Protect your GM Commands

[Methz 2]

Hey @V3ct0r, firstly thank you for the guide.

I have a question (or two):

 

These GameServer with HandlerChat (GetGm...etc) are in the 1.36 version? If not, do you have a GameServer with HandlerChat in the 1.36 version? I tried to use these with my server file (1.36) and didn't worked.

 

OBS: Is allowed to relive topics here? Sorry if not

[BugsBunny 16]

Just curious. How to give items using a TPS??? 

 

[V3ct0r 2,117]

40 минут назад, BugsBunny сказал:

Just curious. How to give items using a TPS??? 

 

What is TPS?

[BugsBunny 16]

22 hours ago, V3ct0r said:

What is TPS?

Third party programs 

[Tassadar 8]

downloaded the gameserver you linked to try, when i run it i get the errors:

 

request speech NPC internal memory error, please increase speech npc internal memory!!!

 

and

 

index [501] overflow, please check resource file [resource/skillinfo.txt

 

no commands are working (have NOT changed any of them)

 

account is gm lvl 99

 

added my character name to the list and it didnt work

made a character named V3ct0r   didnt work

 

 

 

 

 

 

 

 

 

 

 

 

 

 

[FapFap 13]

On 5/22/2016 at 8:29 PM, V3ct0r said:

Protect your GM Commands

Thanks to @c0d3x for translate from Russian

Hello!

 

Let's pretend as if your server has been hacked and the hacker received access to the GM account afterwards. In this thread I'll try to explain how you can secure GM commands and make the hack nearly pointless.

 

Attention! You must pay the most attention to &lua and &lua_all commands(!). If you have got them enabled on your server and somehow hacker manages to get into a GM account, he could get control over every thing, including your root folder; rdp access and so on and so forth.

You can read more about those commands HERE.

 

Be as safe as you can, and after reading this thread try Not to use the same commands as I'm gonna use as an example!

3rd way. GameServer.exe with HandleChat(), GetGmLv() and SetGmLv() functions.

To use this way you have to use modified GameServer.exe which has the functions above in it.

 

Function HandleChat(userdata role, string message) works out when a character writes messages into local chat. Since all GM commands are being written into local chat, too, you can create a script that will control their execution.

 

Like, you can make so that GM commands work only if the character, who executes them, has a specified ID or name. In addition to this, you can make so that the character has to be in a specified guild, where only administrators  and/or GMs could enter. It all depends on your fantasy!

 

To find out if character is a GM, use function GetGmLv(userdata role).

 

Using function SetGmLv(userdata role, number level) you can edit account's gm level to which the character is attached to. Also, using the same function you can set GM level to 0 (ordinary player) in HandleChat() function in case the character hasn't passed the verification.

 

Let's make a simple system to control GM commands:

1) GM commands can be used only if your name is: "V3ct0r", "pkodev" or "Administrator".

2) If the character is GM and he/she hasn't passed the verification, set GM level to 0, kick the character and send the message for Administrator to the GameServer.exe console.

 

Firstly, let's create an array inside variable.lua with characters' names that could use GM commands, we'll call it PlayerCanUseCmd:

PlayerCanUseCmd = {}
PlayerCanUseCmd["V3ct0r"] = 1
PlayerCanUseCmd["pkodev"] = 1
PlayerCanUseCmd["Administrator"] = 1

 

Then let's make a script inside HandleChat() in functions.lua:

-- Local chat handler
function HandleChat(role, message)
 -- Check whether the character is a gm or not
	if (GetGmLv(role) > 0) then
  -- Check if the character has executed the command
		if (string.find(message, "&") == 1) then
		-- Check character's name
	    local cha_name = GetChaDefaultName(role)
			if (PlayerCanUseCmd[cha_name] ~= nil) then
				-- The character can use the command
				return 1
			end

		   -- The character isn't allowed to use the command
		   -- Set GM level to 0
		   SetGmLv(role, 0)
		   -- Kick it from the server
		   KickCha(role)
		   -- Send a message to the console
		   print("Player [" .. cha_name .."] tried to use GM command!")
		   -- Don't let the character execute the command
		   return 0
			end
 
		end
	return 1
end

 

To kick a character we have to add a KickCha() function, add it anywhere into functions.lua:

function KickCha(character)
	local pkt = GetPacket()
	WriteCmd(pkt, 1505)
	SendPacket(character,pkt)
end

Thread is open for the further discussion. You're welcome to ask questions or give ideas in the comments. Thank you and best of luck! 

@V3ct0r this is not working i tried it and i followed changes you made by replies on thread still wont work all gm's can use cmds still

Edited September 8, 2018 by FapFap