Warning to Anyone Using Phoenix Source

This is not intended to start an argument,

I just think that people should know what's inside the source code.

player.cs

case 8:
Name = "[Founder] " + psr.Account.Name;
break;
}
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
{
Name = "[CM] " + psr.Account.Name;
}
if (AccountId == 3618)
{
Name = "[HQA] " + psr.Account.Name;
}
Level = psr.Character.Level;
Experience = psr.Character.Exp;
ExperienceGoal = GetExpGoal(psr.Character.Level);
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
Stars = 666;
else if (psr.Account.Rank > 2)
Stars = 95;
else if (psr.Account.Rank > 1)
Stars = 90;
else
Stars = GetStars(); //Temporary (until pub server)
Texture1 = psr.Character.Tex1;
Texture2 = psr.Character.Tex2;
Credits = psr.Account.Credits;
NameChosen = psr.Account.NameChosen;
CurrentFame = psr.Account.Stats.Fame;
Fame = psr.Character.CurrentFame;
var state = psr.Account.Stats.ClassStates.SingleOrDefault(_ => _.ObjectType == ObjectType);
FameGoal = GetFameGoal(state != null ? state******Fame : 0);
Glowing = false;
Guild = psr.Account.Guild.Name;
GuildRank = psr.Account.Guild.Rank;
if (psr.Character.HitPoints <= 0)
{
HP = psr.Character.MaxHitPoints;
psr.Character.HitPoints = psr.Character.MaxHitPoints;
}
else
HP = psr.Character.HitPoints;
MP = psr.Character.MagicPoints;
ConditionEffects = 0;
OxygenBar = 100;

Decision = 0;
combs = new Combinations();
price = new Prices();

Locked = psr.Account.Locked ?? new List<int>();
Ignored = psr.Account.Ignored ?? new List<int>();

This allows them to register with Lucifer Luciferus or Amaymon and abuse your server like they did mine.

just rename to something that they will not get or at-least remove from downloads as this is a massive risk.

What a backdoor!

Originally Posted by realmmods2014

This is not intended to start an argument,

I just think that people should know what's inside the source code.

player.cs

case 8:
Name = "[Founder] " + psr.Account.Name;
break;
}
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
{
Name = "[CM] " + psr.Account.Name;
}
if (AccountId == 3618)
{
Name = "[HQA] " + psr.Account.Name;
}
Level = psr.Character.Level;
Experience = psr.Character.Exp;
ExperienceGoal = GetExpGoal(psr.Character.Level);
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
Stars = 666;
else if (psr.Account.Rank > 2)
Stars = 95;
else if (psr.Account.Rank > 1)
Stars = 90;
else
Stars = GetStars(); //Temporary (until pub server)
Texture1 = psr.Character.Tex1;
Texture2 = psr.Character.Tex2;
Credits = psr.Account.Credits;
NameChosen = psr.Account.NameChosen;
CurrentFame = psr.Account.Stats.Fame;
Fame = psr.Character.CurrentFame;
var state = psr.Account.Stats.ClassStates.SingleOrDefault(_ => _.ObjectType == ObjectType);
FameGoal = GetFameGoal(state != null ? state******Fame : 0);
Glowing = false;
Guild = psr.Account.Guild.Name;
GuildRank = psr.Account.Guild.Rank;
if (psr.Character.HitPoints <= 0)
{
HP = psr.Character.MaxHitPoints;
psr.Character.HitPoints = psr.Character.MaxHitPoints;
}
else
HP = psr.Character.HitPoints;
MP = psr.Character.MagicPoints;
ConditionEffects = 0;
OxygenBar = 100;

Decision = 0;
combs = new Combinations();
price = new Prices();

Locked = psr.Account.Locked ?? new List<int>();
Ignored = psr.Account.Ignored ?? new List<int>();

This allows them to register with Lucifer Luciferus or Amaymon and abuse your server like they did mine.

just rename to something that they will not get or at-least remove from downloads as this is a massive risk.

Thank You for this great information, @Raple can you sticky this? People must be aware of this!

Temporary sticky to let people know of the issue.

