#Just reporting a string of logs that might tie into a Brush tool exploit or hack

9 messages · Page 1 of 1 (latest)

broken plover
#

Hello, I'm looking to see if this is a unique issue, or if it's known. I was diving through some of our public MP server logs (Particularly our map.txt files) and I found logged instances of Non admin account users being able to place IsoObject (roofs_02_22)

[04-12-22 19:48:10.632] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11865.0,6992.0,2.0.
[04-12-22 19:48:10.634] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11866.0,6992.0,2.0.
[04-12-22 19:48:10.636] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11867.0,6992.0,2.0.
[04-12-22 19:48:10.637] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11868.0,6983.0,1.0.
[04-12-22 19:48:10.639] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11869.0,6983.0,1.0.
[04-12-22 19:48:10.641] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11868.0,6984.0,1.0.
[04-12-22 19:48:10.643] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11869.0,6984.0,1.0.
[04-12-22 19:48:10.645] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11863.0,6986.0,2.0.
[04-12-22 19:48:10.646] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11864.0,6986.0,2.0.
[04-12-22 19:48:10.648] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11865.0,6986.0,2.0.
[04-12-22 19:48:10.651] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11866.0,6986.0,2.0.
[04-12-22 19:48:10.654] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11867.0,6986.0,2.0.
[04-12-22 19:48:10.657] 76561197992991411 "Dog Skeleton" added IsoObject (roofs_01_22) at 11868.0,6986.0,2.0.
[11:52 PM]
Look at how fast they are being placed
[11:53 PM]
Is this the game rendering it? Like wth..... That's like inhuman speeds.
[11:54 PM]
Another

#

[04-12-22 22:30:00.328] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12024.0,2657.0,2.0.
[04-12-22 22:30:00.330] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12025.0,2657.0,2.0.
[04-12-22 22:30:00.331] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12026.0,2657.0,2.0.
[04-12-22 22:30:00.333] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12027.0,2657.0,2.0.
[04-12-22 22:30:00.334] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12028.0,2657.0,2.0.
[04-12-22 22:30:00.336] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12024.0,2658.0,2.0.
[04-12-22 22:30:00.338] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12025.0,2658.0,2.0.
[04-12-22 22:30:00.339] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12026.0,2658.0,2.0.
[04-12-22 22:30:00.341] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12027.0,2658.0,2.0.
[04-12-22 22:30:00.343] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12028.0,2658.0,2.0.
[04-12-22 22:30:00.344] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12025.0,2659.0,2.0.
[04-12-22 22:30:00.346] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12026.0,2659.0,2.0.
[04-12-22 22:30:00.348] 76561198155570675 "ThaTrooth" added IsoObject (roofs_02_22) at 12027.0,2659.0,2.0.
[11:55 PM]
And always roofs_02_22

#

[04-12-22 18:53:16.981] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8120.0,11560.0,2.0.
[04-12-22 18:53:16.986] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8121.0,11560.0,2.0.
[04-12-22 18:53:16.988] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8122.0,11560.0,2.0.
[04-12-22 18:53:16.989] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8123.0,11560.0,2.0.
[04-12-22 18:53:16.991] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8124.0,11560.0,2.0.
[04-12-22 18:53:16.992] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8125.0,11560.0,2.0.
[04-12-22 18:53:16.994] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8126.0,11560.0,2.0.
[04-12-22 18:53:16.995] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8127.0,11560.0,2.0.
[04-12-22 18:53:16.997] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8128.0,11560.0,2.0.
[04-12-22 18:53:16.998] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8129.0,11560.0,2.0.
[04-12-22 18:53:17.000] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8123.0,11561.0,2.0.
[04-12-22 18:53:17.001] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8124.0,11561.0,2.0.
[04-12-22 18:53:17.003] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8125.0,11561.0,2.0.
[04-12-22 18:53:17.004] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8126.0,11561.0,2.0.
[04-12-22 18:53:17.006] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8120.0,11550.0,1.0.
[04-12-22 18:53:17.008] 76561198812907372 "Scooter" added IsoObject (roofs_02_22) at 8121.0,11550.0,1.0.

#

So I guess my main question would be is this some sort of exploit that is taking place where users are able to get a hold of the brush tool?

Or is this some sort of rendering that the logs for some reason tagged these users? I mean the speed is insane and would leave me to believe this. Though if this is the case why only these users? and why only "roofs_02_22"?

broken plover
#

Just reporting a string of logs that might tie into a Brush tool exploit or hack

vivid sapphire
#

I will add that we also had a user gain access to the brush tool and place fencing.
[03-12-22 17:00:28.277] 76561198054892664 "Yeetus" added IsoObject (fencing_01_50) at 10142.0,6634.0,0.0.

In addition we did have someone else join our server two weeks ago who had gained access to admin tools and began lacerating player’s necks and evaded bans 3 times.

broken plover
mellow pendant
#

Definitely looks like a brush tool, thanks for the report

#

Did you have all the anticheat options enabled on your server by the way?