Forum

ETF2L Hacks and Exploits

Created 28th October 2010 @ 08:56

Add A Reply Pages: 1 2 3 Next »

N3tter

M

Dear ETF2L Head Admins and Developers,

Please take the time to read this whole thread before deleting/locking it.

[Edit] First of all, I’d like to apologize for the inconvenience this has caused. I’m sorry, but I saw it as kinda necessary.

I assume you have noticed that little exploit of mine while fixing the HTML bug in the team description yesterday. It was a simple JavaScript include to an external server which was able to do anything. What I did was spreading this script by getting all team ids of the visitor of the team page and change their team description so they are infected with this script too. Additionally I added a function to prevent removing the script by editing the team description, the script was multiplying itself and not removable without database access or disabled javascript. A little test I did with the script was to save all cookies of the visitor. Here are the statistics:
After 2 days I had 760 infected teams and 4’786 saved cookies sessions. The good part, it’s not possible to overtake a session by cloning the cookies, since you’d need the same ip.

The saving-the-cookies part was not very nice of me, I admit, but I already deleted all saved data.

What I also did with this script was to fix a bug of ETF2L, which is a very annoying bug in my opinion. It’s the escape bug of the team description. (You’re -> You’re). I was using this exploit to unescape the team description, you’re welcome.

My goal with this script was, when I reached 1000 infected teams, to replace the css of the team page and change the default colour from blue to pink (wouldn’t that have been fun?). The point of that was to give a fair warning about this exploit, because people who were not as nice as me could have used it to actually do some damage (enter/validate match results, change team names and descriptions, members, informations, basically everything a team admin can do).

I’m glad you did find the exploit before I actually used it. But now comes the bad side of the story:
You edited the team description handling to not allow HTML anymore but you didn’t bother to add the unescaping to the page :(.

Go fix that damn escape bug already!
Hint 1: http://php.net/manual/en/function.htmlspecialchars.php
Hint 2: http://php.net/manual/en/function.stripslashes.php

Kind Regards,
N3tter

(This is a proxy user which actually represents multiple people, you might delete this user if you want)


Last edited by N3tter,

naMu

LAITON
KUKKO!

wow

@@@@@@@@@@@@@@@@@@@@

lol

N3tter

M

Here’s a list of all teams that were infected:

