Name Exploit

iJoris

Member
May 20, 2015
24
15
35
Name exploit

Turn any name that contains one of the following letters: a c e o in the same looking name.

Example:
dRj5qqP.png

VKagwee.png

Works with the latest teamspeak version and some online forums.

Download:
http://ge.tt/3lshWFH2/v/0
Password: r4p3

Virustotal: https://www.virustotal.com/nl/file/...5896397add33506c46fc2c39/analysis/1432815170/


Source code:
Code:
Dim name = TextBox1.Text
        If InStr(name, "a") > 0 Then
            Dim exploited_name As String = Replace(name, "a", "а")
            TextBox2.Text = exploited_name
        ElseIf InStr(name, "c") Then
            Dim exploited_name As String = Replace(name, "c", "с")
            TextBox2.Text = exploited_name
        ElseIf InStr(name, "e") Then
            Dim exploited_name As String = Replace(name, "e", "е")
            TextBox2.Text = exploited_name
        ElseIf InStr(name, "o") Then
            Dim exploited_name As String = Replace(name, "o", "о")
            TextBox2.Text = exploited_name
        Else
            MessageBox.Show("Name can't be exploited")
        End If
 
Last edited:

Asphyxia

Owner
Administrator
Apr 25, 2015
1,845
2
2,199
327
Is there any way you can post the source to this (only if you want to) --- I'm interested in converting this application to JS (JavaScript), that way someone can just type a name into a textbox and the JS can put the cloned name in a text field. This would make it so that someone can just do this on a website instead of having to download and run an application. :D
 

iJoris

Member
May 20, 2015
24
15
35
Is there any way you can post the source to this (only if you want to) --- I'm interested in converting this application to JS (JavaScript), that way someone can just type a name into a textbox and the JS can put the cloned name in a text field. This would make it so that someone can just do this on a website instead of having to download and run an application. :D
First time i used vb.net, so the source is shit i think.
But since i'm a big supporter of open source i posted the source in the OP.
Have fun.
If you need any help with it in javascript ( because i know that better then vb.net ) pm me.
 

Bluscream

Retired Staff
Contributor
May 8, 2015
967
934
211
I think about making a TS plugin for that :)

EDIT:
I continue working tomorrow :D
Code:
void ts3plugin_onMenuItemEvent(uint64 serverConnectionHandlerID, enum PluginMenuType type, int menuItemID, uint64 selectedItemID) {
    char* nickname;
    //char* nickname2;
    std::string str2 = "-";
    if (type == PLUGIN_MENU_TYPE_CLIENT) {
        switch(menuItemID) {
            case MENU_ID_CLIENT_1: {
                if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME, &nickname) == ERROR_ok) {
                    /*
                    If InStr(name, "a") > 0 Then
                        Dim exploited_name As String = Replace(name, "a", "а")
                        TextBox2.Text = exploited_name
                    ElseIf InStr(name, "c") Then
                        Dim exploited_name As String = Replace(name, "c", "с")
                        TextBox2.Text = exploited_name
                    ElseIf InStr(name, "e") Then
                        Dim exploited_name As String = Replace(name, "e", "е")
                        TextBox2.Text = exploited_name
                    ElseIf InStr(name, "o") Then
                        Dim exploited_name As String = Replace(name, "o", "о")
                    */
                    std::string str = nickname;
                    str.append(str2);
                    char* nickname2 = str;
                    if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME, nickname2) == ERROR_ok) {
                        ts3Functions.printMessageToCurrentTab("Successfully faked clients name.");
                    } else {
                        MessageBoxA(0, "Unable to set own nickname!", PLUGIN_NAME "ERROR", MB_ICONERROR);
                    }
                } else {
                    MessageBoxA(0, "Unable to get client nickname!", PLUGIN_NAME "ERROR", MB_ICONERROR);
                    return;
                }
                break;
            } default: {
                    break;
            }
        }
    }
}
 
Last edited:

iJoris

Member
May 20, 2015
24
15
35
I think about making a TS plugin for that :)

