EventScripts Forums
Mattie's EventScripts and Source Forums
Mattie recommends...
Premier Sponsor:Platinum Sponsor:
 
Script Categories
16000 (15) abilities (15) addon (71) addons (17) admin (348) admins (23) advert (27) adverts (26) afk (17) alerts (12) ammo (25) anti (20) armor (11) auth (16) automatic (15) awp (29) ban (24) ba_jail (34) bhop (45) block (27) bomb (47) bonus (25) boost (21) bot (35) bot-management (20) bots (24) bullet (13) bunnyhop (18) Buy (27) buymenu (13) c4 (12) cash (76) Change (14) chat (75) cheat (15) clan (17) classes (24) color (30) colors (20) command (23) commands (20) config (28) configurable (11) connect (54) counter (11) Counter-Strike-Source (18) CS:S (20) css (3313) custom (13) Damage (48) database (14) dead (19) Deagle (11) death (19) deathmatch (79) deathrun (17) deutsch (13) dice (11) disconnect (24) Dissolve (12) dm (24) dod:s (11) dods (494) download (12) easy (26) effect (14) effects (125) English (16) entity (24) est (12) es_tools (14) Eventscript (12) exploit (11) flashbang (27) français (104) french (36) fun (312) funny (18) Gabeee (11) game (12) gamemode (11) gameplay (175) German (11) give (20) gravity (15) grenade (28) grenades (32) gun (15) GunGame (31) GunGame5 (11) guns (20) Hack (16) headshot (37) health (70) hegrenade (15) help (11) hit (13) hl2dm (432) HP (25) hudhint (11) hungarian (22) info (52) information (17) invisible (11) IP (13) jail (79) jailbreak (14) join (44) jump (19) kick (25) kill (50) kills (23) knife (65) leveling (38) LnD (14) lol (11) magyar (32) management (14) manager (11) mani (16) map (31) map-management (26) maps (17) match (21) Memphis-84 (13) menu (139) message (30) messaging (52) minecraft (12) mod (121) model (18) models (32) modye (16) money (50) motd (13) music (32) mute (20) nades (20) name (15) new (13) noblock (53) orangebox (23) player (46) player-management (31) player-tracking (28) popup (70) prop (13) propmenu (14) props (34) protect (11) protection (31) punish (11) punishment (51) python (79) quake (32) QuakeSounds (12) race (13) races (20) radio (29) random (47) rank (41) rates (15) rcon (12) realism (22) Regeln (22) respawn (67) restrict (40) round (26) rpg (32) rules (60) say (16) score (15) scout (29) Script (25) script-helper (25) scriptpack (33) sdk (171) server (60) server-tools (42) shop (12) showdamage (19) silly (31) simple (31) skin (17) skins (34) slay (13) soccer (14) sound (63) sounds (106) source (13) spanish (18) spawn (81) speed (25) statistics (13) stats (55) status (15) Steam (11) STEAMID (29) Superhero (15) surf (41) Team (29) team-balance (14) teleport (16) text (17) TF2 (142) time (22) timer (15) tools (15) tracers (19) triggers (11) uedi (17) uses_auth (18) vip (23) vote (39) voting (22) war (25) Warcraft (12) warcraft-source (20) wc3 (14) wcs (47) wcs:Python (32) weapon (87) weapons (116) web (16) welcome (12) wuerfeln (11) zm (26) zombie (99) zombiemod (55) zombies (12)
Script Authors
