 20:54

Finally we fixed it. I hope that will help you.

SubZero** · 10/29/2017, 21:00

thank you

KingDollar · 10/29/2017, 21:03

i'm happy that you finally find it out

tombalaci46 · 10/29/2017, 21:10

Quote:

Originally Posted by KingDollar

i'm happy that you finally find it out

Yeah and also thank you for trying to help.

~~Taisu~~ · 10/29/2017, 22:53

Thank youuu

R3D* · 10/29/2017, 22:59

Thank you.

Xutan* · 10/30/2017, 18:23

why would you allow this opcode anyway? You should have an opcode whitelist and store only legit opcodes there. I'm not sure if the people above are being sarcastic or they really don't know.

elmagico321 · 10/30/2017, 20:58

Quote:

Originally Posted by Xutan*

why would you allow this opcode anyway? You should have an opcode whitelist and store only legit opcodes there. I'm not sure if the people above are being sarcastic or they really don't know.

true but he said " block the opcode" then it's a little mistake at the coding

blocking the opcode can be done from the exploit.txt " if you have a file for bad opcodes " or by making it like this

PHP Code:



 if(_pck.Opcode == 0x3510)  
{ 
Disconnect  
//or what ever you need to do  
}

sarkoplata · 10/31/2017, 00:36

Quote:

Originally Posted by Xutan*

why would you allow this opcode anyway? You should have an opcode whitelist and store only legit opcodes there. I'm not sure if the people above are being sarcastic or they really don't know.

this is a valid packet for BR files (stall network) and maybe I have it whitelisted for a reason.
Or people can still be using blacklists.
Don't be a ****.

Radoslavski · 08/20/2018, 18:21

Quote:

Originally Posted by sarkoplata

this is a valid packet for BR files (stall network) and maybe I have it whitelisted for a reason.
Or people can still be using blacklists.
Don't be a ****.

I have a complete white list for Black Rogue files, and this opcode has nothing to do with Stall network. It's not a valid Black Rogue opcode!

Only these are valid stall network opcodes.
0x7461,CLIENT_BR_STALLNETWORK_SEARCH
0x7462,CLIENT_BR_STALLNETWORK_CLOSE
0x7463,CLIENT_BR_STALLNETWORK_PURCHASE

So you can block it, it won't affect any functionality in BR Files.

sarkoplata · 08/20/2018, 18:27

Quote:

Originally Posted by Radoslavski

I have a complete white list for Black Rogue files, and this opcode has nothing to do with Stall network. It's not a valid Black Rogue opcode!

Only these are valid stall network opcodes.
0x7461,CLIENT_BR_STALLNETWORK_SEARCH
0x7462,CLIENT_BR_STALLNETWORK_CLOSE
0x7463,CLIENT_BR_STALLNETWORK_PURCHASE

Yeah well, but does it crash the BR Gameserver?

vietnguyen09 · 05/17/2020, 06:55

Quote:

Originally Posted by sarkoplata

Yeah well, but does it crash the BR Gameserver?

I know this thread is really old, but can you share the way you search the malicious? What software to use to see the packet one by one? Did you log all the packet by using Wireshark?

My SRO server files are getting crash so many times in the last few days, my DB are fine and I really don't know the main problem of that, I think there is a new exploit opcode we don't know.

sarkoplata · 05/17/2020, 07:33

Quote:

Originally Posted by vietnguyen09

I know this thread is really old, but can you share the way you search the malicious? What software to use to see the packet one by one? Did you log all the packet by using Wireshark?

My SRO server files are getting crash so many times in the last few days, my DB are fine and I really don't know the main problem of that, I think there is a new exploit opcode we don't know.

I logged every single opcode I received, except for the very common ones like ping, skill, move, chat etc. Through filter of course.

Then checked the odd looking ones just before the gameserver crashed.

You can't analyze the sro packet data with Wireshark I guess... You need a filter.

vietnguyen09 · 05/17/2020, 08:01

Quote:

Originally Posted by sarkoplata

I logged every single opcode I received, except for the very common ones like ping, skill, move, chat etc. Through filter of course.

Then checked the odd looking ones just before the gameserver crashed.

You can't analyze the sro packet data with Wireshark I guess... You need a filter.

Thanks for your really kindly reply. I have a filter but not own the source, I can code C# but I don't know where to start to built a simple filter to log all opcodes like you do. Is there any open-source simple filter project out there you know can give me a starting point?

I have this opcode list

but I think is not all valid code, can you share your list of valid opcodes?

Thanks for your time.