Skip to content

Commit 27ee9ff

Browse files
author
YoFuzzy3
committed
Fix exploit
Redo config handler and add authentication.
1 parent d3605a6 commit 27ee9ff

4 files changed

Lines changed: 99 additions & 56 deletions

File tree

‎CommandSyncClient/src/com/fuzzoland/CommandSyncClient/CSC.java‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,13 @@ public class CSC extends JavaPlugin{
2020
public List<String> oq = Collections.synchronizedList(new ArrayList<String>());
2121
public Integer qc = 0;
2222
public String spacer = "@#@";
23+
public String user;
24+
public String pass;
2325

2426
public void onEnable(){
2527
String[] data = loadConfig();
26-
if(data[3].equals("UNSET")){
27-
System.out.println("[CommandSync] !!! YOU MUST SET THE SERVER'S NAME IN THE CONFIG BEFORE THE PLUGIN WILL WORK FOR THIS SERVER !!!");
28+
if(data[3].equals("UNSET") || data[4].equals("UNSET") || data[5].equals("UNSET")){
29+
System.out.println("[CommandSync] !!! THE CONFIG FILE CONTAINS UNSET VALUES - YOU MUST FIX THEM BEFORE THE PLUGIN WILL WORK !!! ");
2830
return;
2931
}
3032
try{
@@ -33,6 +35,8 @@ public void onEnable(){
3335
}catch(Exception e){
3436
e.printStackTrace();
3537
}
38+
user = data[4];
39+
pass = data[5];
3640
loadData();
3741
getCommand("Sync").setExecutor(new CommandSynchronize(this));
3842
}
@@ -42,33 +46,29 @@ public void onDisable(){
4246
}
4347

4448
private String[] loadConfig(){
45-
String[] data = new String[4];
49+
String[] defaults = new String[]{
50+
"ip=localhost", "port=9190", "heartbeat=1000", "name=UNSET", "user=UNSET", "pass=UNSET"
51+
};
52+
String[] data = new String[defaults.length];
4653
try{
47-
File file = getDataFolder();
54+
File file = new File(getDataFolder(), "config.txt");
4855
if(!file.exists()){
49-
file.mkdirs();
50-
OutputStream os = new FileOutputStream(file + "/config.txt");
51-
PrintStream ps = new PrintStream(os);
52-
ps.println("ip=localhost");
53-
ps.println("port=9190");
54-
ps.println("heartbeat=1000");
55-
ps.println("name=UNSET");
56-
ps.close();
57-
System.out.println("[CommandSync] New configuration file created.");
56+
file.createNewFile();
5857
}
59-
BufferedReader br = new BufferedReader(new FileReader(file + "/config.txt"));
60-
try{
58+
PrintStream ps = new PrintStream(new FileOutputStream(file));
59+
BufferedReader br = new BufferedReader(new FileReader(file));
60+
for(int i = 0; i < defaults.length; i++){
6161
String l = br.readLine();
62-
Integer i = 0;
63-
while(l != null){
62+
if(l == null){
63+
ps.println(defaults[i]);
64+
data[i] = defaults[i].split("=")[1];
65+
}else{
6466
data[i] = l.split("=")[1];
65-
i++;
66-
l = br.readLine();
6767
}
68-
System.out.println("[CommandSync] Configuration file loaded.");
69-
}finally{
70-
br.close();
7168
}
69+
ps.close();
70+
br.close();
71+
System.out.println("[CommandSync] Configuration file loaded.");
7272
}catch(IOException e){
7373
e.printStackTrace();
7474
}

‎CommandSyncClient/src/com/fuzzoland/CommandSyncClient/ClientThread.java‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public ClientThread(CSC plugin, InetAddress ip, Integer port, Integer heartbeat,
2727
this.port = port;
2828
this.heartbeat = heartbeat;
2929
this.name = name;
30-
connect();
30+
connect(false);
3131
}
3232

3333
public void run(){
@@ -67,7 +67,7 @@ public void run(){
6767
}
6868
}
6969
}else{
70-
connect();
70+
connect(true);
7171
}
7272
try{
7373
sleep(heartbeat);
@@ -77,14 +77,31 @@ public void run(){
7777
}
7878
}
7979

