NEED HELP FAST. NEW HUB ATTACK!!!

Dende · Post by **Dende** » 2003-04-07 13:25

Ok I have this thread here started about the problem http://dcplusplus.sourceforge.net/forum ... php?t=1896 and here is what I need.
I need a script that prevents $connect to me flooding. I have a users somewhere in my hub flooding the dc++ users with this connect to me flood program that we think was created by progger. I have a script that prevents the $getnfo flood but not one for that kind of flood. Someone please help. The info in the hub software that I have got has to be fake because the ip that is being reported is never in the hub. I have a pic of the flood but I don't know how to post it lol. if you need it I can send it to you.

I recomend every hub owner out there to investigate this as all dc++ users can be attacked by this flood. It doesn't crash the hub or anything like that it crashes the dc++ client itself. All downloads end up corupt as a result.

ender · Post by **ender** » 2003-04-07 13:55

Ok, here goes (not tested, use at your own risk):

Code: Select all

sub DataArival(curUser,curData)
  dim cmd,ip
  if instr(curData," ")>0 then
    cmd = left(curData,instr(curData," ")-1)
    if cmd="$ConnectToMe" then
      ip = mid(curData,instr(curData," ")+1)
      if left(ip,3)<>"Hub:" then
        ip = left(ip,instr(ip,":")-1)

        if ip<>curUser.sIP then
          colUser.SendChatToAll "Hub-Security", "Kicking out " + curUser.sName + " for sending fake ConnectToMe. IP: " + curUser.sIP + "; faked IP: " + ip
          curUser.kick
        end if
      end if
    end if
  end if
end sub

Dende · Post by **Dende** » 2003-04-07 15:07

Hey thinks I'll try it and I hope it works. I need to get this fixed as half my users are dc++ users. We love dc++

so we want them to be free to use it.