#Server Hacked

59 messages · Page 1 of 1 (latest)

gilded dagger
#

Alright, so basically commands were being executed to spawn zombies and helicopter events, and probably more that I haven't caught yet.

To be safe, I loaded the backup from hopefully before all of these commands were executed, but even looking through logs its clear it was done via the live console and not via in-game admin accounts.

My guess is the rcon password got leaked, so I'm hoping I can find out WHO was executing these commands, even if all I get is an IP address I can cross reference them with other players. I've reached out to the server provider for a connection report to see if any of the panel accounts were breached, but I'd like som guidance on how to find who was executing live console commands, if possible.

#

I'm also seeing this pop up in the console
LOG : Network , 1712117789860> 19,869,586,196> [02-04-24 23:16:29.860] > ConnectionManager: [RakNet] "new-incoming-connection" connection: guid=553942783708542776 ip=null steam-id=0 access= username="null" connection-type="Disconnected"

#

LOG : Network , 1712117791557> 19,869,587,893> [02-04-24 23:16:31.557] > ConnectionManager: [receive-packet] "login" connection: guid=553942783708542776 ip=null steam-id=0 access= username="null" connection-type="Steam"

gilded dagger
#

Checking the logs in notepad++, I see a ton of helicopers spawning (which, was reported by players)

#

Another admin of mine is concerned admins were spawned too, given there are a ton near his base suddenly in a long line

#

Personally, I think this is just normal zombiespawn settings and migration, but we're all confused what these blue squares are

#

@hoary cloak

white pivot
coarse copper
gilded dagger
gilded dagger
coarse copper
#

Since the Rcon is just forwarding the commands to the console

#

The closest you could get is getting an IP from the Rcon command, I can try checking if its logged anywhere

#

I did an Rcon test, and the logs would show up like this:

LOG : General , 1712227311866> 1,701,169,313> RCON: new connection Socket[addr=/MYIP,port=myport,localport=serverport]

#

Censored for obvious reasons, check if you have anything like that in your logs?

gilded dagger
#

Yeah rcon is what I suspected, lemme give that a shot and see what I see

#

god damn.....

#

ha

#

ok, but I do see something useful

#

Ok, so that is VERY telling

#

that means since I changed the password, they've tried to connect again

#

I think I found my culprit

#

I'm actually getting a lot of results, with password failed

#

One of them I'm getting daily, since before the server was pwned

#

It might be battle metrics? I dunno, I can see in plaintext an old password they were attempting

#

The rest of them are using it too. So far, I can't see one where the password actually succeeded, on the day where this was happening (the 2nd)

coarse copper
#

Depending if you personally use Rcon a lot, you could just block the port outright

#

I have it disabled myself, I just use the server console instead

gilded dagger
#

Ya, none of these results are very... helpful

#

One of them, the top one, is the only one that doesn't have "password incorrect" on it, and it connected right as the server started

#

I cross-reffed it with any IPs from players, and got no results

#

Which, doesn't exactly mean much. It could have been a non-player doing it, or it could be rcon from the provider

#

Do commands from the server console show up in the logs?

#

One thing I wanted to look into was if anyone had access to the console

coarse copper
#

They would yes

#

You can just type "test" or "save" and see how they look in the logs

gilded dagger
#

right, debug.txt is literally just a dump of the console, isnt it

#

hm. Well, no one used console to run the /chopper command, no hits in bikinitools or buffy's admin logs show usage of any admins running /chopper, I see a lot of failed rcon connections, and those that passed quit soon after and didnt run any commands within that time frame (that I can see)

#

Yet, in my server logs, I see a dozen helicopters spawned, one admin claimed a ton of zombies were spawned in artificially (I still think they may have been natural), and this was a day after banning someone who is known to do these sorts of things (or have someone else do them)

coarse copper
#

Hm, check the "admin" logs in that case?

#

If helicopters or other things are spawned through a gui, then no commands would be logged, since none are used

#

Same thing applies to items for example

gilded dagger
gilded dagger
# coarse copper Same thing applies to items for example

Yeah catching item hackers is a bit of a challenge. Buffys will show every cheat activation without access level, but wont show when people spawn in items. Only way I've caught those folk is by actually checking their inventory, then checking logs to see if they ever picked up those specific items

gilded dagger
# coarse copper If helicopters or other things are spawned through a gui, then no commands would...

I've seen the actual gui used too. Its a 3rd party tool that runs along-side zomboid, lua-injecting. Half of the buttons dont work, and those that do still pop-up in the logs, despite some people claiming its "undetectable" (actual quote from a guy I banned for cheating).

Half the time, the game crashes when loading it, there's some trick to get it working according to one guy who used said cheats, then showed me how he used it as part of a leniency deal for unbanning him.

#

So, I wonder if they used these cheats to spawn a ton of helicopters via a gui from this injector... I just kinda wonder why that wouldn't show up in logs. Like buffy or bikini will actually log every button click on any in-game admin UIs, but this program uses a totally 3rd party tool (similar to how enb config works) that overlays on top of the game. But, if clicking a button just runs a command or script, shouldn't that still show up?

coarse copper
#

Because the log only logs the actual commands being pushed to the console, not the actual activation process

#

The only thing that woudl be logged is that the helicopter activated, which is what you can see in the screenshot above

#

But since no command was sent, no command is logged

#

The cheats do not send commands as far as I understand them, they just outright activate the chopper

gilded dagger
#

I see