Miniclip lumberjack games hack with Autoit

I haven't wrote for a long time, even tho I made some great progress in hacking, with attack types of XSRF and Email Injection, maybe I'll write about those later, maybe not, but now I need to publish my newest creation: hacking lame games, which only requires you to destroy your keyboard.

I'm talking about the games like the newest game at miniclip.com, the Lumberjack Games. I used my hack on that, so I'll make that the example, even tho it can be used on many other simple games.

The hack is written in AutoIt and does one simple task: it presses the "x" button, which in our case is the chopping trees in most cases.

The simplest way to do that is:

While 1
  Send("x")
WEnd

But you don't want to use it in every game, which are switching pretty fast, and this script can hardly be closed (only from task manager), so I decided to make a GUI for it. A tiny simple one:



This GUI is described by the following code:

$mainwindow = GUICreate("X-Spammer", 170, 50)
$spam = GUICtrlCreateButton("Spam", 30, 15, 60)
$stop = GUICtrlCreateButton("Stop", 100, 15, 60)

GUISetState(@SW_SHOW)

But with this code we can't do much, it will simply start and finish, so we need to add some event handlers. First we tell that we would like to work in event mode:

Opt("GUIOnEventMode", 1)

Then we add some events with functions. The idea here is that we'll have a controller variable which has a value of 0 on startup, change it's value with the corresponding button pressed (set value of 1 when start and 0 when stop is pressed) and modify our loop, so that will spam the button "x" only when our controller, in this case $doit has a value of 1.

The complete code:

#include <guiconstantsex.au3>

$doit = 0;

Opt("GUIOnEventMode", 1)
$mainwindow = GUICreate("X-Spammer", 170, 50)
GUISetOnEvent($GUI_EVENT_CLOSE, "CLOSEClicked")
$spam = GUICtrlCreateButton("Spam", 30, 15, 60)
GUICtrlSetOnEvent($spam, "spam")
$stop = GUICtrlCreateButton("Stop", 100, 15, 60)
GUICtrlSetOnEvent($stop, "stop")

GUISetState(@SW_SHOW)

While 1
Sleep(10)
  If $doit Then
    Send("x")
  EndIf
WEnd

Func CLOSEClicked()
  Exit
EndFunc

Func spam()
  $doit = 1;
EndFunc

Func stop()
  $doit = 0;
EndFunc

It works really good. I played the game only twice. First without this hack, and scored around 12000, then with this little thing and...:



with a score of:


You can't use this tool in some levels but you can still win enough to become first. Hope you enjoyed and have fun learning.

Bye

JALH (Just Another Lame Hack)

Not lame, the lamest. I won't describe this with every detail, it was just too lame. I was trying some other URL SQL Injections on Lamer (without any great success) when found something weird. 

When submitting a post on forum I was looking in Fiddler for the post data. And I found my username and user ID within. I thought it's a bad joke, a remnant from an old version... I mean my username was in the cookie with my coded password (long term cookies for "remember me" for a year or so logins), why require it on form... in hidden inputs. It wasn't hidden at all.

I copied the site to a local HTML file, replaced every relative path (./) to absolute ones (http://lamer_domain.top_level_domain/) with Notepad++, removed the type="hidden" attributes of the inputs, and opened it.

There was a form, where I couldn't just post a text, but I could specify the one posting it. Guess what, I picked the administrator (user ID 2). Well, I'm a l33t, at least I've done this on the test-page, so no real user was reading it.

I think that's all about Lamer. When I was first asked to hack Lamer, I was thinking that 5 successful attempts will be more than enough to be acknowledged as somebody important, so this is the point where I'll stop hunting, this was the fifth chance to do something a normal user shouldn't do. Lamer isn't lame any more, moreover, never really was. I still think it's the best site ever, and hope one day I'll be one of it's programmers. But don't worry, the world is full of hackable things, and this blog will be alive until the whole world won't become smarter than I am.

The more I hack the more ideas I get to hack. So please stand by, very soon you'll hear about me.

Hacking my own ISP

As you know ISP stands for Internet Service Provider, those guys who let you connect to the Internet, usually over against a particular amount of fee. The title says hack, but it's not really a hack, but a pretty good bug exploit.

It was before a festival, some guys got in trouble for a dirty business (nothing happened after all), but I got acquainted with one of them. He was a real hacker, without the slightest knowledge of programming. He has his own "friends", passwords, programs and money-making prospect (and I'm not talking about working here, it's more like stealing).

He lives close to me, close enough to have the same ISP. He told me that our Internet Service has a bug. Our provider gives dynamic IP (for me became static since I have router and not turning off too often), which I knew about. The trick I didn't knew, was that different IP addresses got different bandwidths. Inside the local network (it's larger than the whole city) there's about 2-5 MB/s speed, outside is 255-500 KB/s. But there are a few IP addresses which got more then 5 MB/s speed outside of the local network.

That was the time he became my costumer. I had programming knowledge, and he had every other. Helped me a lot to create the bot, which search for the owning IP. It was simple: connect, calculate the bandwidth, if it was good enough exit, else disconnect and start over. For connecting and disconnecting I used RasDial, for bandwidth calculation RapidShare. The whole thing was implemented in C#.

A little reference for both of them:

• RasDial in C#
• Upload to RapidShare using C#

I think the second link is a broken one, or just the server is down temporary, either way I'll post my complete source code:

• RapidShare Upload Class : used for bandwidth calculation. Completely copied from the second site I gave before.
• Main program
• XML template file for user informasion

The program is very simple. I created a file (it's size is 1MB, but it can be changed), which is uploaded each time the bandwidth is calculated. The calculation is simple too, measure the time, and divide the uploaded file's size with it, then convert to KB/s.

To sum up, this wasn't that great of a hack. These IP's would have been allocated for users anyway, and a user could get access manually too, I just created a search bot to speed up the process. And I never taught about telling anyone in charge, I mean who don't wants speed? And why not to use it, if there's already outside somewhere?

If you have a dynamic IP, RasDial with the BotNet presented in the previous post can be used on anonymous voting polls. Vote, change IP and vote again (and do not accept any cookie). Maybe someday I'll create a software for that too. Another use would be brute-forcing logins. It's rustic but impossible to create defense against it. At least I couldn't do it.

But for now, I'll stay on Lamer, and attack it for a few more times.