Malicious Server Crashing Problem

[CassideyRae]

I am an admin on the >V< server and the server has been crashed repeatedly by several people with variable IP's. The message that is shown in the log after the crash is always "ERROR: Stopping due to possible infinite torso state loop". The server is crashed always at the very beginning of a round, after everyone has respawned but you can't move, the player does need to be in the server but doesn't need to be playing (aka can be in spec). Our Server has every patch available on this site for MoH:AA.

If anyone has any idea how to stop this or could list the sites they downloaded Server patches from or even say which patches you have if your server isn't crashed frequently, it would be extremely helpful. Also if anyone knows where to obtain the fix for people flooding your server with ''bots'' (making it so others can't enter the server because the bots take up all client slots) it would also help.

[SNYPE]

Does anyone actually claim responsibilty for the crashing? The reason I ask is that the only time I have seen the Infinite Torso Loop errors is some kind of mod conflict on the server. My first thought would be to remove mods and see how it runs, especially any that were recently added.

There is no standalone fix currently for the Bot problem. CI has a fix for it in their more recent releases.

[CassideyRae]

TEAMPKM.TK takes responsibility lol. They spam TEAMPKM.TK over and over then crash the server. Then fill it with bots if it is restarted right after the crash.

Could it be possible that a client is exploiting one of the fixes like the nade drop fix to make an infinite torso loop? The only mods on the server are fixes.

[Zepplin]

Found this sometime ago.

Some interesting reads at his site.

################################################## ######################

Title: Medal of Honor buffer-overflow fix 0.1
Author: Luigi Auriemma
e-mail: aluigi@altervista.org
web: http://aluigi.altervista.org

################################################## ######################


1) Introduction
2) Patch


################################################## ######################
http://aluigi.altervista.org/poc/mohaabof.zip
The official Linux patches are available from Icculus http://icculus.org/betas/mohaa/?M=A



===============
1) Introduction
===============


This program is able to automatically fix the bugged function of ANY
Windows version and ANY game based on the Medal of Honor engine:

Allied Assault <= 1.11v9
Spearhead <= 2.15
Breakthrough <= 2.40b

The bugged function lets an attacker to crash or execute malicious code
on the vulnerable server or client, so is better that you apply this fix
as soon as possible.
The advisory referred to this vulnerability is available here:

http://aluigi.altervista.org/adv/mohaabof-adv.txt

I have said that this program is an autopatcher, in fact it simply
searchs a specific pattern (a piece of the bugged function) and
substituites it with the new patched one.

Is important to say that this patch not only fixes the bug but also
makes that specific portion or code of Medal of Honor more fast and
clean, so you will spend less CPU cicles and time when managing the
queries and replies packets.


################################################## ######################

========
2) Patch
========


The following is the disassembled code of the patch (the offsets are
referred to the MOHAA dedicated server):


:00428FAD B0FF mov al, FF
:00428FAF 8B4D08 mov ecx, dword ptr [ebp+08]
:00428FB2 8B9DF4FBFFFF mov ebx, dword ptr [ebp+FFFFFBF4]

:00428FB8 8A11 mov dl, byte ptr [ecx]
:00428FBA 80FA5C cmp dl, 5C
:00428FBD 7426 je 00428FE5
:00428FBF 84D2 test dl, dl
:00428FC1 0F84A3010000 je 0042916A
:00428FC7 8813 mov byte ptr [ebx], dl
:00428FC9 41 inc ecx
:00428FCA 43 inc ebx
:00428FCB FEC8 dec al
:00428FCD 84C0 test al, al
:00428FCF 75E7 jne 00428FB8
:00428FD1 C60100 mov byte ptr [ecx], 00
:00428FD4 E991010000 jmp 0042916A

:00428FE5 894D08 mov dword ptr [ebp+08], ecx
:00428FE8 899DF4FBFFFF mov dword ptr [ebp+FFFFFBF4], ebx


:0042900C B0FF mov al, FF
:0042900E 8B4D08 mov ecx, dword ptr [ebp+08]
:00429011 8B9DF4FBFFFF mov ebx, dword ptr [ebp+FFFFFBF4]

:00429017 8A11 mov dl, byte ptr [ecx]
:00429019 80FA5C cmp dl, 5C
:0042901C 7430 je 0042904E
:0042901E 84D2 test dl, dl
:00429020 742C je 0042904E
:00429022 8813 mov byte ptr [ebx], dl
:00429024 41 inc ecx
:00429025 43 inc ebx
:00429026 FEC8 dec al
:00429028 84C0 test al, al
:0042902A 75EB jne 00429017
:0042902C C60100 mov byte ptr [ecx], 00
:0042902F E936010000 jmp 0042916A

:0042904E 894D08 mov dword ptr [ebp+08], ecx
:00429051 899DF4FBFFFF mov dword ptr [ebp+FFFFFBF4], ebx


################################################## ######################

http://aluigi.altervista.org/poc/mohaabof.zip
it is an autopatcher working with any Windows version of the game (Allied Assault, Spearhead and Breakthrough)

The official Linux patches are available from Icculus
http://icculus.org/betas/mohaa/?M=A

[CassideyRae]

I have now learned how they are crashing the server. They are calling the hand/arm shader aka "models\player\allied_SAS_fps.tik" Because this is ONLY the hand/arm shader it crashes the server because there are no torso/legs to display for one of the player models.

Is there any way to ensure that no one has "_fps" as their skin right at the very end of every round? Or if anyone knows some fix or a way to get one...

[StoneCold68]

i have a few scripts that will catch any alias key binds they maybe using to activate these by hitting a key such as bots skins sharking trigger bots wambot ibot it actually works really well and i have given it out to alot of my friends in the past , i do not know if it will catch this one issue but if it is bound to a key it should alert you when they hit it .
if this sounds like something you might need just email me wolfrik@msn.com i will send them right over. :undecided

[SNYPE]

I have now learned how they are crashing the server. They are calling the hand/arm shader aka "models\player\allied_SAS_fps.tik" Because this is ONLY the hand/arm shader it crashes the server because there are no torso/legs to display for one of the player models.

Is there any way to ensure that no one has "_fps" as their skin right at the very end of every round? Or if anyone knows some fix or a way to get one...
Your in luck! A new fix for this exploit was just posted at ModTheater.com:
http://www.fpsadmin.com/forum/showthread.php?t=9807
Its available in our Downloads:
http://www.fpsadmin.com/download/?dlid=315

[gfunk]

I made a fix for your problem put the btk hack fix in your main or mainta
http://borntokill.low-ping.com/user/30102/files/BTKFixes/BTKServerFix.zip
If you have any questions or comments visit our website www.Born-To-KiLL.com
:salute:

[CassideyRae]

This has stopped our server from being crashed everyday. Thank You much!

Im wondering though, What exactly is the reloadmapfix.zip. What is it stopping?

A new problem has arisen though, on our server we do not have a mod that kills people who try to press ''e'' on ladders. There hasn't been a problem with landsharking in the past so we let it stay that way. However, there is a glitch that i haven't seen in a long time involving switching teams while on ladders that teleports people to either the axis or allied spawns. Now that someone remembered this exploit ive seen 3-4 people use it, with variable IP's of course.

Does anyone know a non-obtrusive fix for this? (one that won't kill everyone who uses ''e'' on ladders)

[StoneCold68]

This has stopped our server from being crashed everyday. Thank You much!

Im wondering though, What exactly is the reloadmapfix.zip. What is it stopping?

A new problem has arisen though, on our server we do not have a mod that kills people who try to press ''e'' on ladders. There hasn't been a problem with landsharking in the past so we let it stay that way. However, there is a glitch that i haven't seen in a long time involving switching teams while on ladders that teleports people to either the axis or allied spawns. Now that someone remembered this exploit ive seen 3-4 people use it, with variable IP's of course.

Does anyone know a non-obtrusive fix for this? (one that won't kill everyone who uses ''e'' on ladders)
with the scripts i have it will tell you when they do it and say kick me kick me im cheating this way it helps out some

[gfunk]

This what you need http://borntokill.low-ping.com/user/30102/files/BTKFixes/75-anti%20sharks.zip This will get rid of all sharkers... and your still able to press the use button without killing you. This mod was not made by me... It was made from my friend elgan. He did a great job on it. It detects the body movements needed to shark and disables it. Enjoy... from the g-man! :salute: