Page 1 of 1

Need help with exploits in CT2.4 (fixes inside)

Posted: Sat Mar 14, 2015 6:33 pm
by JMD
Does anyone know what critical exploits have show up from Epilogue till now? Or at least help me in any way to find them?

Re: Need help with exploits.

Posted: Fri Mar 20, 2015 11:10 pm
by Gries

Re: Need help with exploits.

Posted: Sat Mar 21, 2015 6:12 pm
by JMD
i know about it but since the old trac is password protected now i cant look at the diffs.

Re: Need help with exploits.

Posted: Mon Mar 23, 2015 12:06 am
by Gries
JMD wrote:i know about it but since the old trac is password protected now i cant look at the diffs.
Here you go:
http://trac.l2jfree.com/l2jserver/changeset/6477

Code: Select all

Index: /branches/unstable/L2J_Server_BETA/java/com/l2jserver/gameserver/network/clientpackets/AuthLogin.java
===================================================================
--- /branches/unstable/L2J_Server_BETA/java/com/l2jserver/gameserver/network/clientpackets/AuthLogin.java	(revision 6365)
+++ /branches/unstable/L2J_Server_BETA/java/com/l2jserver/gameserver/network/clientpackets/AuthLogin.java	(revision 6477)
@@ -72,7 +72,14 @@
 		if (client.getAccountName() == null)
 		{
-			client.setAccountName(_loginName);
-			LoginServerThread.getInstance().addGameServerLogin(_loginName, client);
-			LoginServerThread.getInstance().addWaitingClientAndSendRequest(_loginName, client, key);
+			// Preventing duplicate login in case client login server socket was disconnected or this packet was not sent yet
+			if (LoginServerThread.getInstance().addGameServerLogin(_loginName, client))
+			{
+				client.setAccountName(_loginName);
+				LoginServerThread.getInstance().addWaitingClientAndSendRequest(_loginName, client, key);
+			}
+			else
+			{
+				client.close((L2GameServerPacket) null);
+			}
 		}
 	}
Index: /branches/unstable/L2J_Server_BETA/java/com/l2jserver/gameserver/LoginServerThread.java
===================================================================
--- /branches/unstable/L2J_Server_BETA/java/com/l2jserver/gameserver/LoginServerThread.java	(revision 6365)
+++ /branches/unstable/L2J_Server_BETA/java/com/l2jserver/gameserver/LoginServerThread.java	(revision 6477)
@@ -462,8 +462,9 @@
 	 * @param account the account
 	 * @param client the client
-	 */
-	public void addGameServerLogin(String account, L2GameClient client)
-	{
-		_accountsInGameServer.put(account, client);
+	 * @return {@code true} if account was not already logged in, {@code false} otherwise
+	 */
+	public boolean addGameServerLogin(String account, L2GameClient client)
+	{
+		return _accountsInGameServer.putIfAbsent(account, client) == null;

Re: Need help with exploits.

Posted: Mon Mar 23, 2015 12:35 am
by JMD
Thank you.

Here is the fix for CT2.4
Gist by: JMD13

Re: Need help with exploits.

Posted: Tue Mar 24, 2015 7:37 pm
by Gries
Probably this one too
viewtopic.php?f=77&t=29776

Re: Need help with exploits.

Posted: Tue Mar 24, 2015 7:55 pm
by JMD
Gries wrote:Probably this one too
viewtopic.php?f=77&t=29776
Nice thanks.
Gist by: JMD13

Re: Need help with exploits in CT2.4 (fixes inside)

Posted: Wed Apr 01, 2015 7:27 pm
by Gries
It appears that L2jFree site is now down, can't check changes anymore now :cry: