Resource icon

Hotfix for TeamSpeak vulnerabilities [till 3.0.13] 1.0.0

No permission to download

Ramses

Active Member
Sep 11, 2016
33
2
80
ut it doesnt fix the exploit.. We only have to change one line of code to circumvent your "fix". Which is already done in the dev versions of the exploit. You can upload fix file?
i no use iptables need rules
I need iptables help. I no have binary.
 

Ramses

Active Member
Sep 11, 2016
33
2
80
Code:
-A INPUT -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j LOG --log-prefix "TS3 sploit: " --log-level 4
-A INPUT -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j DROP
or
Code:
-I INPUT 5 -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j LOG --log-prefix "TS3 sploit: " --log-level 4
-I INPUT 6 -p udp -m udp -m multiport --ports 9987:9997 -m length --length 300:400 -m string --hex-string "|545333494e495431|" --algo kmp -m comment --comment "TS3 sploit" -j DROP
where 5,6 - number line rule.
Please upload done file. I no can modify hex editor
 

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,029
896
216
Why don't you update ? Everything in this thread is seriously outdated.
 

Ramses

Active Member
Sep 11, 2016
33
2
80
i no use iptables need rules
# Flush rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F PREROUTING
iptables -t raw -F OUTPUT
# List policies first
iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT;
# Disable connection tracking on voice server ports
iptables -A PREROUTING -t raw -p udp --dport 9987 -j NOTRACK
iptables -A OUTPUT -t raw -p udp --sport 9987 -j NOTRACK
# Allow TCP inbound
iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 21,22 -j ACCEPT
# Drop invalid UDP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 0:32 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 2521:65535 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 98 -j DROP
# Drop TS3 booter methods
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|fa163eb402096ac8|' --algo kmp -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|71f63813d5422309|' --algo kmp -j DROP
# Allow incoming packets related to outgoing ones.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow UDP inbound
iptables -A INPUT -p udp --dport 9987 -j ACCEPT
# Allow ICMP
iptables -A INPUT -p icmp -j ACCEPT
# Log all dropped packets to /var/log/messages
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

and client drop logs
 

Ramses

Active Member
Sep 11, 2016
33
2
80
I don't recommend this ; Client can crash when sending certain text messages (timeout after 10 seconds, only voice is transmitted before reconnection).
-A INPUT -p udp -m udp -j DROP --match length --length 300:350 should I use it? and you will not drop?
 

Ramses

Active Member
Sep 11, 2016
33
2
80
Which fix are you using? iptables or binary?
# Flush rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F PREROUTING
iptables -t raw -F OUTPUT
# List policies first
iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT;
# Disable connection tracking on voice server ports
iptables -A PREROUTING -t raw -p udp --dport 9987 -j NOTRACK
iptables -A OUTPUT -t raw -p udp --sport 9987 -j NOTRACK
# Allow TCP inbound
iptables -A INPUT -p tcp -m state --state NEW -m multiport --dports 21,22 -j ACCEPT
# Drop invalid UDP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 0:32 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 2521:65535 -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m length --length 98 -j DROP
# Drop TS3 booter methods
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|fa163eb402096ac8|' --algo kmp -j DROP
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|71f63813d5422309|' --algo kmp -j DROP
# Allow incoming packets related to outgoing ones.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow UDP inbound
iptables -A INPUT -p udp --dport 9987 -j ACCEPT
# Allow ICMP
iptables -A INPUT -p icmp -j ACCEPT
# Log all dropped packets to /var/log/messages
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

my iptables and have drops
 

LetsBlade

Member
Jan 7, 2017
102
14
53
"November 2k16" Was there even the Stable Version out for 3.1.1? xD And the Video was still made at February
 

jasmin

Restricted
Jan 26, 2017
4
0
13
"November 2k16" Was there even the Stable Version out for 3.1.1? xD And the Video was still made at February
Wayne fore the Date, In the Changelog of Teamspeak Client is nothing about a "WINDOWS" crash fix!
He found the Exploit but dosen't report Teamspeak to fix that ;) R4P3 wan't only Money, they Release Tools for VIP you most pay and they make that so hard to find a Crash look at Splamy he has written a solo Ts3 Protocol and in this Video he has also give this Client badges that not released!
very bad r4p3 ;*
 

Alligatoras

Administrator
Mar 31, 2016
2,570
12
2,855
381
You are f**king retards!
R4P3 is not your favorite page about teamspeak cracks ands bug reports!
R4P3 is a security research team - something that you kids don't want to understand!
We are not your toys and of course we won't keep our heads above teamspeak to find and get anything that your little brain desires!
 

jasmin

Restricted
Jan 26, 2017
4
0
13
You are f**king retards!
R4P3 is not your favorite page about teamspeak cracks ands bug reports!
R4P3 is a security research team - something that you kids don't want to understand!
We are not your toys and of course we won't keep our heads above teamspeak to find and get anything that your little brain desires!
Don't cry, it's okay that you'r a little skid they search on "Hackforums" for many scripts and post that on r4p3
You are saying to that r4p3 is a security research team - why r4p3 release Tools for VIP and say Teamspeak how to fix that? yes just want money...
And your "R4P3 Team" consists of nothing, it's only your community that does something and you only release it
And you Alligatoras, you just release all Scripts from other users to this website you have do nothing here and then you say you are a security researcher? haha
Now to the R4P3 bot that obfuscated with Confuser give me 2 days and i will deobfuscate it and leak all of this bot :*
 

Alligatoras

Administrator
Mar 31, 2016
2,570
12
2,855
381
It's easy - if you don't like it here just don't login again!
Nobody forced you to register here or spend money!
 

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,029
896
216
Don't cry, it's okay that you'r a little skid they search on "Hackforums" for many scripts and post that on r4p3
You are saying to that r4p3 is a security research team - why r4p3 release Tools for VIP and say Teamspeak how to fix that? yes just want money...
And your "R4P3 Team" consists of nothing, it's only your community that does something and you only release it
And you Alligatoras, you just release all Scripts from other users to this website you have do nothing here and then you say you are a security researcher? haha
Now to the R4P3 bot that obfuscated with Confuser give me 2 days and i will deobfuscate it and leak all of this bot :*
I would personally do much better without the majority of the community which consists of kids wanting to make money from insecure php shit and not knowing proper english :)

( should we split this in a rant thread ? )
 

jasmin

Restricted
Jan 26, 2017
4
0
13
It's easy - if you don't like it here just don't login again!
Nobody forced you to register here or spend money!
Suck at Apshyxias Eggs are you happy because you are Super Mod on a cheap forum? haha
I would personally do much better without the majority of the community which consists of kids wanting to make money from insecure php shit and not knowing proper english :)

( should we split this in a rant thread ? )
Oha boy the whole php script here is already much longer published on other site exactly as the RFI which was not times of R4P3 but wayne simply indicate haha
 

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,029
896
216
Suck at Apshyxias Eggs are you happy because you are Super Mod on a cheap forum? haha

Oha boy the whole php script here is already much longer published on other site exactly as the RFI which was not times of R4P3 but wayne simply indicate haha
Do you english ? I did not understand anything you wrote.
 
Top