EDIT:
I continue working tomorrow :D
Code:
void ts3plugin_onMenuItemEvent(uint64 serverConnectionHandlerID, enum PluginMenuType type, int menuItemID, uint64 selectedItemID) {
    char* nickname;
    //char* nickname2;
    std::string str2 = "-";
    if (type == PLUGIN_MENU_TYPE_CLIENT) {
        switch(menuItemID) {
            case MENU_ID_CLIENT_1: {
                if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME, &nickname) == ERROR_ok) {
                    /*
                    If InStr(name, "a") > 0 Then
                        Dim exploited_name As String = Replace(name, "a", "а")
                        TextBox2.Text = exploited_name
                    ElseIf InStr(name, "c") Then
                        Dim exploited_name As String = Replace(name, "c", "с")
                        TextBox2.Text = exploited_name
                    ElseIf InStr(name, "e") Then
                        Dim exploited_name As String = Replace(name, "e", "е")
                        TextBox2.Text = exploited_name
                    ElseIf InStr(name, "o") Then
                        Dim exploited_name As String = Replace(name, "o", "о")
                    */
                    std::string str = nickname;
                    str.append(str2);
                    char* nickname2 = str;
                    if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME, nickname2) == ERROR_ok) {
                        ts3Functions.printMessageToCurrentTab("Successfully faked clients name.");
                    } else {
                        MessageBoxA(0, "Unable to set own nickname!", PLUGIN_NAME "ERROR", MB_ICONERROR);
                    }
                } else {
                    MessageBoxA(0, "Unable to get client nickname!", PLUGIN_NAME "ERROR", MB_ICONERROR);
                    return;
                }
                break;
            } default: {
                    break;
            }
        }
    }
}
Good work!

Here are more characters that can be exploited:
$a = array('O', 'o', 'e', 'E', 'c', 'C', 'a', 'A', 'B', 'T', 'X', 'x');
$b = array('О', 'о', 'е', 'Е', 'с', 'С', 'а', 'А', 'В', 'Т', 'Х', 'х');

$a are normal letters, $b are the exploited version.
 

Bluscream

Retired Staff
Contributor
May 8, 2015
967
934
211
Thanks Joris for your application that gave me the idea and the chars ^^ I will credit you when the plugin is finished :D

Code:
void ts3plugin_onMenuItemEvent(uint64 serverConnectionHandlerID, enum PluginMenuType type, int menuItemID, uint64 selectedItemID) {
    bool foundChar = false;
    char* nickname;
    int i;
    anyID ClientID;
    const char search[] = { 'O', 'o', 'e', 'E', 'c', 'C', 'a', 'A', 'B', 'T', 'X', 'x', '\0' };
    const char replace[] = { 'О', 'о', 'е', 'Е', 'с', 'С', 'а', 'А', 'В', 'Т', 'Х', 'х', '\0' };
    char* addition = "ᅚᅚᅚᅚ";
    if (type == PLUGIN_MENU_TYPE_CLIENT) {
        switch (menuItemID) {
        case MENU_ID_CLIENT_1: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME, &nickname) == ERROR_ok) {
                for (i = 0; search != '\0'; i++) {
                    //if (strstr(nickname, search[i])) {
                        //replace(char)
                        foundChar = true;
                    //}
                }
                if (foundChar == false) {
                    //str.append(nickname,addition)
                }
                if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME, nickname) == ERROR_ok) {
                    ts3Functions.flushClientSelfUpdates(serverConnectionHandlerID, NULL);
                    ts3Functions.printMessageToCurrentTab("Successfully faked clients name.");
                }
                else {
                    MessageBoxA(0, "Unable to set own nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                }
                MessageBoxA(0, nickname, PLUGIN_NAME "ERROR", MB_ICONERROR);
            }
            else {
                MessageBoxA(0, "Unable to get client nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        case MENU_ID_CLIENT_2: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME_PHONETIC, &nickname) == ERROR_ok) {
                if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME_PHONETIC, nickname) == ERROR_ok) {
                    ts3Functions.flushClientSelfUpdates(serverConnectionHandlerID, NULL);
                    ts3Functions.printMessageToCurrentTab("Successfully faked clients phonetic name.");
                }
                else {
                    MessageBoxA(0, "Unable to set own phonetic nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                }
            }
            else {
                MessageBoxA(0, "Unable to get client phonetic nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        case MENU_ID_CLIENT_3: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_DESCRIPTION, &nickname) == ERROR_ok) {
                ts3Functions.getClientID(serverConnectionHandlerID, &ClientID);
                ts3Functions.requestClientEditDescription(serverConnectionHandlerID, ClientID, nickname, NULL);
                ts3Functions.printMessageToCurrentTab("Successfully faked clients description.");
            }
            else {
                MessageBoxA(0, "Unable to get client description!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        } default: {
            break;
        }
        }
        }
        }
    }
}

