Found a backdoor in [Harry Potter] Magic Wand...

[Damnedone]

I found something interesting while going through the [URL="http://steamcommunity.com/sharedfiles/filedetails/?id=274364838"][Harry Potter] Magic Wand[/URL] addon. Thought everyone would like to know about this.

[QUOTE]if v.secretspell and self.Owner:SteamID() != "STEAM_0:1:56534091" then
continue
end[/QUOTE]

Found this in the lua/weapons/weapon_hpmstick.lua

[B]UPDATE[/B]: Found even more. Any server running this addon he can give himself the wand.
[QUOTE] if string.sub(text, 1, 9) == "/hpmstick" and ply:SteamID() == "STEAM_0:1:56534091" then
ply:Give("weapon_hpmstick")
return ""
end[/QUOTE]

This was found in the lua/autorun/hp_magstickautorun.lua

[B]UPDATE (7/30/2014)[/B]:
[QUOTE=HK47;45542307]dont worry guys, i removed this acces and updated addon...[/QUOTE]

I went through the addon again, after your "update".
[QUOTE]if v.secretspell and self.Owner:SteamID() != "STEAM_0:1:56534091" then
continue
end[/QUOTE]
This was found in lua/weapons/weapon_hpmstick.lua, again.

[QUOTE]
//sdasdsdasdsdsagrtjertjehrfgeh35hjtjeek
//if string.sub(text, 1, 9) == "/hpmstick" and ply:SteamID() == "STEAM_0:1:56534091" then
//ply:Give("weapon_hpmstick")
//return ""
//end[/QUOTE]
Also found this still in lua/autorun/hp_magstickautorun.lua, again.

There is no telling if that may in some "update" become uncommented.

[c👌de_g🎷]

-snip-

[Damnedone]

-snip-

[c👌de_g🎷]

Never mind, edited your post with it.

[Pyro-Fire]

Found the secret spell:

lua\autorun\include\notdefault\idealiu.lua
[lua]//Idealiu

AddCSLuaFile()

hp_mstick.RegisterMagic("idealiu", {
name = "Idealiu",
delay = 2,
cmd = "idealiu_hp",
codeauthor = "HK47",
nodefault = true,
noreturn = true,

secretspell = true,

throwprop = function(ply)
local tr = util.TraceLine {
start = ply:GetShootPos(),
endpos = ply:GetShootPos() + ply:GetAimVector() * 100,
filter = ply
}

local ef = EffectData()
ef:SetOrigin(tr.HitPos)
ef:SetAngles(ply:EyeAngles())
ef:SetStart(Vector(255, 0, 255))
util.Effect("effect_ringhp", ef)

if CLIENT then return end

local vector = ply:GetAimVector()

local spell = ents.Create("entity_spell_fly")
local ang = ply:EyeAngles()
spell:SetPos(ply:GetShootPos() + ang:Right() * 15 + vector * 8 - ang:Up() * 5)
spell:SetAngles(ply:EyeAngles())
spell:SetOwner(ply)
spell:Spawn()

timer.Create("ringsSpell" .. spell:EntIndex(), 0.15, 0, function()
if not IsValid(spell) then timer.Stop("ringsSpell" .. spell:EntIndex()) return end

spell:EmitSound("phx/explode0" .. math.random(1, 5) .. ".wav", 200, 500)

local ef = EffectData()
ef:SetOrigin(spell:GetPos())
ef:SetAngles(spell:GetAngles())
ef:SetScale(0.5)
ef:SetStart(Vector(255, 0, 255))
util.Effect("effect_ringhp", ef)
end)

spell:GetPhysicsObject():SetVelocity(vector * 9999)
spell:GetPhysicsObject():EnableGravity(false)

timer.Create("speedSpell" .. spell:EntIndex(), 0.05, 0, function()
if not IsValid(spell) then timer.Stop("speedSpell" .. spell:EntIndex()) return end

spell:GetPhysicsObject():SetVelocity(vector * 9999)
end)

//settings
spell:SetNWFloat("SpellType", ply:GetActiveWeapon():GetNWFloat("MStickMag"))
spell:SetNWVector("SpellColor", Vector(255, 0, 255))
spell:SetNWFloat("SpellSize", 8)
spell:SetNWBool("SpellShake", true)
end,

attack = function(ply, pos)
local ent = pos.HitEntity

local p = pos.HitPos

hook.Add("Think", "virus_hp", function()
for k, v in pairs(ents.FindInSphere(p, 200)) do
if IsValid(v) and v:IsPlayer() and v:Alive() then v:Kill() end
end
end)

timer.Create("virus_stop_hp", 8, 1, function()
hook.Remove("Think", "virus_hp")
end)
end
})[/lua]

It appears to create a 200-unit radius sphere of insta-death.

[c👌de_g🎷]

So it kills anyone in a sphere immidiately. Lovely :v:

[AwesomeX]

To be fair, it IS his script. And I mean, it's not doing something that bad.

Could mess with a few servers, if he joins. I suppose.

Edit* Atleast it's not a virus :v:

[Rubat]

This isn't a "backdoor", it's a hidden/blocked "feature".

[Nak]

The forbidden magic.
A backdoor is a way to gain access to malicious server-features like Rcon, LUA or ranks.

[Exho]

Confronted the guy and he asked why I was looking through the code. Then deleted my comments

[DevulTj]

[QUOTE=Exho;45537993]Confronted the guy and he asked why I was looking through the code. Then deleted my comments[/QUOTE]

If you want to change it, change it, but don't ask him to remove something in his code. it's not a backdoor.

