WorldGuard Bypass

Key Takeaways

this area is protected by worldguard nobody should be able to enter and yet there are people in here as always lots of hacking stuff is happening on the server but before we talk about that let me catch you up on what has happened since the last episode I'm here at my second favorite place on the server the item solder it's really complex and I didn't quite understand how it works but I finally figured out where the design is from it's from my Zuma games I'll link the channel below I've been binge watching some of the design videos really cool stuff but back to the server hopefully you'll remember I had developed an anti-human plugin that checks if the coordinates of players are specific strict values this is supposed to prevent human players from joining and only allow bot movements if imprecise human movement is detected the player is kicked I thought it's foolproof but turns out it's not effective first of all you can see me I'm moving on the server so I managed to bypass it and of course so have many others the server is very active with players and this causes some issues let's head to my favorite place on the server the spawn area nothing here was built by me and that's why it's so cool on any other anarchy-like server the spawn is always completely wrecked and of course we are getting more and more griefing attempts but the community here is defending it hard so let's do our part and help clean up some of the mess griefing on the server is actually a very interesting topic I don't want to spend time on Banning people for grieving So eventually it will happen but usually on survival servers you have the extreme power imbalance between normal players and Griefers the Griefers join with hacked clients they can fly around speed hacks super fast placing blocks while the regular players are on foot slow and cannot even attack them in the air but on this server it's different everybody has hacks cleaning up the mess can be automated with Bots and flying mix reaching the places easy look at this crazy bot from Ender kill 98 cleaning a lava cast but there's even more Bots at spawn actually have a built-in surveillance system that logs every valuable block getting grieved let me show you so here's the rainbow Beacon and underneath the protected obsidian is the actual Emerald pyramid now let's grieve one of those Emerald blocks boom here the live underflowpot which is not me I don't know who's bot that is it announced that live overflow broke a block of emerald at the Beacon and look at this I immediately get called out don't even think about it and these messages are also related to an unofficial Discord server so it doesn't take long and they show up to check on what the f I'm doing there ready to strike me down also there are a few known Griefers and here is an automated system warning everybody that they were sighted near spawn it's crazy I love it as you can see despite no plugins against grieving I think the accountability through logs and the power for the defender also using hacks or utility mods made the spawn survive for this long it's very fascinating to observe however the interval of Griefers joining is slowly increasing and I wonder how long the spawn will be defended but until then I am just here enjoying the music at the concert hall which by the way is another cool project from this server epic player A10 improved the note bot and the code even got merged into their meteor client love to see their engagement now on a different topic several players ask me about whether there's a way to get a club matter bottle in game unfortunately there was not so to be a good respected leader deserving of a statue I had to find a cool way to give players a bottle and luckily I had an idea this is the story how I found a world guard bypass there will be spoilers now so if you are a player on the server and you want to learn something try it yourself first you can always come back to the solution later it's a lot more fun to find the bypass yourself so anyway let's go foreign with my anti-human plugin in the last episode I went over a bit of Minecraft server code to show you how the plugin event system works in the anti-human plugin I register an on-player movie event which supposedly is called every time a player moves and in that code I check if the player has human or bot movement but when I was reading over the event calling code immediately I noticed something fishy so this code is in the server game packet listener this is executed every time a player sends a movement packet and here they create the player move event object and calls every plugin which registered to that event but just a few lines above this part there you can find this if Case prevent 40 event calls for less than a single Pixel of movement to implement this here they calculate a Delta movement basically the distance between the last known position and the new position in the packet and then they only go into this if case with the event trigger if the Delta is large enough immediately my alarm Bells went off can we maybe move without triggering an event not enter this if case I guess you already know the answer but before I tell you more about how it works let me show you the challenge I built around it at the coordinates one three three seven one three three seven I created a floating island and a small ruin the idea is that in this area similar to the anti-human check a plugin will check if a player is inside this area using the on Player move event if a player is detected there they will be teleported out to the floating island with a Kick message showing exactly what the check is so a very simple region protection plugin now if a player really manages to reach the chest in the Rune and interact with it they will get awarded a club matter I thought the challenge was foolproof but it didn't take long and I had to learn the hard way developing protection plugins is very difficult first I had to watch in shock that when players move inside a minecart the player move event is not triggered instead the on vehicle move event is called okay fine you got me I gotta extend the code but that was not all turns out that when the vehicle is not moving and you just click on entering it your player is basically teleported into the minecart not triggering a on Player move event only if you write the minecart that is triggered so you can start teleporting from Minecart to Minecart now it's not that simple because moving your camera also triggers sending a Player move packet but unfortunately every typical cheat client includes a feature to stop sending out any movement packets so now the only movements happening are basically only the server teleports when clicking on a minecart that's bad and this also led to the next discovery which is ender pearls you can also throw an ender pearl into the area and it triggers the server to teleport you if again you block any other outgoing movement packets you can use ender pearls to move move around in the area go to a chest and get a club Martin and that was still not all I really had an actual bug in the code where I forgot to check the world when opening a chest at the correct location I checked that the region protection only applies to the Oval World but I forget that with the chest reward so players figured out that they can place a chest on the nether roof and start farming Club Mata bottles God damn it why is it so hard to implement a basic region protection plugin and so at this point too many players were able to bypass my plugin without the intended solution and lots of Club Martin bottles were out in the world already kinda sucked to be honest but that's also fair game on the server for hackers however it was not all a bad experience because Philip as well as guildfish and other to very well-known and experienced Minecraft hackers they solved it the intended way so it's true there is a way to move in Minecraft without triggering the move event on the server a and the crazy thing goldfish and other immediately knew how to solve it because as it turns out the issue wasn't new but more on that later so after this fatal attempt of creating a cool challenge I decided to look around some more being able to not trigger the event handler seems to be something that could be a big issue for many plugins so I started to look into some region protection plugins the first one being World guard maybe they solved the other issues of Ender Pearls cards and animals but still have the player move event issue I opened up the code and take a look how it's implemented and it's right there they use the on Player move event so I set up a test world and installed worldguard defined the region with a flag to prevent players from entering you can see I cannot walk towards Herobrine but let me show you my exploit do you see this I'm able to walk towards him almost there let's try to kill him but well that doesn't work because of the disabled PVP in the area but point being I walked over there how did I do it I'm sure you noticed the flashing screen when executing the back and that has good reasons so let's go back to the code for every move packet the server calculates here the distance between the old known position and the new position in the packet if it's small it doesn't trigger the event so it seems simply just move very very very slowly but actually that doesn't work because this last position is only updated if the Delta was large enough which means when you slowly move last position stays the same and eventually you will have moved far enough for the Delta to become too large triggering the event but immediately I thought well I can just disconnect and reconnect again right just walk a few Tiny Steps less than Delta log out log in everything will be reset again and I can walk another tiny bit this should work and this was enough for me to think of building the first challenge there's definitely a legit way to walk tiny bits without triggering the event but after playing around with it a bit more another thought came to my head if you send an invalid move packet for example when you try to move very far away the server will reset your position with the teleport this effectively works like the relog it will reset everything and that's why you see me flashing I always move a tiny bit and then try to move very far away triggering a Teleport back to the current position and move forward again so all that is left you just have to write some code around this and then you can move in the protected area crazy so I went onto the server and started building ruins near the spawn inside of it is a club mate Fountain which is a lava pool and the goal is to die in there and the area is obviously protected by World guard I thought this looks really cool but people started messing with it and flooded it overnight turning lava into obsidian and I didn't want to turn on fluid protection in World guard due to Performance hits so I moved the ruins to almost build height up into the sky as a floating island instead but what do players get when they solve it because everybody got a club Martin bottle at this point I had to think of another reward so I implemented a name prefix if you bypass World guard and die in the club Martin Fountain you get awarded the hacker prefix and you can see many people on the server have it it was very cool to see how slowly the players figured it out also my solution is pretty bad it works but it's very slow but some other players started optimizing and getting every little piece they can out of it look how fast Jerry Lam is walking through the area it's crazy and here is Philip he was one of the first people to solve the challenge as well and it was also really fun to watch him optimize his bypass over time amazing so is this a serious zero day world guard bypass well I already mentioned that this issue is not a zero day guildfest showed me this hack forums threat from 2016 Minecraft 1.9 flyback bypass almost any anti-cheat and see what they write here basically you can move less than 0.0626 since it won't fire any events then you teleport into a block or the void to reset your position and then move less than 0.0626 again the whole process doesn't fire any events and you can move any way you want it's exactly the issue I discovered when reading over the plugin code you can see this issue is or was known in the Minecraft cheating Community since 2016. so how come worldguard is not patched against this or why has paper not patched it I have a few thoughts about that first the impact 4 World card is not that bad areas are still protected from griefing and pvps it's just entering bypass and that's not too bad to be honest but besides World guard of course it might bypass some basic anti-cheat plugins but also the flight is very slow the negative impact is probably not that high but what about paper patching it directly of course the whole Delta calculation could be removed and an event triggered on every move packet they claim it has negative performance impact but this is definitely something that could be checked how often are these tiny movements even happening during regular play so maybe paper would put this behind a config variable whether to always trigger the event or always change the Delta amount another fixed idea might be to make the server reset teleports to go back to the last position if they are set instead of the current player coordinates but in the end the server maintainers who are a lot more experienced with the code and know what else might break they have to decide if they fix it or not and not fixing it I think is totally fine as well it's probably not a serious issue if it has existed already for over six years but if the community decided to not patch it I think it must be very clearly documented that this is a potential issue plugin developers need to know about these details so they can make sure they design their plugin around us and so here I did my part hope more people know about it now cool we found a workout bypass so this is the end of my video but the more time I spend with the project the more I realize there are so many amazing projects happening on the server and I want to give players a chance to Showcase what they have done and in this episode I introduce you to dark Reaper he started on the wrong side he joined the server and started griefing but he really came around and tries to be a very productive member of the community now and I very much appreciate that and that's why he will be the first show take it away I have a fork of bleach hack which I renamed for dark heck because of my nickname there are actually a lot of people that use split check on this server I noticed that from speaking to some the first module that I made for the server was this ironbot module which allows me to move by rounding the position I also had to make extra mixing just for vehicles because if I would enter a boat it would kick me and as I use both fly quite a lot I had to implement that second module that I added to bleach was a eventless fly I have two modes for that because some plugins are more strict than a board card word card allows you to move inside of a block but uh some plugins don't so I have a strict mode which is kind of slow but allows me to move even on those strict plugins and I have a free mode that is a bit more free as you would say um so if I enable it with fly I can move pretty fast through the region next thing that I would like to show you is a sign restorer so basically I took this repository that was created just for restoring signs on live overflow server because I broke them so I noticed that some very skilled people on the server made a sign restorer mode but it didn't have highlights so you didn't know where do you need to place the signs so I added support for little renderer that just renders the blocks that needs to be replaced with sign it will now show me that there's a missing sign and when I place it back and this is handled by the code of green script curve it will automatically write down what was there before it works by using this Json file where there are coordinates and a message and the last thing that I would like to show you that I modified photo server is notebot I ate that little GUI when I go to UI and enable it it will show me what blocks have to be placed down I can disable the UI by going to modbot menu and disabling it by selecting it one more thing that I a death School KSP but I did that for 1.19 this works by searching for sculpts and Source if there's a it's called trigger in nine blocks radius it will show the blocks around in the red which means I can't step on these blocks if I don't want to activate the three car so if I would put this sensor a little bit further away it wouldn't showcase the blocks in red so only the sensors that are dangerous for me will be shown in red color so now I can place blocks here without a problem but if I would put it somewhere here that's it for this video and thank you for watching [Music] foreign [Music]