*XYZ*SaYnt (12) .:MiB:. (20) .:modye:. (14) .eMko* (6) 101satoon101 (12) 3R10N (24) 4u571n91 (5) 7355608 (9) Absolute (9) Ace Rimmer (40) adminc (5) Adz (8) AgathaKnuppelkuh (8) aidden (8) ajax (5) ak_47 (6) Al3c Tr3v3lyan (6) allstareng (5) ashbash1987 (9) ATAMAH (7) Ayuto (5) aznone (5) B00M (5) BackRaw (41) BFH_RedBull (8) bigfabi (8) Bioko (10) blackshoxx (9) Blade (10) bladesback (13) bobdole (11) bodzsar1 (8) bonbon (36) Brainsucker (32) cagemonkey (8) capo azzlack (7) captain master (6) carbon-14 (10) CaskioUTF (5) cbirou (15) CbRRR (16) ChaCaLz2psy4 (5) CharlesT (5) Chrisber (5) chrismrulz (10) Chun (6) cladiron (10) clipz934 (8) Colster (21) Cookieman8 (7) CrAzD (6) craziest (11) dani12356 (12) DanielB (19) Darkness123 (8) Dave (9) dbozan99 (7) deathx9 (5) Deathyy (16) dhack (17) Di[M]aN (12) DJ Fire-Black prod (8) DoCky (31) Don (15) dordtcore (9) DragonFreddo (8) Drassil (5) dretax14 (11) Einlanzers (47) EmbouT (10) emilplov (7) Errant (10) Eun (6) Fantole (10) FMIS (5) Franc1sco (17) freddukes (18) Frequency (6) Fugi91 (6) Fulmine (5) G4ME (5) GAMEREN2 (8) german9114 (13) GODJonez (40) GoodfellaDeal (5) Hansi (6) Hisoka (6) HitThePipe (7) HOLLDIDAY (24) Icetouch (6) ichthys (25) Im the new guy (14) iNexus (13) infamous1 (9) isivisi (13) ispaine (7) Jackmaster (9) Jeff91 (45) JoeyT2006 (30) Juba_PornBorn (12) jxl180 (11) KDBFame (6) L'In20Cible (11) L.P.H (8) Largo Usagi (10) LnD (14) Lobe (11) loKkdoKk (8) lolo-le-haricot (7) LosNir (5) Lumpi@Work (9) M4rc3L-XCN (7) macshot (7) magyar-oneill (9) Matth (7) Mattie (21) mave1993 (5) MBchrono (15) McFly (20) Medda (5) Memphis-84 (15) Messiah93 (19) Mickyy (5) micmacx (6) Mitchell (5) Mixer57 (5) modye (6) Monster_Bitch1 (9) Mordavolt (7) motomoto (10) MrScriptaz (6) mryoung (6) MyTechZone.de (8) Nicolous (23) ojii (31) oliVier (10) Omega68 (6) Omega_K2 (11) Owned|Myself (8) P3N (7) pand3mic (6) parsimba (5) Pascal257 (9) PatPeter (7) PDrop (10) Phaedrus (18) PhantOm Fury (7) phoenix131 (9) pinkyyy -.- (5) pitbull0993 (7) PixelGamer (7) randomknifer (9) Raptor150 (31) Ratzee (6) ReaCtioN2oo9 (6) RedCliff (5) Rennnyyy (17) revolutionfighters (8) RideGuy (12) Rio (9) Roeliekt (6) roof (16) runamagic (13) Ryezin (5) sandking220 (6) Sarcasm_Poisoning (10) saRs| Johnny-5 (13) Schubaal (10) sea212 (5) sega74rus (15) sgt.angel (6) Shad0w (11) ShoTaXx# (7) sicilia (7) sicman_adrian (22) skillz92 (7) sn4k3 (18) Snake12 (7) snake38 (10) sonicsight (7) SpeedFreak (9) spoonman184 (10) stabby (22) stas (27) Stirni (6) stonedegg (7) Strontium Dog (30) SumGuy14 (25) SuperDave (49) surfteam (5) TaCo (5) TanaToS (17) Tealk (6) teowow (16) TheCheeTaH (27) TheDonFather (5) theresthatguy (6) Tiny Tod (7) tooshkan4uk (8) Totyahun (9) uedi (38) ultimatebuster (6) Undead (25) usernamesaretaken (15) wanted241 (9) Warren (13) westham (6) WhiteAvenger (7) Wonder (14) Wundermaxe (5) X-Mania (5) XE_ManUp (14) xfalcon61 (5) zSweetXz (5) ZZMatty (6) [Cs]Lord_Inferno2 (11) [DAP]Kickbutt (5) [NATO]Hunter (28) ||Wolf|| (10)
Search

Post new topic Reply to topic
Go to page 1, 2, 3  Next
Author Message
User avatar
Site Administrator
Site Administrator
Profile

Posts: 7631
Location:
At Work
 
New postPosted: 2006-02-03, 11:46 pm 
   Post subject: Mattie's System Plugin v0.1 Beta

NOTE: v0.1 has been deprecated. After reading the warnings below, please use the version here:
http://forums.mattie.info/cs/forums/vie ... php?t=7179

[original post below]
I put together a simple, simple plugin. Yet it has a lot of security implications.

Mattie's System Plugin
Before you download the plugin, read the notes below.

WARNING:
  • If you install this plugin, any admin with rcon or console access can run any executable on your system. This includes the ability to delete every file on your filesystem or turn your server into a zombie.
  • Exploiting this requires access to your server console or rcon. Yet, if you write bad scripts that aren't careful about usernames and say text, players may be able to take advantage of this.
  • If you install this on your server, you do so at your own risk. I actually recommend that you do not install this since you never know what could happen. All legal responsibility is yours if something bad happens.
  • It's highly recommended that you run srcds as a user account with very low privileges. Do not run as system or root.
  • Never let this plugin interact with player-created strings. This opens too many avenues for abuse.
  • NEVER install this plugin anywhere other than your dedicated server. This plugin is a very bad thing to install on your local Counter-Strike that you use to play on people's servers. Use dedicated servers only.

Now that I've scared you away, what does this plugin do?

Description
    It only has one console command:
    • system <command-string>
      Tells the operating system to run command-string.
      Example: system wget --spider "http://mattie.info/db/serverup.php"
      Example: system cmd.exe /c echo CreateIt > c:\output.txt
    In a nutshell, the system command lets you run any program just as if you were sitting at a command prompt on that system. This is very powerful and very dangerous. Please reread my warnings above.

    What can you do with it? Well, anything. It works particularly well with EventScripts. Now anything an executable can do, your scripts can do. This could involve calling a Perl script, Python script, your own program, or anything else you can upload to your server.

    For example, let's say I want to talk to mysql, I just need to be sure my mysql console is in the PATH (or provide the full path to it) and send a command-line with the query on it. You can format your command-line with es_format, too.

    If you were so inclined, you could write a PHP website that stores user stats or anything else via a website. You need to make sure the "wget" program is in your path, and you could do something like this:

    player_death.cfg
    Code:
    es_setinfo myurl 0
    es_format myurl "http://mattie.info/stats.php?killedby=%1" event_var(weapon)
    es system wget --spider server_var(myurl)


    This would visit a webpage, but that webpage could be written to take the query string value and do something with it. Like keep a running tally of weapon kills on your server.

    Right now the system call just executes the program and returns. To get information back into the game, you need to write your own executable, script, or batch file. It can send the info back via an rcon utility (e.g. "rcon es_setinfo player_allowed 1"), via the creation of a .cfg file that your server regularly executes (e.g. "echo es_setinfo player_allowed 1 > runme.cfg") or by writing to an EventScripts keygroup file that you read in later via es_keygroupload.

Download
Latest Beta (recommended):
Original Plugin:


Questions and thoughts welcome,
-Mattie


Last edited by Mattie on 2007-05-06, 11:31 pm, edited 6 times in total.




User avatar
Regular
Profile

Posts: 150
 
New postPosted: 2006-02-04, 5:42 am 

Holy

F*****g

S**t.

I've wanted something like this for so long that I just wet my pants.

_________________
-Faaip
http://www.toolcs.com/


User avatar
Moderator
Moderator
Profile

Posts: 4920
Location:
/dev/null
 
New postPosted: 2006-02-04, 6:31 am 

*promptly hacks Faaip's server* :P

_________________
~ The_WuH
_________________
All code I give out is licensed - http://creativecommons.org/licenses/by-nc-sa/3.0/us/
Image
Weeks of programming can save you hours of planning.


User avatar
EventScripts Administrator
EventScripts Administrator
Profile

Posts: 3483
Location:
Calgary, Waterloo, Ottawa
 
New postPosted: 2006-02-04, 9:32 am 

wow! awesome, completely utterly awesome.

edit: crashes when I dont supply a commandstring. Other than that my first little tests worked.

_________________
Image
Image


User avatar
Reader
Profile

Posts: 81
Location:
Poland
 
New postPosted: 2006-02-04, 4:42 pm 

the force is strong in this plugin.
compile it for sourcemm could you?? ;]

_________________
Don't run from me. You will only die tired :>
Image


User avatar
Moderator
Moderator
Profile

Posts: 4920
Location:
/dev/null
 
New postPosted: 2006-02-04, 4:54 pm 

rodpod wrote:
the force is strong in this plugin.
compile it for sourcemm could you?? ;]


... yet again there is no reason to do that.

Also as a side comment at Mattie, all this power and still no ability to read / write to normal files???

_________________
~ The_WuH
_________________
All code I give out is licensed - http://creativecommons.org/licenses/by-nc-sa/3.0/us/
Image
Weeks of programming can save you hours of planning.


User avatar
Site Administrator
Site Administrator
Profile

Posts: 7631
Location:
At Work
 
New postPosted: 2006-02-04, 5:33 pm 

awuh0 wrote:
rodpod wrote:
the force is strong in this plugin.
compile it for sourcemm could you?? ;]


... yet again there is no reason to do that.

Also as a side comment at Mattie, all this power and still no ability to read / write to normal files???


Yeah, I'll probably come around on that one. I want EventScripts to be secure though, and you have to careful with writing to files.

If you guys are curious with the sort of thing you can do with the System plugin, check this page:
http://mattie.info/connect

And then visit my beta test server here: 205.234.191.34:27015

Basically, I wrote a player_activate.cfg that visits a website, outputs the response to a .cfg file and executes it a few seconds later. The website has a DB back-end that stores the information.

Biggest problem with that site is that people can change connect strings for other people, but, oh well. I'll ban their IPs from my web servers if they do. ;)
-Mattie


User avatar
Moderator
Moderator
Profile

Posts: 4920
Location:
/dev/null
 
New postPosted: 2006-02-05, 12:42 am 

Very Nice!

Im fixing the last few bugs in my es_tools plugin, and I will release it later... this morning.

Would you mind showing how your connecting to the DB?
I dont thing they have ODBC for linux.. :oops:

_________________
~ The_WuH
_________________
All code I give out is licensed - http://creativecommons.org/licenses/by-nc-sa/3.0/us/
Image
Weeks of programming can save you hours of planning.


User avatar
Site Administrator
Site Administrator
Profile

Posts: 7631
Location:
At Work
 
New postPosted: 2006-02-05, 1:09 am 

awuh0 wrote:
Very Nice!

Im fixing the last few bugs in my es_tools plugin, and I will release it later... this morning.

Would you mind showing how your connecting to the DB?
I dont thing they have ODBC for linux.. :oops:


Here's how it works. It's nothing fancy:
  • Player connects
  • player_activate.cfg calls "system wget" to visit a website and store the output from the website to STEAMID.cfg
  • The website was written in ASP/VBScript (you could use PHP, C++ CGI, Perl, whatever) to read from an Access DB.
  • The website takes a steamid as part of the URL and looks it up in the database.
  • If it's found, it outputs the plain text of "es_keysetvalue connectstrings Players STEAMID text". This is saved as the STEAMID.cfg by wget on the CS:S server.
  • player_activate.cfg uses es_delayed to exec STEAMID.cfg
  • player_activate.cfg uses es_delayed to announce the connectstring if it was set by the above cfg file.
  • I wrote a separate VBScript page that will save connect strings to the afforementioned database.


On the CS:S side, all I'm really doing is calling "wget" from the command-line to visit a website and exec the resulting text. The website does most of the database work. I was going to use MySQL but I have an older project that used Access that only took me 15 minutes to port into this instead.

