MPGHThe Dark Arts
RegisterLog in

Warning to Anyone Using Phoenix Source

Posts 1–15 of 21 · Page 1 of 2
Warning to Anyone Using Phoenix Source
This is not intended to start an argument,

I just think that people should know what's inside the source code.

 
player.cs
case 8:
Name = "[Founder] " + psr.Account.Name;
break;
}
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
{
Name = "[CM] " + psr.Account.Name;
}
if (AccountId == 3618)
{
Name = "[HQA] " + psr.Account.Name;
}
Level = psr.Character.Level;
Experience = psr.Character.Exp;
ExperienceGoal = GetExpGoal(psr.Character.Level);
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
Stars = 666;
else if (psr.Account.Rank > 2)
Stars = 95;
else if (psr.Account.Rank > 1)
Stars = 90;
else
Stars = GetStars(); //Temporary (until pub server)
Texture1 = psr.Character.Tex1;
Texture2 = psr.Character.Tex2;
Credits = psr.Account.Credits;
NameChosen = psr.Account.NameChosen;
CurrentFame = psr.Account.Stats.Fame;
Fame = psr.Character.CurrentFame;
var state = psr.Account.Stats.ClassStates.SingleOrDefault(_ => _.ObjectType == ObjectType);
FameGoal = GetFameGoal(state != null ? state.BestFame : 0);
Glowing = false;
Guild = psr.Account.Guild.Name;
GuildRank = psr.Account.Guild.Rank;
if (psr.Character.HitPoints <= 0)
{
HP = psr.Character.MaxHitPoints;
psr.Character.HitPoints = psr.Character.MaxHitPoints;
}
else
HP = psr.Character.HitPoints;
MP = psr.Character.MagicPoints;
ConditionEffects = 0;
OxygenBar = 100;

Decision = 0;
combs = new Combinations();
price = new Prices();

Locked = psr.Account.Locked ?? new List<int>();
Ignored = psr.Account.Ignored ?? new List<int>();


This allows them to register with Lucifer Luciferus or Amaymon and abuse your server like they did mine.

just rename to something that they will not get or at-least remove from downloads as this is a massive risk.
#1 ·
What a backdoor!
#2 ·
Quote Originally Posted by realmmods2014 View Post
This is not intended to start an argument,

I just think that people should know what's inside the source code.

 
player.cs
case 8:
Name = "[Founder] " + psr.Account.Name;
break;
}
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
{
Name = "[CM] " + psr.Account.Name;
}
if (AccountId == 3618)
{
Name = "[HQA] " + psr.Account.Name;
}
Level = psr.Character.Level;
Experience = psr.Character.Exp;
ExperienceGoal = GetExpGoal(psr.Character.Level);
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
Stars = 666;
else if (psr.Account.Rank > 2)
Stars = 95;
else if (psr.Account.Rank > 1)
Stars = 90;
else
Stars = GetStars(); //Temporary (until pub server)
Texture1 = psr.Character.Tex1;
Texture2 = psr.Character.Tex2;
Credits = psr.Account.Credits;
NameChosen = psr.Account.NameChosen;
CurrentFame = psr.Account.Stats.Fame;
Fame = psr.Character.CurrentFame;
var state = psr.Account.Stats.ClassStates.SingleOrDefault(_ => _.ObjectType == ObjectType);
FameGoal = GetFameGoal(state != null ? state.BestFame : 0);
Glowing = false;
Guild = psr.Account.Guild.Name;
GuildRank = psr.Account.Guild.Rank;
if (psr.Character.HitPoints <= 0)
{
HP = psr.Character.MaxHitPoints;
psr.Character.HitPoints = psr.Character.MaxHitPoints;
}
else
HP = psr.Character.HitPoints;
MP = psr.Character.MagicPoints;
ConditionEffects = 0;
OxygenBar = 100;

Decision = 0;
combs = new Combinations();
price = new Prices();

Locked = psr.Account.Locked ?? new List<int>();
Ignored = psr.Account.Ignored ?? new List<int>();


This allows them to register with Lucifer Luciferus or Amaymon and abuse your server like they did mine.

just rename to something that they will not get or at-least remove from downloads as this is a massive risk.
Thank You for this great information, @Raple can you sticky this? People must be aware of this!
#3 ·
Temporary sticky to let people know of the issue.
#4 ·
Quote Originally Posted by realmmods2014 View Post
This is not intended to start an argument,

I just think that people should know what's inside the source code.

