nitro/apollyon-ms4
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'swf-exploit-fix' into 'master'

Browse Source 
Swf exploit fix

See merge request official-plugins/apollyon!7
This commit is contained in:
Harmonic 2020-11-18 09:59:28 -05:00
commit 3762dc3ad3
3 changed files with 58 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/main/java/org/krews/apollyon/ftp/FTPUploadService.java
View File

@ -1,17 +1,20 @@
package org.krews.apollyon.ftp;
import com.eu.habbo.Emulator;
import org.krews.apollyon.utils.PngSignatureChecker;
import java.io.IOException;
import java.io.OutputStream;
import java.net.URL;
import java.net.URLConnection;
import java.net.URLEncoder;
import java.util.Arrays;
public class FTPUploadService {
private static final String ftpUrl = "ftp://%s:%s@%s/%s;type=i";
public static void uploadImage(byte[] image, String uploadPath) throws IOException {
if (PngSignatureChecker.isPngFile(image)) {
String host = Emulator.getConfig().getValue("ftp.host");
String user = Emulator.getConfig().getValue("ftp.user");
String pass = Emulator.getConfig().getValue("ftp.password");
@ -25,3 +28,4 @@ public class FTPUploadService {
outputStream.close();
}
}
}

17
src/main/java/org/krews/apollyon/incoming/CameraRoomPictureEvent.java
View File

@ -1,21 +1,19 @@
package org.krews.apollyon.incoming;
import com.eu.habbo.Emulator;
import com.eu.habbo.habbohotel.catalog.CatalogManager;
import com.eu.habbo.habbohotel.rooms.Room;
import com.eu.habbo.messages.incoming.MessageHandler;
import com.eu.habbo.messages.outgoing.camera.CameraURLComposer;
import com.eu.habbo.messages.outgoing.generic.alerts.GenericAlertComposer;
import io.netty.buffer.ByteBuf;
import io.netty.buffer.ByteBufInputStream;
import javafx.scene.Camera;
import org.krews.apollyon.ftp.FTPUploadService;
import org.krews.apollyon.utils.PngSignatureChecker;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.imageio.ImageIO;
import java.awt.image.BufferedImage;
import java.awt.image.DataBufferByte;
import java.io.File;
import java.io.IOException;
import java.lang.IllegalArgumentException;
@ -38,11 +36,16 @@ public class CameraRoomPictureEvent extends MessageHandler {
final int count = this.packet.readInt();
ByteBuf image = this.packet.getBuffer().readBytes(count);
ByteBuf imageCopy = image.copy();
if (image == null)
return;
try {
byte[] imageBytes = new byte[image.readableBytes()];
image.readBytes(imageBytes);
if (PngSignatureChecker.isPngFile(imageBytes)) {
this.packet.readString();
this.packet.readString();
this.packet.readInt();
@ -62,13 +65,10 @@ public class CameraRoomPictureEvent extends MessageHandler {
try {
if (Emulator.getConfig().getInt("ftp.enabled") == 1) {
byte[] imageBytes = new byte[image.readableBytes()];
image.readBytes(imageBytes);
FTPUploadService.uploadImage(imageBytes, Emulator.getConfig().getValue("imager.location.output.camera") + URL);
FTPUploadService.uploadImage(imageBytes, Emulator.getConfig().getValue("imager.location.output.camera") + URL_small);
}
else {
BufferedImage theImage = ImageIO.read(new ByteBufInputStream(image));
} else {
BufferedImage theImage = ImageIO.read(new ByteBufInputStream(imageCopy));
ImageIO.write(theImage, "png", new File(Emulator.getConfig().getValue("imager.location.output.camera") + URL));
ImageIO.write(theImage, "png", new File(Emulator.getConfig().getValue("imager.location.output.camera") + URL_small));
}
@ -80,6 +80,7 @@ public class CameraRoomPictureEvent extends MessageHandler {
}
this.client.sendResponse(new CameraURLComposer(URL));
}
} finally {
image.release();
}

20
src/main/java/org/krews/apollyon/utils/PngSignatureChecker.java Normal file
View File

@ -0,0 +1,20 @@
package org.krews.apollyon.utils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.Arrays;
public class PngSignatureChecker {
private static final Logger LOGGER = LoggerFactory.getLogger(PngSignatureChecker.class);
private static byte[] signature = new byte[] { -119, 80, 78, 71, 13, 10, 26, 10 };
public static boolean isPngFile(byte[] file) {
if (Arrays.equals(Arrays.copyOfRange(file, 0, 8), signature)) {
return true;
} else {
LOGGER.warn("[Apollyon] Someone tried to exploit the camera by uploading a malicious file!");
return false;
}
}
}