Hacker - RunUO

Stormy1 · 11-29-2005, 10:04 AM

We confirmed the exploit and the bug in the runuo core we also are fairly certain now we know the program our hacker was using to send these altered packets to the server. That information will be withheld in the interest of denying the script kiddies an easy crash.
I hope to see a fix for the general user of runuo soon, since I am confused about the legalities of posting a fixed server.exe
*Edit*
Reminded I might need to break this down for some.
Runuo is adding checks in the core to see if a property is null and then turning around and REFERENCING null as a write to console line :/
http://www.orbsydia.com/forum/showth...newpost&t=3071

Viago · 11-30-2005, 07:12 AM

Quote:

I know this is going to seem somewhat silly to you, but after my first post all others have been made for the information of others. We did turn auto acct creation for the duration of the attack except when testing fixes.
Shortly after the first post the problem was found and corrected.
Any other shard out there with auto create acct which is default setting in runuo and running the distro runuo files has not been fixed.
There are tons of users out there of runuo that don't know much about how it works inside and that is perfectly fine. They however do deserve to know that such a problem exists and that there is a solution to it. The hacker attacking my shard will eventually turn to other places, at least that is my bet and with that very same exploit. To deny others the knowledge of it and how to fix it seems pretty mean spirited.

i agree, im looking to fix this on my shard, any info whould be lovely aswell. as i was unaware to this.

Stormy1 · 11-30-2005, 09:09 AM

The information was given to Asayre8 on irc before the website returned to service. We were told it was one of our scripts...subsequent testing disproved that. It was also posted by another person in the thread i referenced above as well as the one line fix for it.
The fix requires a one line core mod hence the post here. Plus the fact no one really wants to be found posting an altered exe file to runuo with the legalities being hazy all the way around.
I was reluctant to post the exact line and fix because kids love stuff like this. However it will require they actually understand what a packet is and know what program to use and how to edit it. It is hopeful a script kiddy version wont come out tommorow unless our hacker becomes overgenerous and starts to share

I expected this thread to be jumped on like, a fat kid on a twinky, and either declaimed or flamed instead it appears to have become a stepchild.
Rarely have I seen this happen on runuo where the verbal savagery is often unchecked.
Go figure :/
Only thing I can think is someone decided "Ignore it and it will go away".
"Dont the emporer's new clothes look fantastic?"
I have done what I may to inform those here about the problem for the users who can't edit their own core.
The issue is posted on orbsydia as is the simple fix for it for those of you who can edit your own core.

Viago · 12-01-2005, 03:45 AM

well i hope the 2.0 will have this fixed, there wer alot of buggs in 1.0's release from what i have seen, and experianced. i love runuo, and sometimes it seems that thesafeness seems exagerated, when there is somethign like this, and there is no fix being released. (being released by the team) but as i said i love runuo.

if you could pm me further information o nthe subject, ie the Exact fix, as artis seems veage to me, and some other viewers im sure.

as i have another exploit that i have found, and its in the distro player vendor. i duno if its been found out befor, but i need fix for that too heh

masternightmage · 12-01-2005, 05:47 AM

just plane crazy! hehehe

pappppp · 12-01-2005, 11:36 AM

Quote:

It is hopeful a script kiddy version wont come out tommorow unless our hacker becomes overgenerous and starts to share

aww lisa, why would i wanna go and do a thing like that? my problem isn't with the runuo community, it's with you.

(and psst, shouldn't a 35 year old be able to spell a word as simple as "tomorrow"?)

Woody-NAE · 12-01-2005, 03:38 PM

Quote:

Originally Posted by pappppp

aww lisa, why would i wanna go and do a thing like that? my problem isn't with the runuo community, it's with you.

(and psst, shouldn't a 35 year old be able to spell a word as simple as "tomorrow"?)

Take a hike, You find pleasure in bringing down a free shard? Someone makes the effort to pay for hosting so that other people can play a game for free. What you accomplished was nothing... So you found an undocumented feature in the core. Big deal it was a minor inconvience to us. You exploited it and we plugged it.

Johabius · 12-01-2005, 05:58 PM

Quote:

Originally Posted by pappppp

(and psst, shouldn't a 35 year old be able to spell a word as simple as "tomorrow"?)