9ce3963363.png
 
Last edited:

iJoris

Member
May 20, 2015
24
15
35
Thanks Joris for your application that gave me the idea and the chars ^^ I will credit you when the plugin is finished :D

Code:
void ts3plugin_onMenuItemEvent(uint64 serverConnectionHandlerID, enum PluginMenuType type, int menuItemID, uint64 selectedItemID) {
    bool foundChar = false;
    char* nickname;
    int i;
    anyID ClientID;
    const char search[] = { 'O', 'o', 'e', 'E', 'c', 'C', 'a', 'A', 'B', 'T', 'X', 'x', '\0' };
    const char replace[] = { 'О', 'о', 'е', 'Е', 'с', 'С', 'а', 'А', 'В', 'Т', 'Х', 'х', '\0' };
    char* addition = "ᅚᅚᅚᅚ";
    if (type == PLUGIN_MENU_TYPE_CLIENT) {
        switch (menuItemID) {
        case MENU_ID_CLIENT_1: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME, &nickname) == ERROR_ok) {
                for (i = 0; search != '\0'; i++) {
                    //if (strstr(nickname, search[i])) {
                        //replace(char)
                        foundChar = true;
                    //}
                }
                if (foundChar == false) {
                    //str.append(nickname,addition)
                }
                if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME, nickname) == ERROR_ok) {
                    ts3Functions.flushClientSelfUpdates(serverConnectionHandlerID, NULL);
                    ts3Functions.printMessageToCurrentTab("Successfully faked clients name.");
                }
                else {
                    MessageBoxA(0, "Unable to set own nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                }
                MessageBoxA(0, nickname, PLUGIN_NAME "ERROR", MB_ICONERROR);
            }
            else {
                MessageBoxA(0, "Unable to get client nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        case MENU_ID_CLIENT_2: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME_PHONETIC, &nickname) == ERROR_ok) {
                if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME_PHONETIC, nickname) == ERROR_ok) {
                    ts3Functions.flushClientSelfUpdates(serverConnectionHandlerID, NULL);
                    ts3Functions.printMessageToCurrentTab("Successfully faked clients phonetic name.");
                }
                else {
                    MessageBoxA(0, "Unable to set own phonetic nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                }
            }
            else {
                MessageBoxA(0, "Unable to get client phonetic nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        case MENU_ID_CLIENT_3: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_DESCRIPTION, &nickname) == ERROR_ok) {
                ts3Functions.getClientID(serverConnectionHandlerID, &ClientID);
                ts3Functions.requestClientEditDescription(serverConnectionHandlerID, ClientID, nickname, NULL);
                ts3Functions.printMessageToCurrentTab("Successfully faked clients description.");
            }
            else {
                MessageBoxA(0, "Unable to get client description!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        } default: {
            break;
        }
        }
        }
        }
    }
}

9ce3963363.png
Awe-some!!
 

Supervisor

Administrator
Apr 27, 2015
1,863
2,546
335
This is looking very nice! I'll try it tomorrow.

/edit: oh wait, you have to upload first xD
 

self.add()

Member
Jul 20, 2015
13
11
35
Here are some more:
Code:
const char search[] = { 'A', 'A', 'B', 'B', 'C', 'E', 'E', 'H', 'H', 'I', 'I', 'J', 'K', 'K', 'M', 'M', 'N', 'O', 'O', 'P', 'Q', 'S', 'T', 'T', 'X', 'X', 'Y', 'Y', 'Z', 'a', 'c', 'd', 'e', 'h', 'i', 'j', 'o', 'o', 'p', 'q', 's', 'w', 'x', 'y', 'z' ,' '}
const char replace[] = { 'Α', 'А', 'Β', 'В', 'С', 'Ε', 'Е', 'Η', 'Н', 'Ι', 'І', 'Ј', 'Κ', 'К', 'Μ', 'М', 'Ν', 'Ο', 'О', 'Р', 'Ԛ', 'Ѕ', 'Τ', 'Т', 'Χ', 'Х', 'Υ', 'Ү', 'Ζ', 'а', 'с', 'ԁ', 'е', 'һ', 'і', 'ј', 'ο', 'о', 'р', 'ԛ', 'ѕ', 'ᴡ', 'х', 'у', 'ᴢ', ' '}
Could use a randomizer to randomize between multiple characters.
I did not put the "very close but noticeable" characters in since they'd destroy the illusion.
Characters in the array that seem to differ don't differ in TeamSpeak 3. All characters are tested.
Code:
const char search[] = { 'fi', 'fl', 'ij' }
const char replace[] = { 'fi', 'fl', 'ij' }
 
