TeamSpeak 3 Avatar Crash Client [3.0.0 - 3.0.17]

[Asphyxia]

There is currently a TeamSpeak 3 security issue as of September 08, 2015. Clients may set a certain avatar causing others to crash. This is how it can be used for testing purposes only. It should be clear that neither R4P3.NET nor any of the members here should be held responsible for misuse of this PoC (proof of concept) plugin. The intended use is on your own client on your own server. What you do with this is your choice, not ours.

1. Open your TeamSpeak 3 client.
2. Settings ---> Options ---> Application ---> Update Channel = BETA, APPLY.
3. Help ---> Check for Update, UPDATE
4. If you have the 32bit TeamSpeak client, download the x86 attached file. If you have the 64bit TeamSpeak client download the x64 attached file. Run the ts3_plugin file, install the plugin.
5. Plugins ---> AvRape ---> Upload

This is the free version, for the VIP version without mentioning of R4P3.NET please register and become a VIP to support our community.

------
Here is a video demonstrating the usage of the plugin available in our VIP section (Releases). If you are interested in this, click on VIP Access and donate to the community just $5.00 which funds our web resources, voice communication server and security solutions.

http://www.funnyordie.com/videos/25358c1940/teamspeak-3-crash-client [Please click on Funny at the bottom left of the video] ♥

 

[Asphyxia]

This is mirrored from the TeamSpeak forum.
When we click another users avatar we crash.

Hello, I moderate a small community server and lately a couple of people have been joining named 'xxxxxx Whenever they come in they just play loud music and troll the TS. When we attempt to click their names to mute/ban them we instantly crash due to their Avatars. Is there any possible way to ban them without clicking their names?

Update your server to altest version and do not allow to set avatars bigger than 1 megabyte or remove the ability for guests at all.

And there are ways!
Click the name in the chat or search it in client list.
Or set a password on your server. Thoose guys come back if you ban them.

If your not wanting to password the server I would suggest disallowing guest to set avatar and in the All Clients window (Permissions -> List All Clients) right click them to delete their avatars or delete them from the database all together.

Moderated channels also can prevent guest from loud noise trolling.

 

[Kaptan647]

Another Dante696's stupid posts He have no idea about how we do it lol

 

[Supervisor]

Well, I always thought they'd read the forum. Looks like they don't. lol
Better for us I guess, haha

 

[Asphyxia]

Just going to bump this, since it has been updated recently.

 

[User_418]

Was it published at 06.09.2015? Strange, I already encountered someone with it at 23.08.2015. He had his name autochanged to "R4P3.NET Public Hack", so I thought that it's public version.

But anyway, thanks for sharing!

 

[Asphyxia.Cell]

No, this issue was found a while ago by us. We (R4P3.NET members) are the original creators of the plugins involving this to my knowledge. Credits go to ehthe for making the first successful version.

 

[ehthe]

 

[Yismokesbong]

Thanks bro, works like a charm!

 

[Soza]

Works perfect.

 

[Supervisor]

You may share this very nice free version with your friends (and you may also tell them about R4P3 )

 

[Soza]

How fast do you think this will be fixed?

 

[Supervisor]

The crash is fixed already. If you set the beta channel you can download 3.0.18
In 3.0.18 TeamSpeak updated the QT to 5.5 where this weakpoint no longer exists. Thats why you have to use it now while most people still use 3.0.17

 

[micha]

loading image all the time?

 

[bl4uni]

It is actually really useful right now, because when you update, you can click on your name without worrying of your own client crashing.

Btw. if you happen to meet someone using this on your server and youre unable to ban or even move that person, just open the "Contacts" menu. Now drag that Persons name from the Server's Chat into your Contacts. Using the Ignore tab you can set to remove that persons avatar on your client. Now you will just have to delete the avatar by right clicking (without crashing).

 

[User_418]

It is actually really useful right now, because when you update, you can click on your name without worrying of your own client crashing.

Btw. if you happen to meet someone using this on your server and youre unable to ban or even move that person, just open the "Contacts" menu. Now drag that Persons name from the Server's Chat into your Contacts. Using the Ignore tab you can set to remove that persons avatar on your client. Now you will just have to delete the avatar by right clicking (without crashing).

List all clients>Enter name>Hit search button>Ban client
A lot easier, isn't it?

Also autobanning everyone who uses this namechange works too.

 

[Asphyxia.Cell]

There is no name change.

 

[User_418]

There is no name change.

Really? Okay, I haven't tested it, but I saw this:

This is the free version, for the VIP version without mentioning of R4P3.NET please register and become a VIP to support our community.

And according to my previous message, I found someone who used this (or some sort of it) exploit with automatic namechange to R4P3.NET Public Hack.

Admin edit: mention of a broken link.

 

[Bluscream]

@Kirill You need to use r4p3.net instead of forum.r4p3.net now...

Im also a bit fucked up by all the changes we go through now ...

 

[User_418]

@Kirill You need to use r4p3.net instead of forum.r4p3.net now...

Im also a bit fucked up by all the changes we go through now ...

Well, I know, but link was to forum.r4p3.net ...