On that same note shouldn't someone like you be able to capitalize the first word of a sentence? Those who are without sin, please feel free to cast stones, in all other cases take your useless flames elsewhere

pappppp · 12-01-2005, 06:16 PM

Quote:

Originally Posted by Johabius

On that same note shouldn't someone like you be able to capitalize the first word of a sentence? Those who are without sin, please feel free to cast stones, in all other cases take your useless flames elsewhere

um, that was intentional. purposely not capitalizing the first character of a sentence (or any character for that matter) isn't equal to the inability to spell words as simple as "tomorrow."

..but thanks for playing.

pappppp · 12-01-2005, 06:19 PM

Quote:

Originally Posted by Woody-NAE

Take a hike, You find pleasure in bringing down a free shard? Someone makes the effort to pay for hosting so that other people can play a game for free. What you accomplished was nothing... So you found an undocumented feature in the core. Big deal it was a minor inconvience to us. You exploited it and we plugged it.

haha, you're fucking stupid. an undocumented feature isn't the same as not properly checking whether or not an object exists before trying to edit it. perhaps you should a) shut the fuck up. b) read a book. c) never post in this thread again.

the decision is yours, professor.

smokified · 12-01-2005, 09:47 PM

I find it funny that the biggest internet "hard asses" are the smallest nerdiest little bastards in real life. I would bet pappppp wouldn't have the balls to talk like that to anyone face to face.

And before you start your ignorant immature ranting while at the same time trying to proove that you are more intelegent than me, just sit back and think of the reality of the situation.

pappppp · 12-01-2005, 09:49 PM

Quote:

Originally Posted by smokified

I find it funny that the biggest internet "hard asses" are the smallest nerdiest little bastards in real life. I would bet pappppp wouldn't have the balls to talk like that to anyone face to face.

And before you start your ignorant immature ranting while at the same time trying to proove that you are more intelegent than me, just sit back and think of the reality of the situation.

325 hand drive, godfrey IL. anytime you wanna come by, fine by me.

oh and "intelegent"? you're not even trying

IHaveRegistered · 12-01-2005, 10:32 PM

Something tells me this will be locked. I believe it should with all the 'violence' in here.

PS. Street names are supposed to be capitalized...

Arvoreen · 12-01-2005, 10:36 PM

Quote:

Originally Posted by IHaveRegistered

PS. Street names are supposed to be capitalized...

Nah, remember the thing about not capitalizing anything?

*edit: Oh, I think crashing servers is wrong, not cool. Even over private disputes. Then again, I'm a pacifist.

pappppp · 12-01-2005, 10:47 PM

Quote:

Originally Posted by Arvoreen

Nah, remember the thing about not capitalizing anything?

*edit: Oh, I think crashing servers is wrong, not cool. Even over private disputes. Then again, I'm a pacifist.

at least ONE of you fucking people can read.

perhaps i should post the source code/executable for the exploit.

Woody-NAE · 12-02-2005, 09:57 AM

There are plenty of things I'd like to say to you right now but I've been advised not to comment on an ongoing investigation...

eviltimmy · 12-02-2005, 10:50 AM

Quote:

Originally Posted by Arvoreen

Nah, remember the thing about not capitalizing anything?

*edit: Oh, I think crashing servers is wrong, not cool. Even over private disputes. Then again, I'm a pacifist.

Hrm .. not capitalizing anything hey..

Well, I could count 1 (Nah), 2 ... (Oh), 3 ... (Even), 4... (Then), and oh, 5 (I'm) capitals in that post :P

Lol, your a fucking idiot :P You can't even attempt to be funny/smartassed/intelligent correctly

Arvoreen · 12-02-2005, 11:29 AM

Ok, for people that are stupid, like eviltimmy, here is the conversation that took place:

Quote:

Originally Posted by pappppp

um, that was intentional. purposely not capitalizing the first character of a sentence (or any character for that matter) isn't equal to the inability to spell words as simple as "tomorrow."

..but thanks for playing.

