Noticed something surprising in script.log.

[superlube]

Hey everyone.

I doubt I'm the only one who has noticed this and want to get some other peoples opinion on it.

While I was manually parsing though some logs after a server wide "gangnam style" hack, I came across something interesting: (Search "caught" in script.log")

21.01.2013 22:03:16: Playername1  (00.000.00.000:2304 abcdefghijklmnopqrstuvwxyz - #192 "['Rustler Anti-Hax', 'Caught: Hackername1', 'For: TP'] spawn BIS_fnc_infoText;"
21.01.2013 22:03:16: Playername2  (00.000.00.000:2304 abcdefghijklmnopqrstuvwxyz - #192 "['Rustler Anti-Hax', 'Caught: Hackername1', 'For: TP'] spawn BIS_fnc_infoText;"
21.01.2013 22:03:16: Playername3  (00.000.00.000:2304 abcdefghijklmnopqrstuvwxyz - #192 "['Rustler Anti-Hax', 'Caught: Hackername1', 'For: TP'] spawn BIS_fnc_infoText;"
21.01.2013 22:03:16: Playername4 (00.000.00.000:2304 abcdefghijklmnopqrstuvwxyz - #192 "['Rustler Anti-Hax', 'Caught: Hackername1', 'For: TP'] spawn BIS_fnc_infoText;"
21.01.2013 22:03:16: Playername5 (00.000.00.000:2304 abcdefghijklmnopqrstuvwxyz - #192 "['Rustler Anti-Hax', 'Caught: Hackername1', 'For: TP'] spawn BIS_fnc_infoText;"

Over the past few days, I have had up to 190 of these lines or similar. Sometimes the "hackername" portion is just "1%" which I am assuming means that the hacker is using a bypass. In the logs, after the lines mentioned above, every "playername" would spam a whole lot of foreign logs which resembles some form of hack defense - similar to monkey monitor. I've also noticed that when a hacker causes the whole server to be kicked, a few players remain on the server - same as the ones listed in the logs as catching the hacker.

A quick google shows Rustler Anti-hack is part of a hack pack (which I will obviously not link in this forum). I've also seen Wizard anti-hack in my logs as well.

I've had up to 23 people with this log some nights at once reporting one hacker, few of which I assumed were legit players. The reported hackers have been actual hackers which I had banned myself manually via other evidence.

My question is, would every player listed in the log be using the Rustler hack or could it only be one person and notifying other players that a hacker has been caught? (Which could be why they are executing the script). I personally have never seen a message like this in-game but I also don't play on my own servers.

The reason I'm asking is because I was going to add a kick rule for anyone getting this message but don't want to cause any inconveniences for actual players.

Cheers

 

[Xyberviri]

Hey just a FYI, hackers also use call preprocessFileLineNumbers in order to get around some filters, im taking apart rustlers script that just got leaked on Monday.

If you see anything like "call compile to string[1234,1234,1234,234,23,234,234,234] etc etc' then that is an injection attempted. skittles are stupid so the script makers change this to ascii so they can't steal their scripts.

",99,97,108,108" this is "call"
"97,108,108,32,99,111,109,112,105,108,101,32,112,114,101,112,114,111,99,101,115,115,70,
105,108,101,76,105,110,101,78,117,109,98,101,114,115,32" this is "call compile preprocessFileLineNumbers"

If your checking for ; anywhere then you need to also check for "call compile to string[* * * 59 * * *]" because 59 is the ascii character for semi colon.

32 is space, here is a quick list of acsii by number: http://www.asciitable.com

As far as i know or care, players should never be sending "99,97,108,108" because i dont code in hacker, that should be insta kick.

 

[superlube]

Cheers man!! Interesting stuff. Thanks for your reply.