someone is creating money on my server

[robertorb12]

as the title says, someone is creating money on my server, I think the problem comes from the bank or I'm not really sure where the bug could be but the player has a lot of money "200kks" created in his bank. does anyone know what it could be? use tfs 1.3 based on otx
rl map


help please, it is very annoying that since the subject starts to annoy giving some kks to the players

 

[Svira]

Rl map?
Buing wands in Malak selling in Cameron
Check it.
Or u using Sample in DB, then just make a transfer to the sample and make a new character

 

[robertorb12]

Rl map?
Buing wands in Malak selling in Cameron
Check it.
Or u using Sample in DB, then just make a transfer to the sample and make a new character

I didn't understand, what did you mean?, i tested sample and

check the sample and that was not the problem

 

[Svira]

We'll start little by little ... Do you use GlobalMap server?

 

[robertorb12]

Rl map?
Buing wands in Malak selling in Cameron
Check it.
Or u using Sample in DB, then just make a transfer to the sample and make a new character

otservbr

 

[Svira]

otservbr is a server from RL map. Check if there are 2 NPCs on the map: Malak and Cameron.
If so, check the prices of their goods. It is very common for a kid to buy something cheap and Cameron to sell dearly, as a result the balance in the bank can be 1kk in 10 minutes.

The second reason is quite known when you use Sample for acc. Sample Knight, Sample, Sorcerer etc. Then the player makes a transfer from his character to Sample and then creates another character modeled on a sample that has already received money in this way the entire server can flow in gold.

 

[robertorb12]

otservbr is a server from RL map. Check if there are 2 NPCs on the map: Malak and Cameron.
If so, check the prices of their goods. It is very common for a kid to buy something cheap and Cameron to sell dearly, as a result the balance in the bank can be 1kk in 10 minutes.

The second reason is quite known when you use Sample for acc. Sample Knight, Sample, Sorcerer etc. Then the player makes a transfer from his character to Sample and then creates another character modeled on a sample that has already received money in this way the entire server can flow in gold.

they are not on the map

only cameron, but he sells nothing

the second reason test:
02:44 ADM[108]: transfer
02:44 Naji: Please tell me the amount of gold you would like to transfer.
02:44 ADM[108]: 1000000
02:44 Naji: Who would you like transfer 1000000 gold to?
02:44 ADM[108]: Druid Sample
02:44 Naji: This player does not exist.

Post automatically merged: Feb 25, 2020

 

[Aczkolwiek]

Sample Knight, Sample, Sorcerer etc.

Druid Sample

 

[Demnish]

RIP

 

[Eduardo170]

they are not on the map

only cameron, but he sells nothing

the second reason test:
02:44 ADM[108]: transfer
02:44 Naji: Please tell me the amount of gold you would like to transfer.
02:44 ADM[108]: 1000000
02:44 Naji: Who would you like transfer 1000000 gold to?
02:44 ADM[108]: Druid Sample
02:44 Naji: This player does not exist.

Post automatically merged: Feb 25, 2020

Do you have gesior 2012?

 

[robertorb12]

Do you have gesior 2012?

how can i know that ?

 

[Eduardo170]

how can i know that ?

Do you use Sqlite o Mysql?.

 

[robertorb12]

Do you use Sqlite o Mysql?.

Mysql

 

[Demnish]

You do know that after you've found the problem you have to reset, right?

 

[robertorb12]

You do know that after you've found the problem you have to reset, right?

yep

 

[Red]

There are a few issues being described here:

Svira is describing an issue where one NPC allows players to buy an item for 100 gold and another NPC players can sell that item for 500 gold (net profit: 400 gold). I assume Malak and Cameron are common NPCs in this distribution, not sure really.

Svira continued to describe another common issue with servers using sample characters to create new ones; this is a rather old method and can be quite problematic. Does your server have characters named "Sorcerer Sample", "Druid Sample", "Paladin Sample", and "Knight Sample"? These sample characters were, if I recall correctly, created by Gesior AAC as a way to "copy" a "fresh" character sample when creating new ones.

Eduardo170 is suggesting that it might be a website exploit through SQL-i. This is/was common with Gesior-based AACs, some users even released pages with known backdoors in the past.

@robertorb12 It might be easier for you if you shared your server's website URL and perhaps a copy of your bank NPC script (or a link to your server's base distribution provided you have not made any changes to the code).

Red

 

[robertorb12]

There are a few issues being described here:

Svira is describing an issue where one NPC allows players to buy an item for 100 gold and another NPC players can sell that item for 500 gold (net profit: 400 gold). I assume Malak and Cameron are common NPCs in this distribution, not sure really.

Svira continued to describe another common issue with servers using sample characters to create new ones; this is a rather old method and can be quite problematic. Does your server have characters named "Sorcerer Sample", "Druid Sample", "Paladin Sample", and "Knight Sample"? These sample characters were, if I recall correctly, created by Gesior AAC as a way to "copy" a "fresh" character sample when creating new ones.

Eduardo170 is suggesting that it might be a website exploit through SQL-i. This is/was common with Gesior-based AACs, some users even released pages with known backdoors in the past.

@robertorb12 It might be easier for you if you shared your server's website URL and perhaps a copy of your bank NPC script (or a link to your server's base distribution provided you have not made any changes to the code).

Red

the bug is that even if you have 1 gp you can deposit up to 20,000,000 gps to the bank
here my NPC naji (bank thais) script:

the bug is with the rest of the banks

 

[Red]

the bug is that even if you have 1 gp you can deposit up to 20,000,000 gps to the bank
here my NPC naji (bank thais) script:

the bug is with the rest of the banks

In the file you've posted, your code calls the function:

getMoneyCount(msg)

Without knowing how this function works we don't have enough information to determine exactly where the exploit is. If I were to guess, it's that it does not check how much gold the player actually has before updating their bank balance. You can also see in your code between lines 159-164 that the only part of the code that actually does so by evaluating a message against "player:getMoney()" is commented out.

Red

 

[Nemphis]

This is really a good idea for servers. Why must the only way to get gold is loot or selling runes and looted items?

There could be low and high interest in cities in special goods. But if you buy one of these goods, you cannot take portals, boat, flying carpets and you can only carry 1 at the time. and net profit a couple gps

 

[theduck]

as the title says, someone is creating money on my server, I think the problem comes from the bank or I'm not really sure where the bug could be but the player has a lot of money "200kks" created in his bank. does anyone know what it could be? use tfs 1.3 based on otx
rl map


help please, it is very annoying that since the subject starts to annoy giving some kks to the players

Fix Deposit (#852) · opentibiabr/otservbr-global@735afb7

- Fixed an issue when you trying to deposit an amount higher then you have in hands.

github.com