Exploit fix 0.1

[Toast]

Code: Select all

--[[
	simple workaround for dc++ exploit that affect most popular recent clients.
	script should work with other clients with similar lua implementation
	
	adrian_007 (c) 2008
]]--

dcpp:setListener( "clientIn", "exploitfix",
	function( userp, line )
		-- this is a hack...
		if line == "$ADCGET list /// 0 -1 ZL1" then
			DC():PrintDebug( "Dropped user that tried to crash you via exploit!" )
			return true
		else
			return false
		end
	end
)
DC():PrintDebug(" ** exploitfix.lua loaded")

[adrian_007]

checked with rsx++, maybe someone can confirm if it's working with other.

[Toast]

i can check with BCDC++ later on this day when i get home from work

[allnames]

Loads correct on LDC 1.00 v2a (DC++ 0.674) but I haven't verified it stops the exploit.

[Yeppy]

how can you tell if it works ? cause i'm using it in rsx but i still get the little message that someone is trying to use my client to spam

[adrian_007]

it doesnt prevent spam attempt but remote exploit that can crash your client.... and there's a update on my forum.

[Toast]

Code: Select all

--[[
   simple workaround for dc++ exploit that affect most popular recent clients.
   script should work with other clients with similar lua implementation
   
   adrian_007 (c) 2008

   little change of string-recognition for better exploit-fix by FlipFlop (c) 2009
]]--

dcpp:setListener( "clientIn", "exploitfix",
   function( userp, line )
       -- this is a hack...
       if string.find(line, "%$ADCGET (%S) //+ 0 %-1 ZL1") then
           DC():PrintDebug( "Dropped user that tried to crash you via exploit" )
           return true
       else
           return false
       end
   end
)
DC():PrintDebug(" ** exploitfix.lua loaded")

Yeppy the spam problem that your asking about is the CTM exploit and there arent any sure proof solutions out there yet

[adrian_007]

ahh TmpAntiFlood can partially deal with it

[Yeppy]

ok i got the updated version from rsx forums

btw how do you use the true/false that function returns ? cause i don't think just by sending text ("dropped user ... ") helps with anything

[adrian_007]

if you return true, message isnt dispatched anymore - it's dropped at script level.