Fix targeting exploit!

[Kamron]

Fix targeting exploit!

There is an exploit with targeting, where a player can use Last Target, or manually target an item which is inside of a locked container. You can test this by taking an item and putting it into a locked container. Lock the container of course. On your staff character set the last target to that item, in my case I had just coded the empty bottle targeting for potion kegs.

Now set your accesslevel to player, and the container should be locked when you dclick it. Bring up the targeter and execute your last target or absolute target. In my case, I was able to fill an empty bottle with potion liquid.

Here is the code to fix this exploit - Place this under the OnSnoop function in LockableContainer.cs

		public override bool CheckTarget( Mobile from, Server.Targeting.Target targ, object targeted )
		{
			if ( m_Locked && targeted != this && from.AccessLevel < AccessLevel.GameMaster )
				return false;
			else
				return base.CheckTarget( from, targ, targeted );
		}

 

[Acronis]

There is an exploit with targeting, where a player can use Last Target, or manually target an item which is inside of a locked container. You can test this by taking an item and putting it into a locked container. Lock the container of course. On your staff character set the last target to that item, in my case I had just coded the empty bottle targeting for potion kegs.

Now set your accesslevel to player, and the container should be locked when you dclick it. Bring up the targeter and execute your last target or absolute target. In my case, I was able to fill an empty bottle with potion liquid.

Here is the code to fix this exploit - Place this under the OnSnoop function in LockableContainer.cs

		public override bool CheckTarget( Mobile from, Server.Targeting.Target targ, object targeted )
		{
			if ( m_Locked && targeted != this && from.AccessLevel < AccessLevel.GameMaster )
				return false;
			else
				return base.CheckTarget( from, targ, targeted );
		}

No way! that is a very serious exploit. Nice catch.

Another way this can be exploited is if someone knows the serial of an item, that person could potentially steal it right out of a locked down container in a house, for example. There's also an exploit to initiate a house trade without the owner's consent but I have not been able to figure how that one is done yet. I've witnessed it several times on my shard.

 

[Kamron]

Yeah, I haven't been able to figure it out yet either. There is a trick where you place a house, and if the signs are nearby (I forget which houses it works with), you can initiate a house trade of a different house, tricking the person.

 

[Lord_Greywolf]

the signs would have to be about 3 steps away from each other, (with them standing close to both)
or the person being tricked would not know about the 2 step limit from the sign for house trading, then could be farther apart

 

[tearsguild]

i have noticed when i targeted the wrong iten due to last target that i had the sign for my huse went into my backpack from one of the castles on my shard and it can be opened in town and my customs are the same way and can relocate moving crate outside the house on a differant are of a map ie in tram where house is in fel

 

[Rasmenar]

Correct me if I am wrong, but actually attempting to steal an item with the Stealing skill from a locked down container will fail, there's checks in the Script to make sure that can't happen.

As far as I know, most locked down containers are secured by default, so if you are storing an item like a Potion Keg inside of one, nobody should be able to access it except for those allowed to access the container via the security you set on it.

It seems as if you have to be a staff member to open the locked/secured container first, target whatever it is you wish to exploit, and then become a player to do it. I don't think just a regular player will be able to use this at all.

 

[Kamron]

Correct me if I am wrong, but actually attempting to steal an item with the Stealing skill from a locked down container will fail, there's checks in the Script to make sure that can't happen.

As far as I know, most locked down containers are secured by default, so if you are storing an item like a Potion Keg inside of one, nobody should be able to access it except for those allowed to access the container via the security you set on it.

It seems as if you have to be a staff member to open the locked/secured container first, target whatever it is you wish to exploit, and then become a player to do it. I don't think just a regular player will be able to use this at all.

Every item has a serial number, and its not that difficult to set up macros to utilize items which are inside of locked containers based on serial number. Yes you need to know the serial number, but if you are there while someone is locking/unlocking the container, or whatever the case might be, then the person can use the item.

 

[Stygian Stalker]

House trade scam relies on Custom Houses being used.


Regular houses the sign is to the RIGHT and Custome houses the Sign is to the LEFT so you lure the mark inbetween the two houses, usually a small wooden and a huge custom and offer to sell them the custom. Owning the Custom makes it easier to scam in that you can show them around and move things around ect. If not just takes a bit more work of lying through your teeth.

So the TRICK is really just a scam, and usually a good way to allow the jerks on your shard to chase away your new players.

 

[Lord_Greywolf]

or you just make it so houses can not be placed 3 tiles apart (mine is set for 5 - players complain on it sometimes because they can not always build like they used to lol)
but that way can not be close enough to other house to make the false trade