Metin2 Shutdown!

[Cyxer 167]

Analyze: Accept shutdown p2p command from <IP>

CAN YOU HELP ME;

[Ira™ 41]

Maybe you use a game with a special command than can used by  a player.

[Alina 275]

Edit: Yeah, it's the API tool.

Make sure your firewall blocks every connection incoming to your p2p ports except for localhost!

If you need help, then please send me your firewall rules via pm and I can help you with that.

 

Example for pf:

block in on $if FROM any to 127.0.0.1 port $P2P_PORT

I guess that should do it. It's better to block everything by default and let certain defined ports pass through so you won't get in trouble with that anymore. But be careful with that since you'd block ssh access when working with firewalls!

Edited July 1, 2015 by Alina

[Ken 1034]

Add those things in your config file.

adminpage_ip: your ip-address
adminpage_password: your password

If target is not know your adminpage password, he can not login your system. Default password is SHOWMETHEMONEY.

 

Kind Regards

Ken

[djkotsos 108]

Add those things in your config file.

adminpage_ip: your ip-address
adminpage_password: your password

If target is not know your adminpage password, he can not login your system. Default password is SHOWMETHEMONEY.

 

Kind Regards

Ken

​password root server?

 

adminpage_ip: myip
adminpage_password: SHOWMETHEMONEY

THIS?

[Cyxer 167]

Add those things in your config file.

adminpage_ip: your ip-address
adminpage_password: your password

If target is not know your adminpage password, he can not login your system. Default password is SHOWMETHEMONEY.

 

Kind Regards

Ken

​I Have this:

adminpage_password: 364357485686869
ADMINPAGE_IP: MYIP

 

 

Maybe you use a game with a special command than can used by  a player.

​no!:/ only gm.

 

Edit: Yeah, it's the API tool.

Make sure your firewall blocks every connection incoming to your p2p ports except for localhost!

If you need help, then please send me your firewall rules via pm and I can help you with that.

 

Example for pf:

block in on $if FROM any to 127.0.0.1 port $P2P_PORT

I guess that should do it. It's better to block everything by default and let certain defined ports pass through so you won't get in trouble with that anymore. But be careful with that since you'd block ssh access when working with firewalls!

​

I have not done Firewall installation: /
It can be had by itself.

[.InyaProduction 1722]

adminpage_ip: your ip-address
adminpage_password: your password

Put this to the config of all your game core (not db, not auth)

(your ip = the ip of your website, password = you choose what you want)

Edited July 1, 2015 by .InyaProduction

[Alina 275]

Guys it's a p2p command. He didn't set up a firewall and that's the point behind that.

Set up a firewall and block those p2p ports (and db cache port) and you'll be safe from this attack

 

adminpage_ip: 127.0.0.1

This should also work for you.

Note:

The attack can be from p2p ports and from normal ports. Against normal ports, you can use adminpage_ip to bind your API to localhost, so it'll only accept connections from localhost!

Against p2p ports it's more difficult. You need to shut down access to them via firewall. That's gonna fix your problem and the attack you're getting there is through the p2p ports. So you may look at that

Edited July 1, 2015 by Alina

[.InyaProduction 1722]

Guys it's a p2p command. He didn't set up a firewall and that's the point behind that.

Set up a firewall and block those p2p ports (and db cache port) and you'll be safe from this attack

 

adminpage_ip: 127.0.0.1

This should also work for you.

Note:

The attack can be from p2p ports and from normal ports. Against normal ports, you can use adminpage_ip to bind your API to localhost, so it'll only accept connections from localhost!

Against p2p ports it's more difficult. You need to shut down access to them via firewall. That's gonna fix your problem and the attack you're getting there is through the p2p ports. So you may look at that

​admin page ip and password are can block everything that can affect the server except the player count api and some log related stuff. But i think youre right with the db cache port. If this ones open one of the worst "hacks" (not further discribed here cause of possible chaos) is possible

[ZiuZitsu 5]

In the files that you are using there is a backdoor just know it , its 2hard to find where it is..if you need private help from me just send me a pm to help u to block this command....i think api tool is already fixed on maxmi's files and closed.  

[NoFr1ends 915]

Just disable the p2p ports and win (or limit it on local ips) 

I don't believe that someone in year 2015 does not know how to fix this old issue

If you disabled it and it's still happen choose another source / game 

[Cyxer 167]

Thank you for your help.
I put this firewall but now does not open the mysql!: /
The removal and does not open again . !

can you help me;

Edited August 24, 2022 by Metin2 Dev
Core X - External 2 Internal

[ZiuZitsu 5]

Cyxer if you have got RevenceMetin2 I know the way that someone hacked your server ....It's a command , if you are using maxmi's files then it's means that the problem is a command that notices all the server.

[Unknown 12]

You can block the p2p ports with a firewall or disable the p2p commands into the game.

For example this is my pf rule, just replace the ports by those you are using, and dont forget to replace "em0".

 

ports = "{12000, 14000, 14001, 14002, 14003, 14004, 14006, 14010, 14011, 14012, 14013, 14014, 14015, 14020, 14021, 14022, 14023, 14024, 14025, 14099, 15000}"
block out log quick on em0 inet proto tcp from any port $ports

Note : the last line of the pf.conf must be empty

You can show logs of attempts by using this command :

tcpdump -n -e -ttt -r /var/log/pflog

 

Edited August 19, 2022 by Metin2 Dev
Core X - External 2 Internal

[Cyxer 167]

solved!

thanks for help!