Quote:

Originally Posted by pappppp

325 hand drive, godfrey IL. anytime you wanna come by, fine by me.

oh and "intelegent"? you're not even trying

Quote:

Originally Posted by IHaveRegistered

Something tells me this will be locked. I believe it should with all the 'violence' in here.

PS. Street names are supposed to be capitalized...

Quote:

Originally Posted by Arvoreen

Nah, remember the thing about not capitalizing anything?

*edit: Oh, I think crashing servers is wrong, not cool. Even over private disputes. Then again, I'm a pacifist.

And then on to this loser's reply, when he had no idea WTF he was talking about:

Quote:

Originally Posted by eviltimmy

Hrm .. not capitalizing anything hey..

Well, I could count 1 (Nah), 2 ... (Oh), 3 ... (Even), 4... (Then), and oh, 5 (I'm) capitals in that post :P

Lol, your a f*****g idiot :P You can't even attempt to be funny/smartassed/intelligent correctly

Wow, listen to you. I was merely commenting that THAT GUY, THE SHARD CRASHER GUY, NOT FRICKIN ME, never caps anything. WTF is your problem anyway? Obviously YOU are the f*****g idiot, (or, you're, get it right retard), seeing as you cannot even differentiate between people posting in a forum.

I obviously have much greater capacity for intelligence than you do, since I:
1) Can spell
2) Can read
3) Know the difference between your and you're
4) Don't start throwing around insults when I don't know what the HELL I'm talking about.

Well, I think that's everything eviltimmy, so until you grow a brain, f**k off.

*sorry for this rant everyone else, but this guy/girl/whatever is a moron. I came back, removed my swears, and also added the history of conversation so everyone will understand how stupid this person is for jumping on me for, hmm, I'm not even sure what. And I'm the idiot? LOL!

eviltimmy · 12-02-2005, 09:29 PM

Quote:

Originally Posted by Arvoreen

Ok, for people that are stupid, like eviltimmy, here is the conversation that took place:

And then on to this loser's reply, when he had no idea WTF he was talking about:

Wow, listen to you. I was merely commenting that THAT GUY, THE SHARD CRASHER GUY, NOT FRICKIN ME, never caps anything. WTF is your problem anyway? Obviously YOU are the f*****g idiot, (or, you're, get it right retard), seeing as you cannot even differentiate between people posting in a forum.

I obviously have much greater capacity for intelligence than you do, since I:
1) Can spell
2) Can read
3) Know the difference between your and you're
4) Don't start throwing around insults when I don't know what the HELL I'm talking about.

Well, I think that's everything eviltimmy, so until you grow a brain, f**k off.

*sorry for this rant everyone else, but this guy/girl/whatever is a moron. I came back, removed my swears, and also added the history of conversation so everyone will understand how stupid this person is for jumping on me for, hmm, I'm not even sure what. And I'm the idiot? LOL!

Hehe, my apologies :S

I was attacking the wrong person, i neglected to read your name :S

Sorry dude

Anyhow, the hacker guy is a fuckhead.

Vorspire · 12-02-2005, 10:22 PM

@pappppp

English is your second language, isn't it? You don't have a first. Your ineffective imitation of good posting style only serves to illuminate your lack of substance, good taste, and decency.

When I want your monkey-brained opinion I'll rattle your cage, okay? You must have a very large brain to hold such a vast amount of sheer ignorance. Reading your post makes blindness a wonderful thing to look forward to. As Robert Wilensky said: "We've all heard that a million monkeys banging on a million typewriters will eventually reproduce the entire works of Shakespeare. Now, thanks to the Internet, we know this is not true."

What possessed you to think that you were capable of being entertaining or interesting to read? Any friend of yours is a lousy judge of character. Seriously, I've come across decomposing dog carcases that are less offensive to the senses than you are. Maybe you wouldn't be such a Jerk-In-The-Box if you weren't intellectually slower than a herd of turtles stampeding through a vat of chunky peanut butter; if your weren't so fat that the elephants throw you peanuts at your local Zoo, or if you didn't have a face so ugly that Peeping Toms break into your house and close the blinds. Who am I kidding? You would.

In conclusion, sit down and shut up before trip over your own tongue and hurt yourself.

pappppp · 12-03-2005, 10:41 AM

Quote: