(Source) Instant bomb explosion & instant defuse ("Lag Exploit")

I DONT TAKE ANY CREDITS FOR THIS!
ALL CREDITS GO TO @d0kt0rP3pp3r

GetUserCmd() with its checks is inlined in HookedWriteUsercmdDeltaToBuffer,
so you have to reimplement the function, otherwise you cant send the commands.
I also removed the backup-commands, if you dont want that, set cl_cmdbackup to 2

Code:

//CHLClient::WriteUsercmdDeltaToBuffer index == 23
 
bool __stdcall HookedWriteUsercmdDeltaToBuffer(int slot, void* buf, int from, int to, bool isnewcommand)
{
	int* pBackupCommands = reinterpret_cast<int*>(reinterpret_cast<uintptr_t>(buf) - 0x30);
	int* pNewCommands = reinterpret_cast<int*>(reinterpret_cast<uintptr_t>(buf) - 0x2C);
 
	int cl_cmdbackup = 0;
	*pBackupCommands = cl_cmdbackup;
 
	static bool firstcmd = false;
	if (from == -1) firstcmd = true;
 
	if (to > g_pClientState->lastoutgoingcommand - cl_cmdbackup)
	{
		if (firstcmd) from = -1;
		firstcmd = false;
		
		CUserCmd nullCmd;
		CUserCmd* cmdFrom;
		CUserCmd* cmdTo;
 
		if (from == -1)
		{
			cmdFrom = &nullCmd;
		}
		else
		{
			cmdFrom = g_pInput->GetUserCmd(from);
		}
 
		if (to == -1)
		{
			cmdTo = &nullCmd;
		}
		else
		{
			cmdTo = g_pInput->GetUserCmd(to);
		}
 
		static auto WriteUsercmd = reinterpret_cast<void (__fastcall*)(void* buffer, CUserCmd* from, CUserCmd* to)>((uintptr_t)GetModuleHandleA("client.dll") + 0x34FA10);
 
		__asm
		{
			mov ecx, buf;
			mov edx, cmdTo;
			push cmdFrom;
			call WriteUsercmd;
			add esp, 4h;
		}
	}
 
	return true;
}

Then all you have to do, is skipping some sequence-numbers & fakelag

Code:

if (bLagExploit)
	{
		sendpacket = (sequence_number % 10) == 0;
 
		//use multiples of 150 because thats the size of the command-buffer
		pCmd->command_number += 3 * 150; 
		g_pClientState->lastoutgoingcommand += 3 * 150;
		g_pClientState->m_NetChannel->m_nOutSequenceNr += 3 * 150;
	}

Enjoy