I) hlds_vcrash
Description: Other names of this exploit is hlds_vcrash2, hlds_vcrash_fuck, hlds_vshell and numerous variations for use in cron. This exploit causes the error "
FATAL ERROR (shutting down): Host_Error: SV_ParseVoiceData: invalid incoming packet".
Vulnerable/Protected: It affects to all server protocols 47/48. Very old 46 protocol builds can withstand the attack due to an exploits authorization error on the server.
The first information about the vulnerability appeared in 2002
(proove). Hlds_vcrash exploits the error in processing SV_ParseVoiceData (voice data's from the clients).
Server crashes due the data in the second pacage:
00 00 00 01 00 00 00 00 5B 19 01 01 1B 01 11 41 01 11 41 01 56 04 18 41 04 54 14 04 11 51 41 44 53 41 11 01 41 11 01 01
This is encrypted data. In fact, this message when decoding looks like:
08 44 44 44 44 44 44 44
In this line 8 means a package type clc_voicedata (ie, voice data from the player).
Following 2 bytes (0x4444) - is the length of voice data.
And as known if a value greater than 0x1000 server falls itself (causes an error "Host_Error: SV_ParseVoiceData: invalid incoming packet" and exits). In this case we get entry in the log with IP attacker. Examples of logs, see below.
And this is what we get in a server console: (you can see attacker IP in there )
L 02/25/2010 - 23:55:09: [DPROTO]: Client 9 - Set AuthIdType 8 [dp_RevEmu]; pClient = 05C4E4E8
L 02/25/2010 - 23:55:09: "JWSD0ZpSYp4Ii5<12><STEAM_ID_LAN><>" connected, address "212.106.32.176:1104"
L 02/25/2010 - 23:55:09: [META] ini: Begin re-reading plugins list: c:/program files/cs_srvrs/2/cstrike/addons/metamod/plugins.ini
L 02/25/2010 - 23:55:09: [META] ini: Read plugin config for: dproto
L 02/25/2010 - 23:55:09: [META] ini: Read plugin config for: AMX Mod X
L 02/25/2010 - 23:55:09: [META] ini: Read plugin config for: xdsopt
L 02/25/2010 - 23:55:09: [META] ini: Finished reading plugins list: c:/program files/cs_srvrs/2/cstrike/addons/metamod/plugins.ini; Found 3 plugins
L 02/25/2010 - 23:55:09: [META] dll: Updating plugins...
L 02/25/2010 - 23:55:09: [META] dll: Finished updating 9 plugins; kept 3, loaded 0, unloaded 0, reloaded 0, delayed 0
L 02/25/2010 - 23:55:09: "goblun xRUSx<-1><><CT>" disconnected
L 02/25/2010 - 23:55:09: "182<-1><><CT>" disconnected
L 02/25/2010 - 23:55:09: "veshaemso<-1><><CT>" disconnected
L 02/25/2010 - 23:55:09: "FANTI K<-1><><>" disconnected
L 02/25/2010 - 23:55:09: "Nemo<-1><><CT>" disconnected
L 02/25/2010 - 23:55:09: "2GARIN<-1><><CT>" disconnected
L 02/25/2010 - 23:55:09: "kakaxa<-1><><TERRORIST>" disconnected
L 02/25/2010 - 23:55:09: "HLG AutoBot<-1><><TERRORIST>" disconnected
L 02/25/2010 - 23:55:09: "PILOTIK<-1><><CT>" disconnected
L 02/25/2010 - 23:55:09: World triggered "Round_Draw" (CT "0") (T "0")
L 02/25/2010 - 23:55:09: World triggered "Round_End"
L 02/25/2010 - 23:55:09: Server shutdown
L 02/25/2010 - 23:55:09: Log file closed
L 03/01/2010 - 15:24:35: "2A6U776LxfC4n<1><STEAM_0:0:14473480><>" connected, address "10.100.146.27:4671"
Host_Error: SV_ParseVoiceData: invalid incoming packet.
L 03/01/2010 - 15:24:35: [META] ini: Begin re-reading plugins list: /home/viktor/KS_servera/ubuntu_cs/cstrike/addons/metamod/plugins.ini
L 03/01/2010 - 15:24:35: [META] ini: Read plugin config for: AMX Mod X
L 03/01/2010 - 15:24:35: [META] ini: Read plugin config for: dproto
L 03/01/2010 - 15:24:35: [META] ini: Read plugin config for: xdsopt
L 03/01/2010 - 15:24:35: [META] ini: Finished reading plugins list: /home/viktor/KS_servera/ubuntu_cs/cstrike/addons/metamod/plugins.ini; Found 3 plugins
L 03/01/2010 - 15:24:35: [META] dll: Updating plugins...
L 03/01/2010 - 15:24:35: [META] dll: Finished updating 10 plugins; kept 3, loaded 0, unloaded 0, reloaded 0, delayed 0
Dropped 2A6U776LxfC4n from server
Reason: Server shutting down
L 03/01/2010 - 15:24:35: Server shutdown
L 03/01/2010 - 15:24:35: Log file closed
L 03/01/2010 - 15:24:35: FATAL ERROR (shutting down): Host_Error: SV_ParseVoiceData: invalid incoming packet.
FATAL ERROR (shutting down): Host_Error: SV_ParseVoiceData: invalid incoming packet.
The first and easiest option - install
Anti CS-DoS by Shockler. Starting from version 3.5 it comes with a fix for the "Host_Error: SV_ParseVoiceData". However, easiest - not always the right one. Tools itself periodically crashes with "OUT OF MEMORY", and the author self says "Use at your own risk".
For Linux you can install
HLShield 2.10.
2. Use patch VUP 2.7 (ViTYAN's GameServers Universal Patch) or newer from vityan666 (supports both Windows and Linux).
3. Another option is patching server binaries with hex-editor, for example, HxD.
Open swds.dll and change
3D 00 10 00 00 89 45 ?? 76
to
25 FF 0F 00 80 89 45 ?? EB
where ?? - two random character, which must be skipped.
The result should be like this:
Download prepatched .dll: Only registered users can upload files. Open engine_i686.so and change
50 E8 45 F1 F9 FF
to
90 90 90 90 90 90
or
89 85 F4 EF FF FF 3D 00 10 00 00 76
to
25 FF 0F 00 80 89 85 F4 EF FF FF EB
Download prepatched .so: Only registered users can upload files. Only registered users can upload files. For sick bonkers. You can install
Orpheu Module 2.2 +
special plugin +
script which can protect the server. How much memory will consume this module itself, wouldn't this add new problems - nobody knows. But conditionally this is the only legal way of protection from this exploit (perfect for sick STEAM lovers
).
P.S: On the Internet lined out a lot of ready patched libraries for different version servers builds. Remember that you must download proper patched .dll (.so) which is compatible with your server! Also, some info about patched .so from Shocker (Anti CSDoS Developer)
Quote: Originally Posted by SH@RK (translate from Russian language)
Anti CSDoS Author laid out here
http://www.freakz.ro/forum/FIX-Host_Error-...ata-t31559.html patched .so (from vcrash). He leave Host_Error, but he corrected Host_Error call function itself. It avoid call of CL_WriteMessageHistory, Con_Printf, Host_ShutdownServer, Sys_Error functions, and calls CL_Disconnect only. Well Con_Printf he apparently avoid in vain, but basically idea of editing Host_Error - a wonderful solution.
