mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Nov 2003
Posts: 25
B
Biezais Offline OP
Ameglian cow
OP Offline
Ameglian cow
B
Joined: Nov 2003
Posts: 25
Using v6.12
I tried this script:
Code:
ctcp *:DCC Send:*: if ($len($nopath($filename)) >= 225) { echo 4 -s $nick tried to crash you with an illegal dcc send of $nopath($filename) | halt }  

When testing, message in status window appears:
[01:08] DCC Send from Biezais rejected (invalid parameters)
but this event not handled with script...
After all, I removed the "if" statement, but is has not helped.

Joined: Jun 2003
Posts: 5,024
M
Hoopy frood
Offline
Hoopy frood
M
Joined: Jun 2003
Posts: 5,024
ALT+R > File > New

Put the code in a new file to make sure it does not conflict with any other code. Also make sure you have put the code into your Remotes exactly and you have no "DCC Exploit Blocking" scripts loaded etc.

G'luck.

Regards,


Mentality/Chris
Joined: Nov 2003
Posts: 25
B
Biezais Offline OP
Ameglian cow
OP Offline
Ameglian cow
B
Joined: Nov 2003
Posts: 25
New file is created, all others unloaded.
No changes.

Joined: Jun 2003
Posts: 5,024
M
Hoopy frood
Offline
Hoopy frood
M
Joined: Jun 2003
Posts: 5,024
Try this:

Code:
CTCP *:dcc send:*:
  if (($len($nopath($filename)) >= 225) || ($len($nopath($3)) >= 225)) {
  echo 4 -a * $nick tried to crash your client using the 6.12 long filename vulnerability.
  write $+(",$mircdirAttackers.txt,") $nick ( $+ $address($nick,5) $+ ) @ $time on $date ( $+ $server $+ )
  halt
}


This also logs the attacks to a file called "Attackers.txt" in your mIRC directory.

If that doesn't work also, then I dunno and I hope someone else has a solution :P

Regards,


Mentality/Chris
Joined: Nov 2003
Posts: 25
B
Biezais Offline OP
Ameglian cow
OP Offline
Ameglian cow
B
Joined: Nov 2003
Posts: 25
I don't understand, than it is better...
Event "dcc send" is not intercepted at all by a simple script.

ctcp *:DCC Send:*: echo DCC send event handled.
Not working.
Except, if sending a normal file (/dcc send Biezais mirc.ini), event was handled.

Last edited by Biezais; 25/11/03 01:02 AM.
Joined: Dec 2002
Posts: 1,922
O
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
There are two exploits. The first exploit affects mIRC v6-6.11, causing
immediate crash, and the other, recent exploit affects mIRC v6.12 too
but is less "dangerous" (explanations here). The script you pasted above
can only reject the recent exploit. This script, made by Olathe, detects
whether someone is doing the older exploit.

Joined: Nov 2003
Posts: 25
B
Biezais Offline OP
Ameglian cow
OP Offline
Ameglian cow
B
Joined: Nov 2003
Posts: 25
A problem has solved now. Thank you, Online!

Joined: Dec 2002
Posts: 1,922
O
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
You're welcome laugh


Link Copied to Clipboard