[PSA] Exploit in TTT SpecDM

[meharryp]

In December 2016, this fix was pushed out to GMod
[url]https://github.com/Facepunch/garrysmod/commit/222de8967fdecb707a5d4463576c0b1561fb46e0[/url]

This replaced cvars.Bool with FCVAR_CHEAT as a concommand flag, which a good thing to do. However, this accidentally triggered some shitty coding in specdm to show its face.

[url=https://github.com/Tommy228/TTT_Spectator_Deathmatch/blob/6079d2749fdac155a983f4e355686bfa1549a7ba/lua/sv_specdm_overrides.lua#L3]As you can see here[/url], the new concommand.Add only takes 3 arguments. Normally concommand.Add takes 5, so you can proberbly see where this is going. Any users can change their role at any time because of this. If you've updated your server since December 2016 and have specdm installed this will affect you

A fixed version of specdm can be found here: [url]https://github.com/meharryp/TTT_Spectator_Deathmatch[/url]

[editline]a[/editline]

This has now been fixed in the main branch of specdm.

[Willox]

I'm not sure your fix is correct. The code is trying to use the command/func params that you've removed.

[meharryp]

[QUOTE=Willox;52319137]I'm not sure your fix is correct. The code is trying to use the command/func params that you've removed.[/QUOTE]

Tested it and it should work as intended.

[editline]a[/editline]

I was wrong, shit is fixed now

[SirRanjid]

If you make LocalPlayer() return other players at a certain point you can use :GetActiveWeapon() on anyone.

Been using this in my cheat.lua I wrote to learn lua. Good time to share this one. Not sure if it's an exploit of your value or a real exploit at all.

[meharryp]

-snip-

[ThatLing]

[QUOTE=SirRanjid;52319149]If you make LocalPlayer() return other players at a certain point you can use :GetActiveWeapon() on anyone.

Been using this in my cheat.lua I wrote to learn lua. Good time to share this one. Not sure if it's an exploit of your value or a real exploit at all.[/QUOTE]

Or, you know, you could just call player.GetAll and loop over that?

[>>oubliet]

[QUOTE=ThatLing;52319167]Or, you know, you could just call player.GetAll and loop over that?[/QUOTE]

TTT overrides functions for other players so you can't figure out whether or not they have traitor only weapons with Lua scripts

[Kevlon]

[QUOTE=>>oubliette<<;52319261]TTT overrides functions for other players so you can't figure out whether or not they have traitor only weapons with Lua scripts[/QUOTE]

Where? I used getactiveweapon on other entities in ttt Like 1 week just fine [url]https://github.com/Facepunch/garrysmod/search?utf8=%E2%9C%93&q=getactiveweapon&type=[/url]

E: should've searched for meta table shit but I'm on mobile atm

Also there at better ways to detect traitors

[&gt;&gt;oubliet]

I presumed GetActiveWeapon was just a typo or mistake, since as GetWeapons would have been way more useful.

[QUOTE=Kevlon;52319358]Where? I used getactiveweapon on other entities in ttt Like 1 week just fine [url]https://github.com/Facepunch/garrysmod/search?utf8=%E2%9C%93&q=getactiveweapon&type=[/url]

E: should've searched for meta table shit but I'm on mobile atm

Also there at better ways to detect traitors[/QUOTE]

[url=https://github.com/Facepunch/garrysmod/blob/784cd57576d85712fa13a7cea3a9523b4df966b0/garrysmod/gamemodes/terrortown/gamemode/player_ext_shd.lua#L122]Here[/url] TTT checks on the client whether or not Player.GetWeapons is being called on LocalPlayer, if it is it will return the original function's return, otherwise an empty table. If you detoured LocalPlayer just before calling this you could trick this into think another player was you and it'd return the weapons table.

It's not the best way to do things but it is [I]a way[/I].

[Sean Bean]

I'm glad to see my favorite exploit is still there.
[url]https://github.com/meharryp/TTT_Spectator_Deathmatch/blob/master/lua/weapons/weapon_ghost_base.lua#L253-L259[/url]

[Kevlon]

[QUOTE=>>oubliette<<;52319447]I presumed GetActiveWeapon was just a typo or mistake, since as GetWeapons would have been way more useful.

[url=https://github.com/Facepunch/garrysmod/blob/784cd57576d85712fa13a7cea3a9523b4df966b0/garrysmod/gamemodes/terrortown/gamemode/player_ext_shd.lua#L122]Here[/url] TTT checks on the client whether or not Player.GetWeapons is being called on LocalPlayer, if it is it will return the original function's return, otherwise an empty table. If you detoured LocalPlayer just before calling this you could trick this into think another player was you and it'd return the weapons table.

It's not the best way to do things but it is [I]a way[/I].[/QUOTE]

I see, but this is still so useless :v

[MinIsMin]

Thanks for reporting the exploit!
The BulletGhost exploit is fixed too, I thought I fixed it some time ago.

Workshop version will be updated soon.

[SirRanjid]

[QUOTE=ThatLing;52319167]Or, you know, you could just call player.GetAll and loop over that?[/QUOTE]

I don't quite get this one.

If I'd do:

for k,ply in {all players} do
_ _ ply:GetActiveWeapon()
end

It would only return the active weapon for myself.

Not if I do:

for k,ply in {all players} do
_ _ LocalPlayer = func() return ply end
_ _ ply:GetActiveWeapon()
end

[Kevlon]

[IMG]http://i.imgur.com/DtrMEzI.png[/IMG]

no but seriously what

[SirRanjid]

Haha same question back in the sense of I don't get what you don't get lol. :excited: :boxhide:

I'm refering to... AHHH WRONG CMD MY BAD LOL I meant ":GetWeapons()" (player_ext_shd.lua):

local gmod_GetWeapons = plymeta.GetWeapons
   function plymeta:GetWeapons()
      if self != LocalPlayer() then
         return {}
      else
         return gmod_GetWeapons(self)
      end
   end

[NootNootEh]

Tbh I'm surprise it took so long for it to get fixed, considering so many servers use Cac and cac literally tells you that their is an exploit in the addon. Thanks for the fix doe.