Caught with Invoke commands

[Bulld0g]

LOG 272

[06.14.2006 19:22:09] [From #5 6cdd(VALID:8) ^7^6fitt serb] "fps125" "fps43" "fps" [3 user cvars found]

[06.14.2006 19:22:09] [From #5 6cdd(VALID:8) ^7^6fitt serb] fps125 = "invoke wall 0;invoke stealth 0;echo ^2OFF; set fps vstr fps43"

[06.14.2006 19:22:09] [From #5 6cdd(VALID:8) ^7^6fitt serb] fps43 = "invoke wall 1;echo ^2ON; set fps vstr fps125"

[06.14.2006 19:22:09] [From #5 6cdd(VALID:8) ^7^6fitt serb] fps = "vstr fps43"

 

LOG 271

[06.14.2006 19:10:48] New Connection (slot #5) 85.226.92.228:27960 [?] "^7^6fitt serb" (seq 13468167)

[06.14.2006 19:10:48] Player GUID Computed 7b517550caf94c28c42e1b422e756cdd(-) (slot #5) 85.226.92.228:27960 ^7^6fitt serb

[06.14.2006 19:14:05] Auto Screenshot 003190 Requested from 5 ^7^6fitt serb

[06.14.2006 19:17:49] Screenshot /home/cs5eg3/et/pb/svss/pb003190.png TIMED OUT after 223 seconds (slot=5)

 

apparently he has blatantly haccking so a guy asked me to check logs !

Edited June 14, 2006 by Bulld0g

[*fu* Krull]

Going on this interesting thought I looked for the invoke string in our logs. This player seemed to be clean but very good, now im wondering what this bind is. Any ideas?

 

[06.15.2006 22:23:35] [From #24 ed5e(?) *******] "vstr" "next_shoot" "shoot3" "shoot2" "shoot1" "shoot0" "xshoot8" "xshoot7" "xshoot6" "xshoot5" "xshoot4" "xshoot3" "xshoot2" "xshoot1" "cg_damagekick" "cg_fallkick" "cg_drawfallkick" "cg_drawdamagekick" "shootoff" "shooton" [20 user cvars found]
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] vstr = "shooton"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] next_shoot = "vstr shoot1"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] xshoot5 = "+attack; cg_crosshaircoloralt white; cg_crosshairsize 25; cg_crosshaircolor white; cg_drawCrosshair 5"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] xshoot2 = "-attack; cg_crosshaircoloralt green; cg_crosshairsize 36; cg_crosshaircolor green; cg_drawCrosshair 5"
[06.15.2006 22:23:35] [From #24 ed5e(?) ******* xshoot1 = "+attack; cg_crosshaircoloralt green; cg_crosshairsize 25; cg_crosshaircolor green; cg_drawCrosshair 5"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_damagekick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_fallkick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_drawfallkick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_drawdamagekick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] shootoff = "-attack;cg_fov 120;invoke aim 0;set vstr shooton"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] shooton = "+attack;cg_fov 105;invoke aim 1;set vstr shootoff"

[(TSS)Hidinfury]

Going on this interesting thought I looked for the invoke string in our logs. This player seemed to be clean but very good, now im wondering what this bind is. Any ideas?

 

[06.15.2006 22:23:35] [From #24 ed5e(?) *******] "vstr" "next_shoot" "shoot3" "shoot2" "shoot1" "shoot0" "xshoot8" "xshoot7" "xshoot6" "xshoot5" "xshoot4" "xshoot3" "xshoot2" "xshoot1" "cg_damagekick" "cg_fallkick" "cg_drawfallkick" "cg_drawdamagekick" "shootoff" "shooton" [20 user cvars found]
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] vstr = "shooton"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] next_shoot = "vstr shoot1"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] xshoot5 = "+attack; cg_crosshaircoloralt white; cg_crosshairsize 25; cg_crosshaircolor white; cg_drawCrosshair 5"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] xshoot2 = "-attack; cg_crosshaircoloralt green; cg_crosshairsize 36; cg_crosshaircolor green; cg_drawCrosshair 5"
[06.15.2006 22:23:35] [From #24 ed5e(?) ******* xshoot1 = "+attack; cg_crosshaircoloralt green; cg_crosshairsize 25; cg_crosshaircolor green; cg_drawCrosshair 5"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_damagekick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_fallkick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_drawfallkick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] cg_drawdamagekick = "0"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] shootoff = "-attack;cg_fov 120;invoke aim 0;set vstr shooton"
[06.15.2006 22:23:35] [From #24 ed5e(?) *******] shooton = "+attack;cg_fov 105;invoke aim 1;set vstr shootoff"

 

You just caught a hacker and didnt know it :)

 

Is this server streaming to PBBANS ?

[06.15.2006 22:23:35] [From #24 ed5e(?) *******] shootoff = "-attack;cg_fov 120;invoke aim 0;set vstr shooton"

[06.15.2006 22:23:35] [From #24 ed5e(?) *******] shooton = "+attack;cg_fov 105;invoke aim 1;set vstr shootoff"

 

 

/invoke aim 0 // this turns off aimbot

/invoke wall 0 // this turns off wallhack

[*fu* Krull]

THanks for the reply, now i know something else to be lookign for :0

 

 

As for streaming, we were at one time but i noticed it has beeen turned off. Probably when I was away and the server was moved to a new IP they disabled it. I'll look at getting that set back up.

[AcE]

I'll look at getting that set back up.

Rapidly

[Bulld0g]

Rapidly

awesome that we have both found this now we need a check implemented!!! syntax anyone?

Edited June 16, 2006 by Bulld0g

[foxdie]

I dont think we ever make such check. Maybe I will add capability to scan binds&cvars to our new tool .