1 Topic by FuN~CaT

  • FuN~CaT
  • FuN~CaT
  • New member
  • Offline

Topic: [TUTORIAL] "BUG" how bypass member zone without admin.

P.S. SORRY FOR ENGLISH.

ByPass Member zone

Hello friends of teeworlds,
iam FuN~CaT☻ and today i want to show 1 bug.
I found this bug that allows you to enter the zone members without admin.
Dont abuse this bug.. u get banned smile
Have fun. smile

1: Connect in casual server
2: use /register "id" "pw"
3: use /login "id" "pw"
4: use /register "newid" "newpw" *for change pw*
5: exit and re-connect to server
6: use /login "newid" "newpw"
8: go to member zone smile

Video:
https://www.youtube.com/watch?v=1kTDb_4AbJo

2 Reply by Paszczak (edited by Paszczak 2015-02-20 12:38:58)

  • Paszczak
  • New member
  • Offline

Re: [TUTORIAL] "BUG" how bypass member zone without admin.

Hello I got a fix working on XXLDDRace64.

go game/server/memberlist.cpp 

void CMemberList::Register(int ClientID, const char* pPass, CGameContext *pSelf)
{
    CPlayerMember *pPlayer = SearchList(ClientID, 0);
    char aBuf[256];

    if (!pPlayer)
    {
        SaveList(ClientID, md5(pPass).c_str(), pSelf, false);
        str_format(aBuf, sizeof(aBuf), "Registration successful.");
    }
    else
    {
        if (pSelf->m_apPlayers[ClientID]->m_IsLoggedIn)
        {
            UpdatePlayer(ClientID, md5(pPass).c_str(), pSelf->m_apPlayers[ClientID]->m_Authed);
            str_format(aBuf, sizeof(aBuf), "Password changed.");
        }
        else
            str_format(aBuf, sizeof(aBuf), "%s is already a registered name.", pSelf->Server()->ClientName(ClientID));
    }

    pSelf->Console()->Print(IConsole::OUTPUT_LEVEL_STANDARD, "member", aBuf);
}

change

 UpdatePlayer(ClientID, md5(pPass).c_str(), pSelf->m_apPlayers[ClientID]->m_Authed);

to 

 UpdatePlayer(ClientID, md5(pPass).c_str(), pPlayer->m_AuthLvl);

I don't know why author used m_apPlayers arrary but it seems to not set m_Authed which default is 0, and it's member level.

-1 == player
0 == member
1 == helper
2 == mod
3 == admin
4 == head admin