Hack Rcon Password Sof2 Map

We had the same problem three weeks ago (etpub-server), four players connected and gave themselves admin-status. Smutje restarted server with new rcon pw.

• Battleye Rcon Password
• How To Use Rcon

Sonyfan also showed me, but i recommend you to ask Smutje in our irc chan, cause actually i dont know if he did anything else to solve this problem.actually, the fix just turned out to not work correctly. We are trying to fix the fix atmthe server was !!!Hirntot, 6maps @ et.hirntot.org:27960attacked and hijacked this Saturday from 01:00am until 02:00am CET.One of the other servers i heard about was fPDemolitionCentreEdit: it was the hack that purzel quoted about, affecting a leak in WeaponStats /ws command.

Actually, the fix was installed and running on Hirntot server, but anyway they were able to retrieve the rcon password.This post has been edited by !!!Weird.Al: Aug 4 2007, 02:14 PM. We had the same problem three weeks ago (etpub-server), four players connected and gave themselves admin-status. Smutje restarted server with new rcon pw.

Sonyfan also showed me, but i recommend you to ask Smutje in our irc chan, cause actually i dont know if he did anything else to solve this problem.actually, the fix just turned out to not work correctly. We are trying to fix the fix atmthe server was !!!Hirntot, 6maps @ et.hirntot.org:27960attacked and hijacked this Saturday from 01:00am until 02:00am CET.One of the other servers i heard about was fPDemolitionCentreEdit: it was the hack that purzel quoted about, affecting a leak in WeaponStats /ws command. Actually, the fix was installed and running on Hirntot server, but anyway they were able to retrieve the rcon password.Yesterday a friend of mine's server was hacked also.

I will tell him about this thread. We had the same problem three weeks ago (etpub-server), four players connected and gave themselves admin-status. Smutje restarted server with new rcon pw. Sonyfan also showed me, but i recommend you to ask Smutje in our irc chan, cause actually i dont know if he did anything else to solve this problem.actually, the fix just turned out to not work correctly. We are trying to fix the fix atmthe server was !!!Hirntot, 6maps @ et.hirntot.org:27960attacked and hijacked this Saturday from 01:00am until 02:00am CET.One of the other servers i heard about was fPDemolitionCentreEdit: it was the hack that purzel quoted about, affecting a leak in WeaponStats /ws command. Actually, the fix was installed and running on Hirntot server, but anyway they were able to retrieve the rcon password.My jaymod server is hacked today.

When changing the passwords they come in and hack again. But i think you must secure it with something. We had the same problem three weeks ago (etpub-server), four players connected and gave themselves admin-status. Smutje restarted server with new rcon pw. Sonyfan also showed me, but i recommend you to ask Smutje in our irc chan, cause actually i dont know if he did anything else to solve this problem.actually, the fix just turned out to not work correctly. We are trying to fix the fix atmthe server was !!!Hirntot, 6maps @ et.hirntot.org:27960attacked and hijacked this Saturday from 01:00am until 02:00am CET.One of the other servers i heard about was fPDemolitionCentreEdit: it was the hack that purzel quoted about, affecting a leak in WeaponStats /ws command. Actually, the fix was installed and running on Hirntot server, but anyway they were able to retrieve the rcon password.i belive it looks for the server.cfg then downloads it and then has the rcon pass.

Simplea mate of mine set up my server to run on a different.cfg eg bolox.cfg (same txt in it as server.cfg) and left a nice message in the server.cfg for them to downloadnot sure how he did it but it seems to have fixed the problem.

In the past there have been many fake, and programs of so called rcon stealers. All of these are fake and don’t work.A real rcon stealer is nearly impossible to make. You can only make this if you found a bug/exploit that would allow you to execute your own code on the server (like a buffer overflow).

But a bug like this has never been found in the halo server. So it’s impossible to get the rcon password in a few seconds. There is however a second method to find the rcon password: bruteforce it.The halo server is not protected against bruteforce attacks. So this is possible to make.

The downside is that this can take a long time (read: extremely long). If you want to try all possible passwords with only lowercase letters, you already have 217,180,147,158 possible combinations.

Let’s say you design a decent algorithm that can test 1000 passwords each second. This is already fast, considering we’re doing this over the internet. But it would still take more than 6 years to test all possible combinations. If you also include numbers and uppercase letters, this would be even more: 225,387,915,461,472 combinations, taking more than 7147 years if we could try 1000 passwords each second. So praticly this method also isn’t usefull.To demonstrate this I made a quick program. It tries all the passwords with only lowercase letters. It send a rcon command to the server and waits for a reply.

If the server says the password was invalid, we try the next one. Repeat untill password found or all combinations have been tried. I tested this on my own server against a very weak password.Server and client are running on the same computer, so the connection is very fast.

Yet it still takes 191 seconds to crack it. And it’s a very weak password since it only uses lower case letters and isn’t long. It tried a total of 2886 combinations, resulting in around 15 attempts each second. The weak point in the current algorithm is that it waits untill the server replies. To increase the speed you could send multiple attempts at the same time, then wait for the results, send multiple attempts again, etc.

Battleye Rcon Password

Once you have a positive match you know the password was in one of these attempts. Try each of these attemps again and you have your password.Next post on this will include this updated algorithm, and the results of it.

How To Use Rcon

But for now it seems your rcon passwords are safe. I’ve been working on a similar project; although my rcon steal uses an entirely different strategy.