Here's the player_activate.cfg:
Code:
// player_activate.cfg
es_xsetinfo url 0
es_format url "http://mattie.info/connect/XXXXXXXXX.asp?steamid=%1" event_var(es_steamid)


es_xsetinfo cfgrun 0
es_setinfo cfgout event_var(es_steamid)
// fix the steamid so it can be a filename
es_string cfgout replace ":" "-"
// for exec'ing later
es_format cfgrun "users/%1.cfg" server_var(cfgout)
// for writing to disk by wget
es_format cfgout "cstrike/cfg/users/%1.cfg" server_var(cfgout)

// call wget and tell it to save the website response to cfgout
es system cstrike/wget -O server_var(cfgout) server_var(url)
// now we want to run the file after a few seconds (which aligns nicely to when they can see the announcement)
es_delayed 3 exec server_var(cfgrun)
es_delayed 5 es_setinfo outputtext 0
// web server calls es_keysetvalue so lets read it out
es_delayed 5.1 es_xkeygetvalue outputtext connectstrings Players event_var(es_steamid)
es_delayed 5.2 es_xmsg #green event_var(es_username) has connected.
es_xdelayed 5.2 if (server_var(outputtext) notequalto 0) then es_xmsg #green ==]
es_xdelayed 5.2 if (server_var(outputtext) notequalto 0) then es_xmsg #green ==] server_var(outputtext)
es_xdelayed 5.2 if (server_var(outputtext) notequalto 0) then es_xmsg #green ==]


I look forward to seeing the es_tools plugin!
-Mattie


User avatar
Moderator
Moderator
Profile

Posts: 508
 
New postPosted: 2006-02-05, 1:36 am 

I really can't imagine using it for anything myself :\


User avatar
Moderator
Moderator
Profile

Posts: 4920
Location:
/dev/null
 
New postPosted: 2006-02-05, 2:38 am 

Mattie wrote:
awuh0 wrote:
Very Nice!

Im fixing the last few bugs in my es_tools plugin, and I will release it later... this morning.

Would you mind showing how your connecting to the DB?
I dont thing they have ODBC for linux.. :oops:


Here's how it works. It's nothing fancy:
  • Player connects
  • player_activate.cfg calls "system wget" to visit a website and store the output from the website to STEAMID.cfg
  • The website was written in ASP/VBScript (you could use PHP, C++ CGI, Perl, whatever) to read from an Access DB.
  • The website takes a steamid as part of the URL and looks it up in the database.
  • If it's found, it outputs the plain text of "es_keysetvalue connectstrings Players STEAMID text". This is saved as the STEAMID.cfg by wget on the CS:S server.
  • player_activate.cfg uses es_delayed to exec STEAMID.cfg
  • player_activate.cfg uses es_delayed to announce the connectstring if it was set by the above cfg file.
  • I wrote a separate VBScript page that will save connect strings to the afforementioned database.

On the CS:S side, all I'm really doing is calling "wget" from the command-line to visit a website and exec the resulting text. The website does most of the database work. I was going to use MySQL but I have an older project that used Access that only took me 15 minutes to port into this instead.

Here's the player_activate.cfg:
Code:
// player_activate.cfg
es_xsetinfo url 0
es_format url "http://mattie.info/connect/XXXXXXXXX.asp?steamid=%1" event_var(es_steamid)


es_xsetinfo cfgrun 0
es_setinfo cfgout event_var(es_steamid)
// fix the steamid so it can be a filename
es_string cfgout replace ":" "-"
// for exec'ing later
es_format cfgrun "users/%1.cfg" server_var(cfgout)
// for writing to disk by wget
es_format cfgout "cstrike/cfg/users/%1.cfg" server_var(cfgout)

// call wget and tell it to save the website response to cfgout
es system cstrike/wget -O server_var(cfgout) server_var(url)
// now we want to run the file after a few seconds (which aligns nicely to when they can see the announcement)
es_delayed 3 exec server_var(cfgrun)
es_delayed 5 es_setinfo outputtext 0
// web server calls es_keysetvalue so lets read it out
es_delayed 5.1 es_xkeygetvalue outputtext connectstrings Players event_var(es_steamid)
es_delayed 5.2 es_xmsg #green event_var(es_username) has connected.
es_xdelayed 5.2 if (server_var(outputtext) notequalto 0) then es_xmsg #green ==]
es_xdelayed 5.2 if (server_var(outputtext) notequalto 0) then es_xmsg #green ==] server_var(outputtext)
es_xdelayed 5.2 if (server_var(outputtext) notequalto 0) then es_xmsg #green ==]


I look forward to seeing the es_tools plugin!
-Mattie



Oh... I thought you were directly interfacing with the database.. oh well ;)
Im compiling the linux version of my es_tools plugin right now, no idea where to put it... but I guess I'll go for script packs...

