Help!

naive101 · **Joined:** 24 Jan 2010 03:50 **Posts:** 15

Greetings friends,

A couple days ago I ran into this guy whos spams ventrilos for fun, knowing that he was going to target my vent server next I changed the password to something only I would know. A couple of hours later my server, I disconnected my server and attempted to reconnect. It said I couldn't reconnect because the server was "full" but there was nobody inside that ventrilo server but me because I forced my way in. When I spoke to the ventrilo people they said that "hundreds of users are attempting to connect to my server every second." so my question is, how does one do that? How can I possibly do that? Would I be able to do it if I open hundreds of ventrilofp windows and set them to connect but not type a password in so they don't actually connect to the server just try to.

Any theories or opinions would be very much appreciated, thanks in advanced guys.

Sethioz · **Posted:** 24 Jan 2010 14:34

lol dude, Luigi have written a tool for that, a fake user/player tool that sends users. its called ventrilofp, but what is your problem ? are you trying to solve it, or trying to replicate this ? to me it seems you are more interested of doing it, than preventing it. anyways ventrilofp is located on Luigi's under fake players bug.

naive101 · **Joined:** 24 Jan 2010 03:50 **Posts:** 15

I know about ventrilofp and what it does, the thing is when I try to do it, it doesn't work. Yes I am trying to replicate this..

When this issue happened nobody could connect to the server even thought it was clearly empty from the inside it was just being overwhelmed by users attempting to connect from the outside despite the fact that they where getting the password wrong.

I've also noticed under patches there is a ventrilo pointer patch (botomy) Does that nean that if I apply that patch to my ventrilo it will be able to take others down? Thanks in advanced for the help, just curious and I apologize for my bad english.

aluigi · **Posted:** 24 Jan 2010 16:49

it was for sure a fake players attack.
at the moment I don't remember if it's possible to limit this vulnerability because Duplicates=0 doesn't seem to do much.
sincerely I don't remember

naive101 · **Joined:** 24 Jan 2010 03:50 **Posts:** 15

Yeah, i was just wondering how he did it? Did he have hundreds of ventrilofp.exe windows opened and executed them all at once? That's the best i can think of so far.

aluigi · **Posted:** 24 Jan 2010 18:38

yes, it's possible.
after all ventrilofp is only a proof-of-concept so it's job is only prooving the existence of the bug without being "extreme" like using multiple threads for all the connections.
that's why ventrilofp and any other of my PoC don't use threads

naive101 · **Joined:** 24 Jan 2010 03:50 **Posts:** 15

Ahh, I see. Thank's for the help.

Sethioz · **Posted:** 24 Jan 2010 23:38

Luigi, doesn't your universal player/user limiter work ?
it should limit the join packet just fine.
anyways, he was using the fake player/user flooder, those are called "invisible" users, because they only take a slot, but they don't actually appear. this happens in many other servers too (game or chat or whatever).

aluigi · **Posted:** 24 Jan 2010 23:43

no, doesn't work because that limiter is based on udp packets while ventrilo uses tcp connections.
but yes, basicly could be made the same job also for tcp connections monitoring myaccept instead of myrecvfrom

Sethioz · **Posted:** 24 Jan 2010 23:44

devil damn it, i keep forgetting that your playerlimiter is only for UDP, i should write it down in my memo file

naive101 · **Joined:** 24 Jan 2010 03:50 **Posts:** 15

UPDATE: The tool "Tcpfp" does do what I described in my previouse post, but it does it from only one IP address which is pretty easy to avoid the guy that was doing this was doing it from an insane amount of IP Adresses, I wish I knew how to spoof my IP like he did.... Sigh.

Thanks for the help anyways guys, it is very much appreciated.

Sethioz · **Posted:** 25 Jan 2010 18:03

you can not spoof your IP, you can only use proxy servers.
to find a TCP proxy, you need to google. then you can use sockscap or something like this or proxyfirewall to rotate between proxys.

Luigi Auriemma

Help!