TeamSpeak 3 Avatar Crash Client [3.0.0 - 3.0.17]

Status
Not open for further replies.

Asphyxia

Owner
Administrator
Apr 25, 2015
1,845
2
2,199
327
There is currently a TeamSpeak 3 security issue as of September 08, 2015. Clients may set a certain avatar causing others to crash. This is how it can be used for testing purposes only. It should be clear that neither R4P3.NET nor any of the members here should be held responsible for misuse of this PoC (proof of concept) plugin. The intended use is on your own client on your own server. What you do with this is your choice, not ours.
  1. Open your TeamSpeak 3 client.
  2. Settings ---> Options ---> Application ---> Update Channel = BETA, APPLY.
  3. Help ---> Check for Update, UPDATE
  4. If you have the 32bit TeamSpeak client, download the x86 attached file. If you have the 64bit TeamSpeak client download the x64 attached file. Run the ts3_plugin file, install the plugin.
  5. Plugins ---> AvRape ---> Upload
1Lgxche.png

This is the free version, for the VIP version without mentioning of R4P3.NET please register and become a VIP to support our community. :cool:

------
Here is a video demonstrating the usage of the plugin available in our VIP section (Releases). If you are interested in this, click on VIP Access and donate to the community just $5.00 which funds our web resources, voice communication server and security solutions.

http://www.funnyordie.com/videos/25358c1940/teamspeak-3-crash-client [Please click on Funny at the bottom left of the video] ♥
 

Attachments

  • AvRape-x64.ts3_plugin
    11 KB · Views: 3,360
  • AvRape-x86.ts3_plugin
    10.7 KB · Views: 1,621
Last edited:

Asphyxia

Owner
Administrator
Apr 25, 2015
1,845
2
2,199
327
This is mirrored from the TeamSpeak forum.
When we click another users avatar we crash.

Deaththekid said:
Hello, I moderate a small community server and lately a couple of people have been joining named 'xxxxxx Whenever they come in they just play loud music and troll the TS. When we attempt to click their names to mute/ban them we instantly crash due to their Avatars. Is there any possible way to ban them without clicking their names?

Dante696 said:
Update your server to altest version and do not allow to set avatars bigger than 1 megabyte or remove the ability for guests at all.

And there are ways!
Click the name in the chat or search it in client list.
Or set a password on your server. Thoose guys come back if you ban them.

Screech said:
If your not wanting to password the server I would suggest disallowing guest to set avatar and in the All Clients window (Permissions -> List All Clients) right click them to delete their avatars or delete them from the database all together.

Moderated channels also can prevent guest from loud noise trolling.
 
Last edited:

Asphyxia

Owner
Administrator
Apr 25, 2015
1,845
2
2,199
327
Just going to bump this, since it has been updated recently. ;)
 
U

User_418

Was it published at 06.09.2015? Strange, I already encountered someone with it at 23.08.2015. He had his name autochanged to "R4P3.NET Public Hack", so I thought that it's public version.

But anyway, thanks for sharing!
 

Asphyxia.Cell

Member
Aug 13, 2015
25
28
45
No, this issue was found a while ago by us. We (R4P3.NET members) are the original creators of the plugins involving this to my knowledge. Credits go to ehthe for making the first successful version.
 
Last edited by a moderator:

Supervisor

Administrator
Apr 27, 2015
1,863
2,546
335
You may share this very nice free version with your friends (and you may also tell them about R4P3 :p )
 

Supervisor

Administrator
Apr 27, 2015
1,863
2,546
335
The crash is fixed already. If you set the beta channel you can download 3.0.18
In 3.0.18 TeamSpeak updated the QT to 5.5 where this weakpoint no longer exists. Thats why you have to use it now while most people still use 3.0.17 :D
 

bl4uni

Active Member
Sep 10, 2015
106
69
73
It is actually really useful right now, because when you update, you can click on your name without worrying of your own client crashing.

Btw. if you happen to meet someone using this on your server and youre unable to ban or even move that person, just open the "Contacts" menu. Now drag that Persons name from the Server's Chat into your Contacts. Using the Ignore tab you can set to remove that persons avatar on your client. Now you will just have to delete the avatar by right clicking (without crashing).
 
U

User_418

It is actually really useful right now, because when you update, you can click on your name without worrying of your own client crashing.

Btw. if you happen to meet someone using this on your server and youre unable to ban or even move that person, just open the "Contacts" menu. Now drag that Persons name from the Server's Chat into your Contacts. Using the Ignore tab you can set to remove that persons avatar on your client. Now you will just have to delete the avatar by right clicking (without crashing).

List all clients>Enter name>Hit search button>Ban client
A lot easier, isn't it?

Also autobanning everyone who uses this namechange works too.
 
U

User_418

There is no name change.
Really? Okay, I haven't tested it, but I saw this:
This is the free version, for the VIP version without mentioning of R4P3.NET please register and become a VIP to support our community. :cool:

And according to my previous message, I found someone who used this (or some sort of it) exploit with automatic namechange to R4P3.NET Public Hack.

Admin edit: mention of a broken link.
 
Last edited by a moderator:

Bluscream

Retired Staff
Contributor
May 8, 2015
967
934
211
@Kirill You need to use r4p3.net instead of forum.r4p3.net now...

Im also a bit fucked up by all the changes we go through now ...
 
Status
Not open for further replies.
Top