80-
private void connect(){
80+
private void connect(Boolean sleep){
81+
if(sleep){
82+
try{
83+
sleep(10000);
84+
}catch(InterruptedException e){
85+
e.printStackTrace();
86+
}
87+
}
8188
try{
82-
this.socket = new Socket(ip, port);
83-
this.out = new PrintWriter(socket.getOutputStream(), true);
84-
this.in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
85-
this.connected = true;
89+
socket = new Socket(ip, port);
90+
out = new PrintWriter(socket.getOutputStream(), true);
91+
in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
92+
out.println(plugin.user);
93+
out.println(plugin.pass);
94+
if(in.readLine().equals("n")){
95+
System.out.println("[CommandSync] Sent invalid username or password.");
96+
return;
97+
}
8698
out.println(name);
87-
System.out.println("[CommandSync] Connected to " + ip.getHostName() + ":" + String.valueOf(port) + ".");
99+
if(in.readLine().equals("n")){
100+
System.out.println("[CommandSync] Sent a name that is already connected.");
101+
return;
102+
}
103+
connected = true;
104+
System.out.println("[CommandSync] Connected to " + ip.getHostName() + ":" + String.valueOf(port) + " under name " + name + ".");
88105
}catch(IOException e){
89106
System.out.println("[CommandSync] Could not connect to the server.");
90107
}

‎CommandSyncServer/src/com/fuzzoland/CommandSyncServer/CSS.java‎

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,11 @@
1313
import java.util.Arrays;
1414
import java.util.Collections;
1515
import java.util.HashMap;
16+
import java.util.HashSet;
1617
import java.util.List;
1718
import java.util.Map;
1819
import java.util.Map.Entry;
20+
import java.util.Set;
1921

2022
import com.fuzzoland.CommandSyncServer.Metrics.Graph;
2123

@@ -24,20 +26,29 @@
2426
public class CSS extends Plugin{
2527

2628
public ServerSocket server;
29+
public Set<String> c = Collections.synchronizedSet(new HashSet<String>());
2730
public List<String> oq = Collections.synchronizedList(new ArrayList<String>());
2831
public Map<String, List<String>> pq = Collections.synchronizedMap(new HashMap<String, List<String>>());
2932
public Map<String, Integer> qc = Collections.synchronizedMap(new HashMap<String, Integer>());
3033
public String spacer = "@#@";
34+
public String user;
35+
public String pass;
3136

3237
public void onEnable(){
3338
String[] data = loadConfig();
39+
if(data[3].equals("UNSET") || data[4].equals("UNSET")){
40+
System.out.println("[CommandSync] !!! THE CONFIG FILE CONTAINS UNSET VALUES - YOU MUST FIX THEM BEFORE THE PLUGIN WILL WORK !!! ");
41+
return;
42+
}
3443
try{
3544
server = new ServerSocket(Integer.parseInt(data[1]), 50, InetAddress.getByName(data[0]));
3645
System.out.println("[CommandSync] Opened server on " + data[0] + ":" + data[1] + ".");
3746
new ClientListener(this, Integer.parseInt(data[2])).start();
3847
}catch(Exception e){
3948
e.printStackTrace();
4049
}
50+
user = data[3];
51+
pass = data[4];
4152
loadData();
4253
try{
4354
Metrics metrics = new Metrics(this);
@@ -71,32 +82,29 @@ public void onDisable(){
7182
}
7283

