Sweetgum/sweetgum-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Consistently use Hwid domain object, fix login bypass

Browse Source 
Login bypass (skip pin/pic) was broken due to an
inconsistency in hwid format.
This commit is contained in:
P0nk
2021-07-15 23:51:01 +02:00
parent 12a415e3d5
commit 6e6fbf3be7
14 changed files with 183 additions and 227 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/main/java/net/server/handlers/login/ViewAllCharRegisterPicHandler.java
View File

@@ -7,6 +7,8 @@ import net.server.coordinator.session.Hwid;
import net.server.coordinator.session.MapleSessionCoordinator;
import net.server.coordinator.session.MapleSessionCoordinator.AntiMulticlientResult;
import net.server.world.World;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import tools.MaplePacketCreator;
import tools.Randomizer;
import tools.data.input.SeekableLittleEndianAccessor;
@@ -15,24 +17,16 @@ import java.net.InetAddress;
import java.net.UnknownHostException;
public final class ViewAllCharRegisterPicHandler extends AbstractMaplePacketHandler {
private static final Logger log = LoggerFactory.getLogger(ViewAllCharRegisterPicHandler.class);
private static int parseAntiMulticlientError(AntiMulticlientResult res) {
switch (res) {
case REMOTE_PROCESSING:
return 10;
case REMOTE_LOGGEDIN:
return 7;
case REMOTE_NO_MATCH:
return 17;
case COORDINATOR_ERROR:
return 8;
default:
return 9;
}
return switch (res) {
case REMOTE_PROCESSING -> 10;
case REMOTE_LOGGEDIN -> 7;
case REMOTE_NO_MATCH -> 17;
case COORDINATOR_ERROR -> 8;
default -> 9;
};
}
@Override
@@ -42,9 +36,13 @@ public final class ViewAllCharRegisterPicHandler extends AbstractMaplePacketHand
slea.readInt(); // please don't let the client choose which world they should login
String mac = slea.readMapleAsciiString();
String hwid = slea.readMapleAsciiString();
if (!Hwid.isValidRawHwid(hwid)) {
String hostString = slea.readMapleAsciiString();
final Hwid hwid;
try {
hwid = Hwid.fromHostString(hostString);
} catch (IllegalArgumentException e) {
log.warn("Invalid host string: {}", hostString, e);
c.announce(MaplePacketCreator.getAfterLoginError(17));
return;
}