Hacker on server

[texcard]

Hello Facepunch!

I just had a player join my server and this started coming up in chat

(SILENT) (Players name) removed x (Entity(21):SendLua("_G.prober[ [[RequestDeletion]] ] = true")) from the watchlist

This proceeded to happen three times with Entity(21) being replaced with other numbers. I assume this is just a run string exploit but if you can shine any more light on the situation it would be much appreciated.

Thanks!

[landocalrissian]

You've more than likely got a backdoored addon which allows anyone to use RunString, what addons do you have installed?

[Pie's]

It's the ULX Essentials or ULX Extra from coder hire i think.

[Razr x V3N0M]

[QUOTE=Pie's;44648875]It's the ULX Essentials or ULX Extra from coder hire i think.[/QUOTE]

Can you screenshot your addons dir? I might be able to tell just by the addons you have.

[texcard]

[url]http://puu.sh/8pc6A.png[/url]

[Tyler B.]

That join leave one might be the issue. There was a join/leave one backdoored in the past.

[Pie's]

I found a back door in the ULX Extras from coder hire :/

[Aide]

[QUOTE=Pie's;44659018]I found a back door in the ULX Extras from coder hire :/[/QUOTE]

I'd report it to Adam.

[Razr x V3N0M]

Yeah, nothing I see stands out. Might be your Join message

[Lenny.]

You should also link to your workshop collection for the server. (It's much easier to hide a backdoor in there, since nobody actually unpacks it + you can patch the backdoor in and out whenever you want and never be caught)

[Dawnkiller]

Can anyone actually confirm whether the Leave/join sound has a backdoor? I currently have it, don't want any security concerns, but I'd rather keep it if I can.

[c👌de_g🎷]

[QUOTE=Dawnkiller;44667176]Can anyone actually confirm whether the Leave/join sound has a backdoor? I currently have it, don't want any security concerns, but I'd rather keep it if I can.[/QUOTE]

Which leave/join sound?

[zerothefallen]

Snip misread

[kila58]

Did you purchase these? If not they might be backdoored.

[Thelurker1234]

[QUOTE=kila58;44681592]Did you purchase these? If not they might be backdoored.[/QUOTE]
Depends where you got it, a lot of the stuff on facepunch is fairly safe.

But what leave/join addon? Could you post the code, or link to it on pastebin so people can look to see.

If it's a paid for addon you probably shouldn't do that by the way.

[Razr x V3N0M]

If it is a workshop addon, go ahead and paste the link in here. To do so in the client, when you are on the workshop page right click anywhere and click 'Copy to clipboard' and paste in here.

Update: Checked [URL="http://steamcommunity.com/sharedfiles/filedetails/?id=229976936&searchtext=Join+message"]this one[/URL] and saw nothing. Here is the code anyways, [url]http://pastebin.com/CBAczqsN[/url] check for yourselves and see if anything catches your eye

[Dawnkiller]

[QUOTE=code_gs;44667971]Which leave/join sound?[/QUOTE]

This one: [url]http://forums.ulyssesmod.net/index.php/topic,6036.0.html[/url]

It's very simple code, doesn't look like it could house a user-programmed backdoor.