7384
private String[] loadConfig(){
74-
String[] data = new String[3];
85+
String[] defaults = new String[]{
86+
"ip=localhost", "port=9190", "heartbeat=1000", "user=UNSET", "pass=UNSET"
87+
};
88+
String[] data = new String[defaults.length];
7589
try{
76-
File file = getDataFolder();
90+
File file = new File(getDataFolder(), "config.txt");
7791
if(!file.exists()){
78-
file.mkdirs();
79-
OutputStream os = new FileOutputStream(file + "/config.txt");
80-
PrintStream ps = new PrintStream(os);
81-
ps.println("ip=localhost");
82-
ps.println("port=9190");
83-
ps.println("heartbeat=1000");
84-
ps.close();
85-
System.out.println("[CommandSync] New configuration file created.");
92+
file.createNewFile();
8693
}
87-
BufferedReader br = new BufferedReader(new FileReader(file + "/config.txt"));
88-
try{
94+
PrintStream ps = new PrintStream(new FileOutputStream(file));
95+
BufferedReader br = new BufferedReader(new FileReader(file));
96+
for(int i = 0; i < defaults.length; i++){
8997
String l = br.readLine();
90-
Integer i = 0;
91-
while(l != null){
98+
if(l == null){
99+
ps.println(defaults[i]);
100+
data[i] = defaults[i].split("=")[1];
101+
}else{
92102
data[i] = l.split("=")[1];
93-
i++;
94-
l = br.readLine();
95103
}
96-
System.out.println("[CommandSync] Configuration file loaded.");
97-
}finally{
98-
br.close();
99104
}
105+
ps.close();
106+
br.close();
107+
System.out.println("[CommandSync] Configuration file loaded.");
100108
}catch(IOException e){
101109
e.printStackTrace();
102110
}

‎CommandSyncServer/src/com/fuzzoland/CommandSyncServer/ClientHandler.java‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,32 @@ public class ClientHandler extends Thread{
2323
public ClientHandler(CSS plugin, Socket socket, Integer heartbeat) throws IOException{
2424
this.plugin = plugin;
2525
this.socket = socket;
26-
this.out = new PrintWriter(socket.getOutputStream(), true);
27-
this.in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
2826
this.heartbeat = heartbeat;
29-
this.name = in.readLine();
27+
out = new PrintWriter(socket.getOutputStream(), true);
28+
in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
29+
System.out.println("[CommandSync] Received new connection from " + socket.getInetAddress().getHostName() + ":" + socket.getPort() + ".");
30+
String user = in.readLine();
31+
String pass = in.readLine();
32+
if(!user.equals(plugin.user) || !pass.equals(plugin.pass)){
33+
System.out.println("[" + socket.getInetAddress().getHostName() + ":" + socket.getPort() + "] [" + name + "] Provided invalid username or password.");
34+
out.println("n");
35+
socket.close();
36+
return;
37+
}
38+
out.println("y");
39+
name = in.readLine();
40+
if(plugin.c.contains(name)){
41+
System.out.println("[" + socket.getInetAddress().getHostName() + ":" + socket.getPort() + "] [" + name + "] Provided a name that is already connected.");
42+
out.println("n");
43+
socket.close();
44+
return;
45+
}
46+
out.println("y");
3047
if(!plugin.qc.containsKey(name)){
3148
plugin.qc.put(name, 0);
3249
}
33-
System.out.println("[CommandSync] Received new connection from " + socket.getInetAddress().getHostName() + ":" + socket.getPort() + " under name " + name + ".");
50+
plugin.c.add(name);
51+
System.out.println("[CommandSync] Connection from " + socket.getInetAddress().getHostName() + ":" + socket.getPort() + " under name " + name + " has been authorised.");
3452
}
3553

3654
public void run(){
@@ -39,6 +57,7 @@ public void run(){
3957
out.println("heartbeat");
4058
if(out.checkError()){
4159
System.out.println("[CommandSync] Connection from " + socket.getInetAddress().getHostName() + ":" + socket.getPort() + " under name " + name + " has disconnected.");
60+
plugin.c.remove(name);
4261
return;
4362
}
4463
while(in.ready()){
@@ -106,9 +125,8 @@ public void run(){
106125
plugin.qc.put(name, count);
107126
}
108127
sleep(heartbeat);
109-
}catch(IOException e){
110-
e.printStackTrace();
111-
}catch(InterruptedException e){
128+
}catch(Exception e){
129+
plugin.c.remove(name);
112130
e.printStackTrace();
113131
}
114132
}

0 commit comments

Comments
 (0)