 
player.cs
case 8:
Name = "[Founder] " + psr.Account.Name;
break;
}
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
{
Name = "[CM] " + psr.Account.Name;
}
if (AccountId == 3618)
{
Name = "[HQA] " + psr.Account.Name;
}
Level = psr.Character.Level;
Experience = psr.Character.Exp;
ExperienceGoal = GetExpGoal(psr.Character.Level);
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
Stars = 666;
else if (psr.Account.Rank > 2)
Stars = 95;
else if (psr.Account.Rank > 1)
Stars = 90;
else
Stars = GetStars(); //Temporary (until pub server)
Texture1 = psr.Character.Tex1;
Texture2 = psr.Character.Tex2;
Credits = psr.Account.Credits;
NameChosen = psr.Account.NameChosen;
CurrentFame = psr.Account.Stats.Fame;
Fame = psr.Character.CurrentFame;
var state = psr.Account.Stats.ClassStates.SingleOrDefault(_ => _.ObjectType == ObjectType);
FameGoal = GetFameGoal(state != null ? state.BestFame : 0);
Glowing = false;
Guild = psr.Account.Guild.Name;
GuildRank = psr.Account.Guild.Rank;
if (psr.Character.HitPoints <= 0)
{
HP = psr.Character.MaxHitPoints;
psr.Character.HitPoints = psr.Character.MaxHitPoints;
}
else
HP = psr.Character.HitPoints;
MP = psr.Character.MagicPoints;
ConditionEffects = 0;
OxygenBar = 100;

Decision = 0;
combs = new Combinations();
price = new Prices();

Locked = psr.Account.Locked ?? new List<int>();
Ignored = psr.Account.Ignored ?? new List<int>();


This allows them to register with Lucifer Luciferus or Amaymon and abuse your server like they did mine.

just rename to something that they will not get or at-least remove from downloads as this is a massive risk.
Thanks but I guess that I would just leave it there as they can't join mine :P and I can register as Lucifer Luciferus or Amaymon myself but thanks for the warning. I guess that's what they call by attacking your server
#5 ·
We didn't necessarily do this to "attack servers". It was used as a hardcode to give DM status to our head dev. However, seeing as Realm Mods decided to blatantly use our source with little to no editions, and didn't even give credit, a part of our team decided to make an attack on Realm Mods. However, the problem is resolved. I do believe this is an important thing for people to know.
#6 ·
Quote Originally Posted by Stellar Spark View Post
We didn't necessarily do this to "attack servers". It was used as a hardcode to give DM status to our head dev. However, seeing as Realm Mods decided to blatantly use our source with little to no editions, and didn't even give credit, a part of our team decided to make an attack on Realm Mods. However, the problem is resolved. I do believe this is an important thing for people to know.
yes I agree
#7 ·
Quote Originally Posted by Stellar Spark View Post
We didn't necessarily do this to "attack servers". It was used as a hardcode to give DM status to our head dev. However, seeing as Realm Mods decided to blatantly use our source with little to no editions, and didn't even give credit, a part of our team decided to make an attack on Realm Mods. However, the problem is resolved. I do believe this is an important thing for people to know.
Yeah, it's funny how we are seen as evil masterminds while we ourselves only realized it could be used as a backdoor by pure coincidence.
#8 ·
This is so funny, yet it was one of the first things i saw when i got to editing it.
#9 ·
I think this should be unstickied, this exploit isn't present in Phoenix 1.9.2 from what I believe and the attacks on other servers with this method has subsided.

@Raple @Lovroman
#10 ·
A very similar thing with doomed source, just dif names
#11 ·
For those people who may not know how to solve this.

Code:
           /** if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
                Stars = 666;
            else*/ if (psr.Account.Rank > 2)
                Stars = 100;
            else if (psr.Account.Rank > 1)
                Stars = 95;
            else
Just do that or remove the code, I prefer to keep it in there.
#12 ·
None of the code posted had literally nothing to do with the rank override -.- It's just cosmetic changes
#13 ·
Quote Originally Posted by Kithio View Post
None of the code posted had literally nothing to do with the rank override -.- It's just cosmetic changes
Yep. The actual rank override is hidden somewhere else

If I were to login as one of the accounts on a Phoenix server (as long as the username wasn't banned in the first place or already registered), I would be able to kill everyone
#14 ·
Quote Originally Posted by Ahl View Post
Yep. The actual rank override is hidden somewhere else

If I were to login as one of the accounts on a Phoenix server (as long as the username wasn't banned in the first place or already registered), I would be able to kill everyone
BS i've searched for an hour now. I can't find anything. Still looking though.


Does this have anything to do with it,


 
Code
internal class LuciferTestingCommand : ICommand
{
public string Command
{
get { return "lucitest"; }
}

public int RequiredRank
{
get { return 9; }
}

public void Execute(Player player, string[] args)
{
player.Client.Reconnect(new ReconnectPacket
{
Host = "",
Port = 2050,
GameId = World.ADM_ID,
Name = "Admin Room",
Key = Empty<byte>.Array,
});
}
}
#15 · edited ·
Posts 1–15 of 21 · Page 1 of 2

Post a Reply

Tags for this Thread

None

Need help?