!nsane.eSports
(0v0)
.LV
.pt
/gg/
/v/idya
:(
:>
[r@ts]
-=VIA=- TF2 Community Hig
19% 27%
2 Skinny Black Guys
2 Soldiers 1 Cup
2ez gaming
4_Gurus
404 – Skill Not Found
5 Quinas
6guys1cup
7 lives highlander
7 sisters
7466322e646b
8)*
8)*
8)*
8U Gaming
8U Highlander
9 mancos
9 Men
9 Men
9 Men
9 Men
9 Men Scandinavia
9 Strangers
9 yehudim she hem lo beem
9guys1cup
-9m- tikcus
A.k’s Merry Men
€G-Fanboyos
®Evolution
à ß Basketball Team
Accidental duplicate of o
Active-Art
AD
æ ±æ–¹Medals
ロリ団
after Future
AHEAHEAHEAHEA
ahrenznaet
ahrenznaet
Airstrafers Anonymous
Aleksi´s Angel
Alfred
Alpha Omega – Euro Squad
Amigo gaming
amrl?!
ana ze teama
Angels Of The Rebellion
Ansammlung Laestiger Krie
Ansammlung Laestiger Krie
Ãœberium
archkuz
Are you p0r?n [BBALL]
Argo [Highlander]
Aristocrits
Arla Gaming
Astral-Gaming
Atty’s Dead Pool
awesomesauce
babuolas
Back 2 Basics
back to Resupply
Bacon!
Badmen Enterprise
bagaren o smisk!
Balls of Glory
bandytka w chuj
BANZAI
bball and shit
bball kids
Bear Grylls
Belgium
Best o Fest I
Black Dragons
Blazing Falcons
Blight Gaming
Blitz-Legion
Blood is Good
Blood is Good
Blood is Good²
Blood is Good²
Blood Pressure bBall
Blorg and the fudge crew
BOOM MAXIMUM DAMAGE
Boot To The Head
Boot To The Head
Brass_Monkey
Bros-Gaming
BROzerkers
brt
Brynax
Buurman en Buurman
Cable internet Clan
Cable Internet Clan – IL
Can’t Shoot the Medic
Cardus
Carpe Diem
Casus Belli
Casus Belli KOTH
Catching Bullets
Cavaliers RED
Celebrity Gaming
Chłopaki ze Stajni
Changed
Choona
Choupinou
chris and d2m do it large
CiC Lakers
CiC Mantle
CiC Solar
CiC-Kop
Cleveridiot 2
cleveridiot blue edition
Click It Down
Click it Down
Clones-Inc
Coinz
cold
cold
colony
Comashot 8)
Combat-Folk
Constellation
Continuity
coolclan
coolmix
Corbina Campers
Core Gaming by DediFrag.c
cow says moo
Crack Clan // Blue
Crack Clan // Green
Crasp
Crit Happens
Crit Happens 2.0.
Croatia
Crucial KOTH
CTADO
cvx
cy@ sam
Cyborg
Czech Republic
Czech/Slovak Highlander T
Da Hypnotic Monkeys
daf
DagNoobTeam
Damage and Scars
DAMN YOU YOYOTECH!
Dark Stars
Dark Stars
DarkSouls
Dash Of Death
Dashing along them street
DayohBanden
DCSB Blu Team
Dead Cows Strike Back
DeathbyJG
Delirium
dem needles!
Demolition Squad
Denmark
Depth Gaming
Der Name ist so lang, den
Desperadoes
Destruction Brothers
Deux bords
Dictator
Dictum – Factum
Die Deutschen
Die Deutschen
Digital Warfare
Digital Warfare – Twitch
Digital Wrath Esports
Division 7 Professionals
Division Of Justice
Division Of Justice²
DK1ng
Dominansens riddare
Don’t Eat the Sandvich
Dont Kritz the Pyro
Dont shoot the Medic
Doomsters
Dope Boys ★
Dope Boys ★ Allstarz
DouGie
Down Town Cats
Dredz
DrFunkenstein Is Sexy
Drunk
Drunk Cowboys
Dumbass wordpress
duo31
Easy Going
Eclipse
Eclipse – Latvia
eddSTRUCTION
eL
Electric Scouts
Elegant People
Elemecontitalviolenuincet
Elite nile Gunners
Elite Nile Gunners
Elite Nile Gunners #2
Eliyahu Ha Navi
ENH #clamstackers
enixe
Envision
EPIC FU REACTION RAGE SQU
Epsilon eSports
Equality For ALL²
Esbrugamos
EssÄffchen | powered by
Estonia
Eternity
Evil Empire Headquarters
Evil Mishanja
eXhale community highland
exist
EXIT^
exotic-island
Explosive Devils
Explosive Waffle Observer
Exterminans
Fabulous Fabulist
Fabulous Thunderpussy
Fail
Failander
Failtrain
FakkelBrigade
fallen and reformed.
fallen and reformed.
fap fungus!
FDP
Feeding Boys
Feline Rights League
FFFFFFUUUUU-
Fifth Domination
Fire Axes BBall Team
FireFighters
fLCATERPILLAR
Flyman
FOG
Free Man’s
Freedom Fighters
Freedom Fighters
Frostbitten
Frozen Brains Tell No Tal
Fuck Yeah!
Funky Bear Pie
FunKy Is Sexy
G1deon^
Galgel ota !
Game Over Tactics
GamerX
GamingDeluxe 2
Gangsta Gang Gaming
Garza
Gathering of Tweakers Hig
Gathering of Tweakers Tea
Genocide
Get a Sponsor ?!?
GFM Clan
GFM Wise Monkeys
Global Interactive Gamers
Good at Last!
Got Milk?
Got Milk?
GoT.love
Green Syndicate
Green Syndicate
Gurka*
Guru Gaming
Guru Gaming
Guru training with Yoda
Harmful Hamsters
Head
Heartcore
Hey that’s!
Highlander Global Interac
Highlanders.LT
HmtrHreH`s
Hobbygam0r
Holy Mace-Wielding Minota
Holy Mace-Wielding Minota
HolyKoth !
HolyShit!
HOMOZZZ
HordeofGoats
Hungarian Warriors
Hunterzzzz
HURNSHNZERKLATSCHER
HYDRO
Hysteresis
Hysteresis Highlander
I Don
I Gladiatori
I Lontri
I nub!
I\’d Marry Jack Bauer
I’d Marry Jack Bauer
Ich hab alle!
iCon esport
IG Troopers
Iguana
Immortals
Imperium
Imperox Instagib
Imperox-eSports
Imperox-eSports
Impossible is nothing!
Impossible is nothing!
inab1ckle~ esports
Indignity
Infernal Gamers
Ins Gesicht
Insane Dynamite Monkeys
Intensive. Team
internecine
internecine
internefriends
iQue goes batshit
Ireland
Iron Sharks
It’s cold here!
Its Friday!
Janman
jazzy jazz
Je Suis Une Bibliothèque
ježek! community highlan
Jenova
jEx`Gaming
JOLT!
jukebox
K M highlander
k1ck
Karaoke Stars
KebabCharged
Kekse vor Leif!
Kenny damager..
Kiberzona Chíor Tai
Kiberzona Highlander Stri
KiFFERSTUEBCHEN.de
KillerInstincts Highlande
Kings of the beavers
kitoS
KITTEN
klan:fader
Knö i Hörn
Knifeback Mountain Best T
Knifeback Mountaineers
Knifeback Mountaineers
Knights
knock0ut
KOALAPUNCH
Kolhoza Draudziiba
kozaks
kuzmichspb
Kvakkistansen
LagTastic Gaming
LagTastic Gaming Highland
Last Man Standing
Late Night
Late Night Shinanigans HO
Latvia
Legalize!
Legion of Legends
Lethal-Zone Blue
Lethal-Zone Green
Lethal-Zone Highlander Co
liol
Lithuania
Lokalen Alpha
Lokalen Omega
lolex
Look of Disapproval
Look out !
Losing Victoriously
Loveninjas
Low Pressure
Lumberjacks Team
lvl^sc0ut
M
Man1a Crew
Marizzle
Marsik Midish
Massive
Maximum Games Community –
Maximum Games Community –
Meant 2 Be
meet The
MegaZeus
Memories
meNDi
Mendigo Gigante
Mental Frogs
Michael Jordan
Microownage
Mikey
Mile-Away Meatshots
Mister 2
-MM-
Mmphpry!
Mobbys Dick
mods.de Community-Team
moneymaker
morf
Morty is on a Mission
moustache Gaming
MoZz
Mrcine
MTF.Gaming – Paroxysm
multiplex
Munchies
myRevenge
myRevenge e.V. Lithuania
MYSTERY Gaming
mYsT-Gaming
MyTF.de Highlander
N1
N1
n1ne VS you
Nagatron
Neatmeat
Need a dispenser here!
Negative_Impact
Negative_Impact
NeoGamersView
nervousENERGY 90%airshots
nervousENERGY BLU
nervousENERGY Gold
nervousENERGY Highlander!
Netherlands
New Kids
nExis
Next Six Please
NGI Highlander
Nie dwóch na jednego lud
Nightmare
Nijntje
Nine Nasty Noobies
Nineteenth Century
Nitro
No Aim, Just Brain
No Limits
No Mercy
No ogar Team
No Pants No Lag
Nobody’s fault but mine
none
Nor
Northwave Gaming
Norway
Not Neutral
nubish trollz!
nuBreed Gaming
NUT
NwA
Nyctal
Obsessive Compulsive Dest
Oceanic Six
Okay, Thanks.
OMGLAZERPEWPEWPEW
Only Rockets Love You
Over Nine THOUSASSSSSND
OverClocked Gaming
overGame
Ownage Ownzorgzz
Paan meets MinD
Package
Pamppu
Paracocci
Paranoia eSports
Paroxysm
Penguins Can Fly
PENISPUMPPU
Perle Venner
Philete
Phoenix Squad
Phrozen Gaming
Pink Ponies
play
Please Shoot the Medic
Pointless
Pop like a Cherry
PowerRAGER
Poxel-Ride Gaming
ppb Solly powah
PremiuM
Propheteering!
Puffin
Punchline esc
PunchLine! Fun Club