_________________
~ The_WuH
_________________
All code I give out is licensed - http://creativecommons.org/licenses/by-nc-sa/3.0/us/
Image
Weeks of programming can save you hours of planning.


User avatar
Power User
Profile

Posts: 530
Location:
Karkand with a M4
 
New postPosted: 2006-02-05, 3:06 am 

Simply Amazing Mattie! Calling programs and files outside of SRCDS and ES!

I tip my hat to you sir! :P

_________________
Hey I will get back on the forums once my schooling is caught up (2/29/08)


User avatar
EventScripts Administrator
EventScripts Administrator
Profile

Posts: 2982
Location:
Tampa, FL
 
New postPosted: 2006-02-05, 3:07 am 

TheUnknownFactor wrote:
I really can't imagine using it for anything myself :\


Well, just as an example of what you could use this for:

-You could write a VBScript to read Mani's adminlist.txt to determine if a person is an admin. That alone, is awesome.

_________________
"If life had an SDK, only the smart people would survive."
"I got tired of my wife being my page file, so I ordered more memory from Newegg."
Image
Image
Image


User avatar
Helper
Profile

Posts: 209
Location:
GERMANY
 
New postPosted: 2006-02-05, 7:01 am 

Hi Mattie,

i hope that nobody here makes som F*CKING trash with this plugin.
I mean sets up a ( temporary ) server with delete files on clients or something else.

So some commands should be stopped in the plugin itself...

_________________
Image


User avatar
Site Administrator
Site Administrator
Profile

Posts: 7631
Location:
At Work
 
New postPosted: 2006-02-05, 10:30 am 

TheUnknownFactor wrote:
I really can't imagine using it for anything myself :\


Why not? What do you mean? You wouldn't want to talk to a MySQL console? Or let people email you from in-game with something like sendmail?

-Mattie


User avatar
Site Administrator
Site Administrator
Profile

Posts: 7631
Location:
At Work
 
New postPosted: 2006-02-05, 10:39 am 

Rebell wrote:
Hi Mattie,

i hope that nobody here makes som F*CKING trash with this plugin.
I mean sets up a ( temporary ) server with delete files on clients or something else.

So some commands should be stopped in the plugin itself...


Rebell - this plugin does not affect the client! The system command is server-side only. There is no danger to a client connecting to a server that has this plugin because the system command only works on the server itself.

That being said, I added the following warning to my initial post for people who erroneously thought that they could install it on their personal, graphical Counter-Strike on Windows:
  • NEVER install this plugin for any Counter-Strike that's not a dedicated server. This plugin is a very bad thing to install on your local Counter-Strike that you use to play on people's servers. Use dedicated servers only.


-Mattie


User avatar
Site Administrator
Site Administrator
Profile

Posts: 7631
Location:
At Work
 
New postPosted: 2006-02-05, 11:01 am 

awuh0 wrote:
Oh... I thought you were directly interfacing with the database.. oh well ;)
Im compiling the linux version of my es_tools plugin right now, no idea where to put it... but I guess I'll go for script packs...


That's the whole point of this system plugin-- you don't need a special plugin to directly interface with anything if an exe exists. I chose to go through a website since the database wasn't local.

If I wanted to submit directly to mysql, you can use the mysql console. For example:
Code:
// some stuff
// ...
es_setinfo myquery 0
es_format myquery "UPDATE players SET numkills=%1 WHERE steamid=%2" server_var(somevalue) event_var(es_steamid)

// Now send the query to MySQL. Assumes 'mysql' is in the path.
es system mysql --user=Mattie --password=MyPassword tablename -e server_var(myquery)


-Mattie


User avatar
Newbie
Profile

Posts: 48
Location:
Brooklyn, NY
 
New postPosted: 2006-02-05, 11:01 am 

sweet plugin, I suppose properly setup servers with correct permissions for users running them and file system properly chmoded this plugin can really get some sweet work done :) thanx mattie.

_________________
Image Image Image


Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 41 posts ]  Go to page 1, 2, 3  Next


Who is online

Users browsing this forum: No registered users and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group