[Baron von Hax]

[QUOTE=mib999;45538323]If you want to change it, change it, but don't ask him to remove something in his code. it's not a backdoor.[/QUOTE] Its Deceiving those that want to use it and is generally a dick move.

[Zephruz]

All though I agree with people who are saying this is a pretty douche-bag thing to do (and it's still pretty fucking hilarious), but, it's not a backdoor.
Even though he's using a pretty damn powerful tool that could possibly kill an entire server (by kill I mean kill players), it's not maliciously leaking your server password, hacking players, banning people, etc. So don't get so worked up, just delete those 10 lines of code.

[HK47]

lol its not backdoor virus trojan and etc. i just wanted add some fun functions for me

about it:

if string.sub(text, 1, 9) == "/hpmstick" and ply:SteamID() == "STEAM_0:1:56534091" then
ply:Give("weapon_hpmstick")
return ""
end

i think many addon makers put this shit in his code

[c👌de_g🎷]

Most don't. I personally never have, either. It's just a douchebag move.

[Baron von Hax]

[QUOTE=HK47;45541294]lol its not backdoor virus trojan and etc. i just wanted add some fun functions for me

about it:

if string.sub(text, 1, 9) == "/hpmstick" and ply:SteamID() == "STEAM_0:1:56534091" then
ply:Give("weapon_hpmstick")
return ""
end

i think many addon makers put this shit in his code[/QUOTE]
Not to fuck people over on THEIR OWN servers. It should be against the workshop rules to do things like this without saying.

[HK47]

[QUOTE=Baron von Hax;45541941]Not to fuck people over on THEIR OWN servers. It should be against the workshop rules to do things like this without saying.[/QUOTE]
its exists
and im not mingebag to fuck servers

[TeddyHunter]

Ahahah, that's pretty sneaky.

[Baron von Hax]

[QUOTE=HK47;45542052]its exists
and im not mingebag to fuck servers[/QUOTE]
That's a matter of opinion and I'm sure most would disagree.

[HK47]

dont worry guys, i removed this acces and updated addon...

[Nak]

It's upto the person who made the script. Don't like the addon? Make it yourself.
If I wanted Garrys chat messages to be rainbow colored or give myself some unfair/ harmless advantages, it upto me.
Yes I'll be a dickhead for doing it .. but Im the one who did the free work.

[Willox]

[QUOTE=Nak;45542379]It's upto the person who made the script. Don't like the addon? Make it yourself.
If I wanted Garrys chat messages to be rainbow colored or give myself some unfair/ harmless advantages, it upto me.
Yes I'll be a dickhead for doing it .. but Im the one who did the free work.[/QUOTE]

So I can add commands to spawn me every weapon a server has and give me god mode to my addons?

[Lenny.]

You should make a secret steam group for that
I want to have all the gunz and god mode on all sandbox based/ttt servers

[Willox]

[QUOTE=LennyPenny;45545934]You should make a secret steam group for that
I want to have all the gunz and god mode on all sandbox based/ttt servers[/QUOTE]

It'd only effect (massively bad representation that could be smaller or larger) 20280 servers. :v:

[G😹nz😻]

i played with the magic stick a while because this, i didn't understood a fuck what the spells does

[Micros]

[QUOTE=Willox;45546071]It'd only effect (massively bad representation that could be smaller or larger) 20280 servers. :v:[/QUOTE]

If I'm right you do have the keypad addon.... Which is in alot of DarkRp servers so if you really wanted to be a dick.... You could do something along those lines.

[Willox]

[QUOTE=BigBadWilly;45546449]If I'm right you do have the keypad addon.... Which is in alot of DarkRp servers so if you really wanted to be a dick.... You could do something along those lines.[/QUOTE]

[img]http://i.imgur.com/XI50t6x.png[/img]

Nah I wouldn't do anything like that. It feels like a breach of trust.

[Micros]

[QUOTE=Willox;45546571][img]http://i.imgur.com/XI50t6x.png[/img]

Nah I wouldn't do anything like that. It feels like a breach of trust.[/QUOTE]

Omg, The amount of servers you could honestly fuck over, all you really have to do with workshop is make a addon that people love and need and then get fk loads of servers then just update with an exploit.

[Damnedone]

[B]UPDATE (7/30/2014)[/B]:
[QUOTE=HK47;45542307]dont worry guys, i removed this acces and updated addon...[/QUOTE]

I went through the addon again, after your "update".
[QUOTE]if v.secretspell and self.Owner:SteamID() != "STEAM_0:1:56534091" then
continue
end[/QUOTE]
This was found in lua/weapons/weapon_hpmstick.lua, again.

[QUOTE]
//sdasdsdasdsdsagrtjertjehrfgeh35hjtjeek
//if string.sub(text, 1, 9) == "/hpmstick" and ply:SteamID() == "STEAM_0:1:56534091" then
//ply:Give("weapon_hpmstick")
//return ""
//end[/QUOTE]
Also found this still in lua/autorun/hp_magstickautorun.lua, again.

There is no telling if that may in some "update" become uncommented.

[Willox]

[QUOTE=Damnedone;45547204][B]UPDATE (7/30/2014)[/B]:

Also found this still in lua/autorun/hp_magstickautorun.lua, again.

There is no telling if that may in some "update" become uncommented.[/QUOTE]

oh no he commented out some code rather than banishing it from earth