PuRe
Purr and Meow
PwnShop Gaming
PyRo|GEN eSport
pzggpz
Quarantine
Rainbow DICKINGS
Rake
Really Awesome Teamname
Rebellion
RedBana
Release Yourself
Rembo en Rembo
renoB
Residents
Retsh0ck
Revenge
Revenge Me!
Riders On the Storm
Rimsky Korsakov
Rising aka Floooops !
Romania
Rosaline
Rostock Multigaming Freak
RTA Highlander
RTA2 2v2
Salade Tomates Oignons
Saxy<3
scenic
Schlachtfestchen.de // Te
Scotland
SdX Gaming
Sektor Gaming
Self_Destruction
SFF Gaming
Shamrocked!
Shi
SIBIRSKIE MEDVEDI
siGma
Six Silly Somethings
skeir
Skyride
Slackerz
SMACK!
Smart Move
sMisk
smurfs!
snikz
soo
soo
soo
soo
Sooyoung <3
Sosnooley
SourceOP
South Africa
soz4pwn
SpA|com highlander
Spam Effect
Spank
Sponsored Casuals
spx
Steampunks
Steev
Stew slows the team down
StormscaleElite
Strike a Pose
stupid name
SUGAR HILL GANG
Sugarbiscuits
Suitcase Nuke
Suitcase Nuke
Supasnipa
Super Gut
Superior Cows
Susi
Susi
Swedish Gentlemen
sweiny
Swifty <3s Yoona
Sword Masters
SyavaFanClub
sYnx team[dropped]
Taktyczny Ruch Kolanem
TCM-Gaming
Team 4 Friends 2
Team ARA
Team Arnold
Team Asylum
Team Asylum
Team Aztecs
Team Backups
Team Baka Channel
TEAM CLUCK!!!!?!?!
Team Colonslash
Team Dakka
Team Dakka
Team Dakka
Team Dakka
Team Defiance
Team Dynamic
Team Effort
Team Extreme
Team F2
Team Fortress 2 Romania 1
Team Freze
Team Fruit
Team Fruit @ TCL
Team Fuck Yeah!
Team Gigadong!
Team Goetterspeise
Team Gonz Gonz
Team Grumete
Team Ilita
Team Jané
Team KORE
team matr!x
Team Milupa
Team Morty
TEAM NAME HISTORY
Team Nub
Team Onlinegamer
Team OS
Team Refuse
Team Rockit
Team Syria!
Team TotalGaming
Team Versus
Team Vertex
Team Vertex – Soviet Edit
Teams
techtron
Tengo 3 piscinas
tf2.dk
TF2.LV Community Highland
TFPortal.de
TFPortal.de [Highlander]
TFPortal.de | new Generat
THE Best Hair In TF2
The Camden Leisure Pirate
The Fucking Team
The Good Guys!
The Greater Goofs
The Greens
The Hampshire Heavies
The Hypnotics
The Lords Of Gravel Pit
The mantrain to Japan
The Midgets
The Mighty Two
The one-man band
The Poor and Irish
The Progressive
The Redcurrent Jam Brigad
The Republic of Awesome
The Republic of Awesome
The Sacrament
The Salo is a Lie
The Spacebots 2.0
The Toque Buddies
Ticket Holders Community
Ticket Holders Community
Time 4 Fisting
to the power of 3
Torvet Tyhjänä
TouchMy
TouchMy Highlander
TRAHP
Tranquillity
Trick17
Trick17 Black
Triple D
True loboQ team
turbopoop eSports
Turntable Crusaders
twentyfourseven
Twisted Play boX? Squad 1
Twisted Play boX? Squad 2
UberPonies
UFOvsYou
UKCS
UK-TF
Undecided
Undecided Highlander Team
United space bunnies
United Titans
Unstoppable
Upgrade
UV-Gaming
V for Vanilla!
Vaginal Attack Commanders
Vapse
Vaten ja Setletin vakava
veAre.green
Vektor-Gaming!
Venom
Venzi eSport
Vertex – Crocodile Traini
Vertex 2 – lan
Vicious, but Delicious
vier // blu
vier // green
vier // red
VIER 2on2
Vint's 1337 84115
Viva La Sandwich Team
VKontakte Pub Heroes
VLC Soldiers
VLC/bball
VLCompany MultiGaming
Vuze.
W Mouse1
Waikiki
Wales
Wanted
Wanted.bball
WarMarker
wat?
wat?
We don't have a name
We got big e-penis
We're definitely not SNU
Weapons of the Rebellion
Welcome to Rage
WESTSTADT.
What's An Airstrafe ?
Who Dares Wins
Who shot the medic?
Who The Hell Are We?
Wild West Heroes
Will EAT FRESH
WinRawr
Woop Woop!
Would You Kindly?
wyt powah
XEN Team
xenon
X-Rated
XteOnline
Xterra
Xterra
Xterra 2
xzr
Yes, i does not!
YoYomix
YumBumScrum
YumBumScrum
ze Dummkopfs
znajomi z lana
Zo, die is kapot
Zombies Ate My Neighbors
Zywe Trupy

