Resource icon

Hotfix for TeamSpeak vulnerabilities [till 3.0.13] 1.0.0

No permission to download
Overview History Discussion
R

Ramses

Active Member
Sep 11, 2016
33
2
80
ut it doesnt fix the exploit.. We only have to change one line of code to circumvent your "fix". Which is already done in the dev versions of the exploit. You can upload fix file?
cuncuska said:
i no use iptables need rules
Click to expand...
I need iptables help. I no have binary.
 
R

Ramses

Active Member
Sep 11, 2016
33
2
80
VJean said:
Code: 
-A INPUT -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j LOG --log-prefix "TS3 sploit: " --log-level 4
-A INPUT -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j DROP
or
Code: 
-I INPUT 5 -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j LOG --log-prefix "TS3 sploit: " --log-level 4
-I INPUT 6 -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j DROP
where 5,6 - number line rule.
Click to expand...
Please upload done file. I no can modify hex editor
 
ehthe

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,028
896
216
Why don't you update ? Everything in this thread is seriously outdated.
 
R

Ramses

Active Member
Sep 11, 2016
33
2
80
cuncuska said:
i no use iptables need rules
Click to expand...
# Flush rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F PREROUTING
iptables -t raw -F OUTPUT
# List policies first
iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT;
# Disable connection tracking on voice server ports
iptables -A PREROUTING -t raw -p udp --dport 9987 -j NOTRACK
iptables -A OUTPUT -t raw -p udp --sport 9987 -j NOTRACK
# Allow TCP inbound
iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 21,22 -j ACCEPT
# Drop invalid UDP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 0:32 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 2521:65535 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 98 -j DROP
# Drop TS3 booter methods
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|fa163eb402096ac8|' --algo kmp -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|71f63813d5422309|' --algo kmp -j DROP
# Allow incoming packets related to outgoing ones.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow UDP inbound
iptables -A INPUT -p udp --dport 9987 -j ACCEPT
# Allow ICMP
iptables -A INPUT -p icmp -j ACCEPT
# Log all dropped packets to /var/log/messages
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

and client drop logs
 
R

Ramses

Active Member
Sep 11, 2016
33
2
80
Energeek said:
I don't recommend this ; Client can crash when sending certain text messages (timeout after 10 seconds, only voice is transmitted before reconnection).
Click to expand...
-A INPUT -p udp -m udp -j DROP --match length --length 300:350 should I use it? and you will not drop?
 
R

Ramses

Active Member
Sep 11, 2016
33
2
80
dedmen said:
Which fix are you using? iptables or binary?
Click to expand...
# Flush rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F PREROUTING
iptables -t raw -F OUTPUT
# List policies first
iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT;
# Disable connection tracking on voice server ports
iptables -A PREROUTING -t raw -p udp --dport 9987 -j NOTRACK
iptables -A OUTPUT -t raw -p udp --sport 9987 -j NOTRACK
# Allow TCP inbound
iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 21,22 -j ACCEPT
# Drop invalid UDP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 0:32 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 2521:65535 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 98 -j DROP
# Drop TS3 booter methods
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|fa163eb402096ac8|' --algo kmp -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|71f63813d5422309|' --algo kmp -j DROP
# Allow incoming packets related to outgoing ones.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow UDP inbound
iptables -A INPUT -p udp --dport 9987 -j ACCEPT
# Allow ICMP
iptables -A INPUT -p icmp -j ACCEPT
# Log all dropped packets to /var/log/messages
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

my iptables and have drops
 
LetsBlade

LetsBlade

Member
Jan 7, 2017
102
14
53
"November 2k16" Was there even the Stable Version out for 3.1.1? xD And the Video was still made at February
 
J

jasmin

Restricted
Jan 26, 2017
4
0
13
LetsBlade said:
"November 2k16" Was there even the Stable Version out for 3.1.1? xD And the Video was still made at February
Click to expand...
Wayne fore the Date, In the Changelog of Teamspeak Client is nothing about a "WINDOWS" crash fix!
He found the Exploit but dosen't report Teamspeak to fix that ;) R4P3 wan't only Money, they Release Tools for VIP you most pay and they make that so hard to find a Crash look at Splamy he has written a solo Ts3 Protocol and in this Video he has also give this Client badges that not released!
very bad r4p3 ;*
 
Alligatoras

Alligatoras

Administrator
Mar 31, 2016
2,570
12
2,857
381
You are f**king retards!
R4P3 is not your favorite page about teamspeak cracks ands bug reports!
R4P3 is a security research team - something that you kids don't want to understand!
We are not your toys and of course we won't keep our heads above teamspeak to find and get anything that your little brain desires!
 
J

jasmin

Restricted
Jan 26, 2017
4
0
13
Alligatoras said:
You are f**king retards!
R4P3 is not your favorite page about teamspeak cracks ands bug reports!
R4P3 is a security research team - something that you kids don't want to understand!
We are not your toys and of course we won't keep our heads above teamspeak to find and get anything that your little brain desires!
Click to expand...
Don't cry, it's okay that you'r a little skid they search on "Hackforums" for many scripts and post that on r4p3
You are saying to that r4p3 is a security research team - why r4p3 release Tools for VIP and say Teamspeak how to fix that? yes just want money...
And your "R4P3 Team" consists of nothing, it's only your community that does something and you only release it
And you Alligatoras, you just release all Scripts from other users to this website you have do nothing here and then you say you are a security researcher? haha
Now to the R4P3 bot that obfuscated with Confuser give me 2 days and i will deobfuscate it and leak all of this bot :*
 
Alligatoras

Alligatoras

Administrator
Mar 31, 2016
2,570
12
2,857
381
It's easy - if you don't like it here just don't login again!
Nobody forced you to register here or spend money!
 
ehthe

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,028
896
216
jasmin said:
Don't cry, it's okay that you'r a little skid they search on "Hackforums" for many scripts and post that on r4p3
You are saying to that r4p3 is a security research team - why r4p3 release Tools for VIP and say Teamspeak how to fix that? yes just want money...
And your "R4P3 Team" consists of nothing, it's only your community that does something and you only release it
And you Alligatoras, you just release all Scripts from other users to this website you have do nothing here and then you say you are a security researcher? haha
Now to the R4P3 bot that obfuscated with Confuser give me 2 days and i will deobfuscate it and leak all of this bot :*
Click to expand...
I would personally do much better without the majority of the community which consists of kids wanting to make money from insecure php shit and not knowing proper english :)

( should we split this in a rant thread ? )
 
J

jasmin

Restricted
Jan 26, 2017
4
0
13
Alligatoras said:
It's easy - if you don't like it here just don't login again!
Nobody forced you to register here or spend money!
Click to expand...
Suck at Apshyxias Eggs are you happy because you are Super Mod on a cheap forum? haha
ehthe said:
I would personally do much better without the majority of the community which consists of kids wanting to make money from insecure php shit and not knowing proper english :)

( should we split this in a rant thread ? )
Click to expand...
Oha boy the whole php script here is already much longer published on other site exactly as the RFI which was not times of R4P3 but wayne simply indicate haha
 
ehthe

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,028
896
216
jasmin said:
Suck at Apshyxias Eggs are you happy because you are Super Mod on a cheap forum? haha

Oha boy the whole php script here is already much longer published on other site exactly as the RFI which was not times of R4P3 but wayne simply indicate haha
Click to expand...
Do you english ? I did not understand anything you wrote.
 
You must log in or register to reply here.
Top