Follow me on twitter

Ticket #298 (closed segfault: fixed)

Opened 4 years ago

Last modified 15 months ago

HQ user gets wiped on link

Reported by: sknake Owned by: bryan
Priority: minor Milestone: 1.2.16
Component: sharing Version: 1.2.11
Keywords: hq Cc:

Description

If you run a bot in simulated partyline and link to the botnet (and it strips all of your flags when you link...is that intended?) then you run the ".channels" command, the bot will segfault.

whoami
#HQ# whoami
You are HQ@moschino.

.channels
#HQ# channels
You do not have access to any channels.
[d->] QUIT :SEGMENT VIOLATION -- CRASHING!
!*! SEGMENT VIOLATION -- CRASHING!

Change History

Changed 4 years ago by bryan

  • status changed from new to assigned

good find..

This is kind of known with super low priority, easy fix.. When I was trying to bypass auth on your net (I think?) last week I ran into this..

I'll get around to fixing.. the bug is the flags being stripped.

I'll double check .channels too, but I think it assumes the user doing it has flags, as to even be on the partyline you need flags, so I'll just fix the flags being stripped for HQ.

Changed 4 years ago by bryan

  • keywords hq added
  • component changed from core to sharing
  • summary changed from segfault from simulated partyline to HQ user gets wiped on link

Changed 4 years ago by sknake

This has more to do with changes to a user account for users that are not there i think. So it would be 2 bugs, 1 for HQ getting wiped, the other for users not existing.

This is from the test@bin ->relay-> warchest@hub

[bin(dcc)] Motd: none
[bin(dcc)] You have no messages.
[bin(dcc)] *** warchest joined the party line.
[bin(dcc)] [20:47] #warchest# whom
[bin(dcc)] [20:47] #warchest# -user test
[bin(dcc)] -+- POOF! -+-
[bin(dcc)] You are no longer a user on this botnet.
[bin(dcc)] -=- poof -=-
[bin(dcc)] You've been booted from the file section by bin: User removed.
-:- DCC lost CHAT to bin [Permission denied]
[16:48] <usual> [20:46] (bin) Logged in: test (sysco@sk.apexsoftware.com/58218)
[16:48] <usual> [20:46] (bin) #test# channels 
[16:48] <usual> [20:46] (bin) ! #test# status 
[16:48] <usual> [20:46] (bin) #test# relay hub
[16:48] <usual> [20:46] Telnet connection: core.router.ws[66.252.9.49]/3411
[16:48] <usual> [20:46] (bin) Relay link: test -> hub
[16:49] <usual> [20:47] Logged in: warchest (solid@core.router.ws/3411)
[16:49] <usual> *** warchest joined the party line.
[16:49] <warjest> .whom
[16:49] <usual> [20:47] #warchest# whom 
[16:49] <usual> Users across the botnet (+: Party line, *: Local channel)
[16:49] <usual>  Nick        Bot        Host
[16:49] <usual> ----------   ---------  --------------------
[16:49] <usual> ^warchest  + hub        limit@phearable.com
[16:49] <usual> ^warchest  + hub        solid@core.router.ws
[16:49] <usual> *xavier    + hub        light@host-72-20-20-49.quadspeedi.net [idle 18m]
[16:49] <usual> ^chicano   + hub        ocean@lab.my.edu
[16:49] <usual> *x0wner    + hub2       light@host-72-20-20-53.quadspeedi.net [idle 2d4h]
[16:49] <usual> ^warchest  + bin        sk@apexsoftware.com [idle 6m]
[16:49] <usual> Total users: 7
[16:49] <warjest> .-user test
[16:49] <usual> [20:47] #warchest# -user test
[16:49] <usual> Removed user: test.
[16:49] <usual> Saving userfile...
[16:49] <usual> [20:47] Lost dcc connection to warchest (solid@core.router.ws/3411)
[16:49] <usual> *** warchest lost dcc link.
[16:49] <usual> [20:47] (bin) !*! SEGMENT VIOLATION -- CRASHING!
[16:49] <usual> [20:47] (hub2) [20:47] Lost bot: bin (lost 1 bot and 1 user).
[16:49] <usual> *** (hub2) Lost bot: bin (lost 1 bot and 1 user)
[16:50] <usual> [20:48] (crisco) Switching back to nick crisco
[16:50] <usual> [20:48] (crisco) Switching back to nick crisco
[16:50] <usual> [20:48] (crisco) NICK IS JUPED: crisco (keeping 'crisco-').

Changed 4 years ago by sknake

The highlight of the last post of mine is that a bot segfaulted when i did the -user.

Changed 2 years ago by bryan

  • type changed from defect to segfault

This may be related to or a duplicate of #346

Changed 15 months ago by Bryan Drewery

  • status changed from assigned to closed
  • resolution set to fixed

* Fix 'HQ' user getting wiped in -t mode resulting in a crash. (fixes #298)

The user is no longer booted after the user transfer. Instead, if it did not exist on the remote side, it is re-added. This resolves the segfault from not having a user entry.

This may seem to be a security risk, however, adding user 'HQ' with minimal flags will mitigate this a little because then the linking bot will still have its flags wiped, but retain a user. This is of course assuming the binary has not been tampered with.

Changeset: 2e30b94f8daa3e466085f37fc7e005625b5b7028

Note: See TracTickets for help on using tickets.