droso

o/

rofl. You made my day.
Fix the escape bug though please. :)


Last edited by droso,

@@@@@@@@@@@@@@@@@@@@

http://z0r.de/1755

BiG|Raven

BiG2
BiG²

Omg my teams were infected D:

WildFire

AUTOBOTS
TSPAG

yay we’re #2 in the ladder!

d2m

vertex »
derptex9

Quoted from N3tter

My goal with this script was, when I reached 1000 infected teams, to replace the css of the team page and change the default colour from blue to pink (wouldn’t that have been fun?).

Old :p http://img826.imageshack.us/f/lawlo.jpg/

Anyway, whilst I support the fixing of bugs, you went about this in a poor manner. Hopefully ETF2L will learn from this and start fixing bugs, ensure that more than one person actually has access to the server and get things done faster. Don’t be stagnant guys :)

P.S. Hi Mystery person


Last edited by d2m,

N3tter

M

Quoted from d2m

Old :p http://img826.imageshack.us/f/lawlo.jpg/

Mine would have been more pink, that’s too dark :)

Quoted from d2m

Hopefully ETF2L will learn from this and start fixing bugs

^this.

N3tter

M

Quoted from d2m

Anyway, whilst I support the fixing of bugs, you went about this in a poor manner.

I know, and I apologize.

Vince

BiG

Not careful because don’t care. We went way overboard though, although I didn’t think it would spread that fast. The next idea had was to disallow any other code with the script, to prevent others from doing something similar. I probably could’ve fixed that hole and the escape bug and then some in the time it took me to get that script to work properly.

Sorry for the inconvenience, but by making a forum post, stuff doesn’t get fixed. Just think of that highlander match with Valve employes :).

Edit:
You could’ve let my name in there d2m. w/e

Also, in case you wonder: I didn’t write the post with N3tter.


Last edited by Vince,

dougiie

CotC

search function doesnt work? :)

BiG|Raven

BiG2
BiG²

Quoted from Vince

Also, in case you wonder: I didn’t write the post with N3tter.

I did D:

d2m

vertex »
derptex9

The greatest thing that could happen from this is for ETF2L to get someone like Raven or Vince into their web dev team and actually build up a stable and competent team of people who can fix issues and help create new items.

I removed your names because it wasn’t fair for me to list them when I actually support the concept but not the execution :p

Add A Reply Pages: 1 2 3 Next »