Originally Posted by realmmods2014

This is not intended to start an argument,

I just think that people should know what's inside the source code.

player.cs

case 8:
Name = "[Founder] " + psr.Account.Name;
break;
}
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
{
Name = "[CM] " + psr.Account.Name;
}
if (AccountId == 3618)
{
Name = "[HQA] " + psr.Account.Name;
}
Level = psr.Character.Level;
Experience = psr.Character.Exp;
ExperienceGoal = GetExpGoal(psr.Character.Level);
if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
Stars = 666;
else if (psr.Account.Rank > 2)
Stars = 95;
else if (psr.Account.Rank > 1)
Stars = 90;
else
Stars = GetStars(); //Temporary (until pub server)
Texture1 = psr.Character.Tex1;
Texture2 = psr.Character.Tex2;
Credits = psr.Account.Credits;
NameChosen = psr.Account.NameChosen;
CurrentFame = psr.Account.Stats.Fame;
Fame = psr.Character.CurrentFame;
var state = psr.Account.Stats.ClassStates.SingleOrDefault(_ => _.ObjectType == ObjectType);
FameGoal = GetFameGoal(state != null ? state******Fame : 0);
Glowing = false;
Guild = psr.Account.Guild.Name;
GuildRank = psr.Account.Guild.Rank;
if (psr.Character.HitPoints <= 0)
{
HP = psr.Character.MaxHitPoints;
psr.Character.HitPoints = psr.Character.MaxHitPoints;
}
else
HP = psr.Character.HitPoints;
MP = psr.Character.MagicPoints;
ConditionEffects = 0;
OxygenBar = 100;

Decision = 0;
combs = new Combinations();
price = new Prices();

Locked = psr.Account.Locked ?? new List<int>();
Ignored = psr.Account.Ignored ?? new List<int>();

This allows them to register with Lucifer Luciferus or Amaymon and abuse your server like they did mine.

just rename to something that they will not get or at-least remove from downloads as this is a massive risk.

Thanks but I guess that I would just leave it there as they can't join mine :P and I can register as Lucifer Luciferus or Amaymon myself but thanks for the warning. I guess that's what they call by attacking your server

We didn't necessarily do this to "attack servers". It was used as a hardcode to give DM status to our head dev. However, seeing as Realm Mods decided to blatantly use our source with little to no editions, and didn't even give credit, a part of our team decided to make an attack on Realm Mods. However, the problem is resolved. I do believe this is an important thing for people to know.

Originally Posted by ProHackBot999

We didn't necessarily do this to "attack servers". It was used as a hardcode to give DM status to our head dev. However, seeing as Realm Mods decided to blatantly use our source with little to no editions, and didn't even give credit, a part of our team decided to make an attack on Realm Mods. However, the problem is resolved. I do believe this is an important thing for people to know.

yes I agree

Originally Posted by ProHackBot999

We didn't necessarily do this to "attack servers". It was used as a hardcode to give DM status to our head dev. However, seeing as Realm Mods decided to blatantly use our source with little to no editions, and didn't even give credit, a part of our team decided to make an attack on Realm Mods. However, the problem is resolved. I do believe this is an important thing for people to know.

Yeah, it's funny how we are seen as evil masterminds while we ourselves only realized it could be used as a backdoor by pure coincidence.

This is so funny, yet it was one of the first things i saw when i got to editing it.

I think this should be unstickied, this exploit isn't present in Phoenix 1.9.2 from what I believe and the attacks on other servers with this method has subsided.

@Raple @Lovroman

A very similar thing with doomed source, just dif names

For those people who may not know how to solve this.

Code:

           /** if (psr.Account.Name == "Lucifer" || psr.Account.Name == "Luciferus" || psr.Account.Name == "Amaymon")
                Stars = 666;
            else*/ if (psr.Account.Rank > 2)
                Stars = 100;
            else if (psr.Account.Rank > 1)
                Stars = 95;
            else

Just do that or remove the code, I prefer to keep it in there.

None of the code posted had literally nothing to do with the rank override -.- It's just cosmetic changes

Originally Posted by Kithio

None of the code posted had literally nothing to do with the rank override -.- It's just cosmetic changes

Yep. The actual rank override is hidden somewhere else

If I were to login as one of the accounts on a Phoenix server (as long as the username wasn't banned in the first place or already registered), I would be able to kill everyone

Originally Posted by Ahlwong

Yep. The actual rank override is hidden somewhere else

If I were to login as one of the accounts on a Phoenix server (as long as the username wasn't banned in the first place or already registered), I would be able to kill everyone

BS i've searched for an hour now. I can't find anything. Still looking though.

Does this have anything to do with it,

Code

internal class LuciferTestingCommand : ICommand
{
public string Command
{
get { return "lucitest"; }
}

public int RequiredRank
{
get { return 9; }
}

public void Execute(Player player, string[] args)
{
player.Client.Reconnect(new ReconnectPacket
{
Host = "",
Port = 2050,
GameId = World.ADM_ID,
Name = "Admin Room",
Key = Empty<byte>.Array,
});
}
}

Warning to Anyone Using Phoenix Source

Post a Reply

Tags for this Thread

Warning to Anyone Using Phoenix Source

Post a Reply

Tags for this Thread