From 9c9fac02565e2411beb2cc48d8ae2d41500a5b78 Mon Sep 17 00:00:00 2001 From: Dimatert9 Date: Sat, 1 Oct 2016 13:32:03 +0300 Subject: [PATCH 1/5] fix decode --- src/main/java/us/myles/sep/SkullExploitPatch.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/us/myles/sep/SkullExploitPatch.java b/src/main/java/us/myles/sep/SkullExploitPatch.java index 65157c5..335200b 100644 --- a/src/main/java/us/myles/sep/SkullExploitPatch.java +++ b/src/main/java/us/myles/sep/SkullExploitPatch.java @@ -68,7 +68,7 @@ public boolean isExploit(NbtCompound root) { if (((NbtCompound) texture).getString("Value").trim().length() > 0) { // Check json try { - String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); + String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value").replace("\"", ""))); JSONObject object = (JSONObject) new JSONParser().parse(decoded); if (object.containsKey("textures")) { object = (JSONObject) object.get("textures"); From 966c6a7b08952718b9df6ab0118964ea6997f211 Mon Sep 17 00:00:00 2001 From: Dimatert9 Date: Sat, 1 Oct 2016 23:30:32 +0300 Subject: [PATCH 2/5] dont use JSONObject --- src/main/java/us/myles/sep/ItemPatcher.java | 1 - .../java/us/myles/sep/SkullExploitPatch.java | 42 ++++++------------- 2 files changed, 13 insertions(+), 30 deletions(-) diff --git a/src/main/java/us/myles/sep/ItemPatcher.java b/src/main/java/us/myles/sep/ItemPatcher.java index 082fd4d..572b696 100644 --- a/src/main/java/us/myles/sep/ItemPatcher.java +++ b/src/main/java/us/myles/sep/ItemPatcher.java @@ -1,6 +1,5 @@ package us.myles.sep; -import org.bukkit.Material; import org.bukkit.entity.EntityType; import org.bukkit.event.EventHandler; import org.bukkit.event.EventPriority; diff --git a/src/main/java/us/myles/sep/SkullExploitPatch.java b/src/main/java/us/myles/sep/SkullExploitPatch.java index 335200b..7bb5ddf 100644 --- a/src/main/java/us/myles/sep/SkullExploitPatch.java +++ b/src/main/java/us/myles/sep/SkullExploitPatch.java @@ -1,11 +1,9 @@ package us.myles.sep; -import com.comphenix.protocol.ProtocolLibrary; -import com.comphenix.protocol.wrappers.nbt.NbtBase; -import com.comphenix.protocol.wrappers.nbt.NbtCompound; -import com.comphenix.protocol.wrappers.nbt.NbtFactory; -import com.comphenix.protocol.wrappers.nbt.NbtList; -import com.google.common.io.BaseEncoding; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; + import org.bukkit.Bukkit; import org.bukkit.Chunk; import org.bukkit.Material; @@ -18,9 +16,12 @@ import org.json.simple.JSONObject; import org.json.simple.parser.JSONParser; -import java.util.ArrayList; -import java.util.Arrays; -import java.util.List; +import com.comphenix.protocol.ProtocolLibrary; +import com.comphenix.protocol.wrappers.nbt.NbtBase; +import com.comphenix.protocol.wrappers.nbt.NbtCompound; +import com.comphenix.protocol.wrappers.nbt.NbtFactory; +import com.comphenix.protocol.wrappers.nbt.NbtList; +import com.google.common.io.BaseEncoding; public class SkullExploitPatch extends JavaPlugin { public void onEnable() { @@ -67,29 +68,12 @@ public boolean isExploit(NbtCompound root) { if (((NbtCompound) texture).containsKey("Value")) { if (((NbtCompound) texture).getString("Value").trim().length() > 0) { // Check json - try { - String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value").replace("\"", ""))); - JSONObject object = (JSONObject) new JSONParser().parse(decoded); - if (object.containsKey("textures")) { - object = (JSONObject) object.get("textures"); - } - if (object.containsKey("SKIN")) { - object = (JSONObject) object.get("SKIN"); - } - if (!object.containsKey("url")) { - root.remove("SkullOwner"); - return true; - } - if (((String) object.get("url")).trim().length() == 0) { - root.remove("SkullOwner"); - return true; - } - return false; - } catch (Exception e) { - // Decode failed + String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); + if (!decoded.contains("textures") && !decoded.contains("url")) { root.remove("SkullOwner"); return true; } + return false; } else { root.remove("SkullOwner"); return true; From a1b0708303a2905463325b833beecf1e03078d81 Mon Sep 17 00:00:00 2001 From: Dimatert9 Date: Wed, 2 Nov 2016 17:53:15 +0200 Subject: [PATCH 3/5] maybe fix 1.10 --- src/main/java/us/myles/sep/ItemPatcher.java | 14 ++++- .../java/us/myles/sep/SkullExploitPatch.java | 57 ++++++++----------- 2 files changed, 36 insertions(+), 35 deletions(-) diff --git a/src/main/java/us/myles/sep/ItemPatcher.java b/src/main/java/us/myles/sep/ItemPatcher.java index 572b696..f166f86 100644 --- a/src/main/java/us/myles/sep/ItemPatcher.java +++ b/src/main/java/us/myles/sep/ItemPatcher.java @@ -4,6 +4,7 @@ import org.bukkit.event.EventHandler; import org.bukkit.event.EventPriority; import org.bukkit.event.Listener; +import org.bukkit.event.entity.PlayerDeathEvent; import org.bukkit.event.inventory.InventoryClickEvent; import org.bukkit.event.player.PlayerDropItemEvent; import org.bukkit.event.player.PlayerInteractEvent; @@ -34,7 +35,18 @@ public void onJoin(PlayerJoinEvent e) { } } } - + @EventHandler(priority = EventPriority.HIGHEST) + public void onPlayerDeath(PlayerDeathEvent e) { + if (e.getEntity() == null) { + return; + } + for (ItemStack it : e.getDrops()) { + if (plugin.isExploit(it)) { + e.getDrops().remove(it); + plugin.getLogger().warning("Removing exploit from inventory, " + e.getEntity().getName()); + } + } + } @EventHandler(priority = EventPriority.HIGHEST, ignoreCancelled = true) public void onItemDrop(PlayerDropItemEvent e) { if (plugin.isExploit(e.getItemDrop().getItemStack())) { diff --git a/src/main/java/us/myles/sep/SkullExploitPatch.java b/src/main/java/us/myles/sep/SkullExploitPatch.java index 7bb5ddf..d1cab6e 100644 --- a/src/main/java/us/myles/sep/SkullExploitPatch.java +++ b/src/main/java/us/myles/sep/SkullExploitPatch.java @@ -9,12 +9,11 @@ import org.bukkit.Material; import org.bukkit.block.Block; import org.bukkit.block.BlockState; +import org.bukkit.block.Skull; import org.bukkit.entity.Entity; import org.bukkit.entity.Item; import org.bukkit.inventory.ItemStack; import org.bukkit.plugin.java.JavaPlugin; -import org.json.simple.JSONObject; -import org.json.simple.parser.JSONParser; import com.comphenix.protocol.ProtocolLibrary; import com.comphenix.protocol.wrappers.nbt.NbtBase; @@ -24,7 +23,9 @@ import com.google.common.io.BaseEncoding; public class SkullExploitPatch extends JavaPlugin { + Boolean mc10; public void onEnable() { + mc10 = this.getServer().getClass().getPackage().getName().replace(".", ",").split(",")[3].startsWith("v1_10_R"); // Packet Listener ProtocolLibrary.getProtocolManager().addPacketListener(new SkullExploitListener(this)); // Chunk Load Listener @@ -69,11 +70,10 @@ public boolean isExploit(NbtCompound root) { if (((NbtCompound) texture).getString("Value").trim().length() > 0) { // Check json String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); - if (!decoded.contains("textures") && !decoded.contains("url")) { + if (!decoded.contains("textures") && !decoded.toLowerCase().contains("skin") && !decoded.contains("url")) { root.remove("SkullOwner"); return true; } - return false; } else { root.remove("SkullOwner"); return true; @@ -89,7 +89,6 @@ public boolean isExploit(NbtCompound root) { } // Block if (root.containsKey("Owner")) - { NbtCompound skullOwner = root.getCompound("Owner"); if (skullOwner.containsKey("Properties")) { @@ -101,27 +100,9 @@ public boolean isExploit(NbtCompound root) { if (((NbtCompound) texture).containsKey("Value")) { if (((NbtCompound) texture).getString("Value").trim().length() > 0) { // Check json - try { - String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); - JSONObject object = (JSONObject) new JSONParser().parse(decoded); - if (object.containsKey("textures")) { - object = (JSONObject) object.get("textures"); - } - if (object.containsKey("SKIN")) { - object = (JSONObject) object.get("SKIN"); - } - if (!object.containsKey("url")) { - root.remove("Owner"); - return true; - } - if (((String) object.get("url")).trim().length() == 0) { - root.remove("Owner"); - return true; - } - return false; - } catch (Exception e) { - // Decode failed - root.remove("Owner"); + String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); + if (!decoded.contains("textures") && !decoded.toLowerCase().contains("skin") && !decoded.contains("url")) { + root.remove("SkullOwner"); return true; } } else { @@ -153,15 +134,23 @@ public void cleanChunk(Chunk chunk) { } for (Block head : heads) { - try { - //Dont skip loop if error - NbtCompound root = NbtFactory.readBlockState(head); - if (isExploit(root)) { - getLogger().warning("Removing exploit