Last edited:

TronixYT

Member
Sep 26, 2015
6
1
35
Thanks Joris for your application that gave me the idea and the chars ^^ I will credit you when the plugin is finished :D

Code:
void ts3plugin_onMenuItemEvent(uint64 serverConnectionHandlerID, enum PluginMenuType type, int menuItemID, uint64 selectedItemID) {
    bool foundChar = false;
    char* nickname;
    int i;
    anyID ClientID;
    const char search[] = { 'O', 'o', 'e', 'E', 'c', 'C', 'a', 'A', 'B', 'T', 'X', 'x', '\0' };
    const char replace[] = { 'О', 'о', 'е', 'Е', 'с', 'С', 'а', 'А', 'В', 'Т', 'Х', 'х', '\0' };
    char* addition = "ᅚᅚᅚᅚ";
    if (type == PLUGIN_MENU_TYPE_CLIENT) {
        switch (menuItemID) {
        case MENU_ID_CLIENT_1: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME, &nickname) == ERROR_ok) {
                for (i = 0; search != '\0'; i++) {
                    //if (strstr(nickname, search[i])) {
                        //replace(char)
                        foundChar = true;
                    //}
                }
                if (foundChar == false) {
                    //str.append(nickname,addition)
                }
                if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME, nickname) == ERROR_ok) {
                    ts3Functions.flushClientSelfUpdates(serverConnectionHandlerID, NULL);
                    ts3Functions.printMessageToCurrentTab("Successfully faked clients name.");
                }
                else {
                    MessageBoxA(0, "Unable to set own nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                }
                MessageBoxA(0, nickname, PLUGIN_NAME "ERROR", MB_ICONERROR);
            }
            else {
                MessageBoxA(0, "Unable to get client nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        case MENU_ID_CLIENT_2: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_NICKNAME_PHONETIC, &nickname) == ERROR_ok) {
                if (ts3Functions.setClientSelfVariableAsString(serverConnectionHandlerID, CLIENT_NICKNAME_PHONETIC, nickname) == ERROR_ok) {
                    ts3Functions.flushClientSelfUpdates(serverConnectionHandlerID, NULL);
                    ts3Functions.printMessageToCurrentTab("Successfully faked clients phonetic name.");
                }
                else {
                    MessageBoxA(0, "Unable to set own phonetic nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                }
            }
            else {
                MessageBoxA(0, "Unable to get client phonetic nickname!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        case MENU_ID_CLIENT_3: {
            if (ts3Functions.getClientVariableAsString(serverConnectionHandlerID, selectedItemID, CLIENT_DESCRIPTION, &nickname) == ERROR_ok) {
                ts3Functions.getClientID(serverConnectionHandlerID, &ClientID);
                ts3Functions.requestClientEditDescription(serverConnectionHandlerID, ClientID, nickname, NULL);
                ts3Functions.printMessageToCurrentTab("Successfully faked clients description.");
            }
            else {
                MessageBoxA(0, "Unable to get client description!", PLUGIN_NAME " ERROR", MB_ICONERROR);
                return;
            }
            break;
        } default: {
            break;
        }
        }
        }
        }
    }
}

9ce3963363.png

What is PermChanSwitcher in ur Plugins? :) ^.^
 

Asphyxia

Owner
Administrator
Apr 25, 2015
1,845
2
2,199
327
OP is last seen 2017 - pretty sure this is a dead post. I would recommend switching to Mumble though if you are having problems.
teamSpeak has a fairly awful implementation of their protocol. Just do a password protected Mumble (murmur) server since you mentioned your server is acting up
 
Top