block, " + head.getLocation()); - head.setType(Material.AIR); + if (mc10) { + Skull meta = (Skull) head.getState(); + if (meta.hasOwner()) { + meta.setOwningPlayer(meta.getOwningPlayer()); + meta.update(); + } + } else { + try { + //Dont skip loop if error + NbtCompound root = NbtFactory.readBlockState(head); + if (isExploit(root)) { + getLogger().warning("Removing exploit block, " + head.getLocation()); + head.setType(Material.AIR); + } + } catch (Exception e) { + // Failed to read chunk data, probably odd version and need to update protocol lib. } - } catch (Exception e) { - // Failed to read chunk data, probably odd version and need to update protocol lib. } } From c0a31cc735448eb0d86d842a9c032641ff0b1bed Mon Sep 17 00:00:00 2001 From: Dimatert9 Date: Wed, 2 Nov 2016 19:51:37 +0200 Subject: [PATCH 4/5] check url lenght --- .../java/us/myles/sep/SkullExploitPatch.java | 33 +++++++++++++++---- 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/src/main/java/us/myles/sep/SkullExploitPatch.java b/src/main/java/us/myles/sep/SkullExploitPatch.java index d1cab6e..dcbc50b 100644 --- a/src/main/java/us/myles/sep/SkullExploitPatch.java +++ b/src/main/java/us/myles/sep/SkullExploitPatch.java @@ -68,18 +68,28 @@ public boolean isExploit(NbtCompound root) { // Check for value if (((NbtCompound) texture).containsKey("Value")) { if (((NbtCompound) texture).getString("Value").trim().length() > 0) { - // Check json String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); - if (!decoded.contains("textures") && !decoded.toLowerCase().contains("skin") && !decoded.contains("url")) { + if (decoded.contains("textures") && decoded.contains("SKIN")) { + if (decoded.contains("url")) { + String Url = decoded.split("url")[1].replace("\"", "").replace(":", "").replace("{", "").replace("}", ""); + if (Url.trim().length() == 0) { + root.remove("SkullOwner"); + return true; + } + } else { + root.remove("SkullOwner"); + return true; + } + } else { root.remove("SkullOwner"); return true; } } else { - root.remove("SkullOwner"); + root.remove("Owner"); return true; } } else { - root.remove("SkullOwner"); + root.remove("Owner"); return true; } } @@ -99,9 +109,19 @@ public boolean isExploit(NbtCompound root) { if (texture instanceof NbtCompound) { if (((NbtCompound) texture).containsKey("Value")) { if (((NbtCompound) texture).getString("Value").trim().length() > 0) { - // Check json String decoded = new String(BaseEncoding.base64().decode(((NbtCompound) texture).getString("Value"))); - if (!decoded.contains("textures") && !decoded.toLowerCase().contains("skin") && !decoded.contains("url")) { + if (decoded.contains("textures") && decoded.contains("SKIN")) { + if (decoded.contains("url")) { + String Url = decoded.split("url")[1].replace("\"", "").replace(":", "").replace("{", "").replace("}", ""); + if (Url.trim().length() == 0) { + root.remove("SkullOwner"); + return true; + } + } else { + root.remove("SkullOwner"); + return true; + } + } else { root.remove("SkullOwner"); return true; } @@ -118,6 +138,7 @@ public boolean isExploit(NbtCompound root) { } } } + return false; } From be8bd51e279a48af156ee40ca24178ca9b6c3c5f Mon Sep 17 00:00:00 2001 From: Slava Maspanov Date: Thu, 3 Nov 2016 13:54:26 +0200 Subject: [PATCH 5/5] Oops --- src/main/java/us/myles/sep/SkullExploitPatch.java | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/main/java/us/myles/sep/SkullExploitPatch.java b/src/main/java/us/myles/sep/SkullExploitPatch.java index dcbc50b..9a4ee16 100644 --- a/src/main/java/us/myles/sep/SkullExploitPatch.java +++ b/src/main/java/us/myles/sep/SkullExploitPatch.java @@ -85,11 +85,11 @@ public boolean isExploit(NbtCompound root) { return true; } } else { - root.remove("Owner"); + root.remove("SkullOwner"); return true; } } else { - root.remove("Owner"); + root.remove("SkullOwner"); return true; } } @@ -114,15 +114,15 @@ public boolean isExploit(NbtCompound root) { if (decoded.contains("url")) { String Url = decoded.split("url")[1].replace("\"", "").replace(":", "").replace("{", "").replace("}", ""); if (Url.trim().length() == 0) { - root.remove("SkullOwner"); + root.remove("Owner"); return true; } } else { - root.remove("SkullOwner"); + root.remove("Owner"); return true; } } else { - root.remove("SkullOwner"); + root.remove("Owner"); return true; } } else {