[Share] AIO ITEM (buffer/gmshop/teleporter/etc) Exploit

[Icka]

[hide]Found another exploit while installing an AIO item in my test server.

This exploit is possible at a lot of servers using AIO ITEMS, NOT NPCS!!!!
For example, a server Like L2-INC that uses the magic gem AIO item for buffing/teleporting/gmshop/subclass... and more.
L2-Inc sux anywho but it's not exploitable there as far as I know............


However on other servers, it is.

These 2 for starters:
http://abandon-network.com/lineage/index.html
http://core.lineager.eu/

So far I have only discovered servers with the teleportto bypass exploitable.
But I'm sure there is servers out there with AIO items that have other exploits in custom made item bypass handlers.

This is how it works.

With this particular mod a new item bypass handler is patched into the core. It looks like this when built.

Quotebypass -h Aioitem_teleportTo_169015_-208262_-3499
this is the actual bypass the client will send to the server to use the html  link displayed in the IG client to the player,
for a specific location (x,y,z coordinates)

Instead of pulling an entry ID # in the bypass (for the database table of AIOteleports)
the code pulls the x,y,z locations from the db and puts them in the html build , creates the bypass and displays it as a button.

Well with no protection to check if that location is actually in the database a player can , and I have easily,
recreate a fake bypass using 2 well known programs and sent it to the server, thus allowing the player to teleport
to any x,y,z location they want in the world. [img alt=Smiley]http://www.--------.com/forum/Smileys/smilies_smf/smiley.gif[/img]

The L2.Net Script to send the fake bypass:
Code://CHANGE              _#X_#Y_#Z            TO ANY X,Y,Z Coordinates You wish and send it!
// These X Y Z coods are JAIL!

NPC_DIALOG "bypass -h Aioitem_teleportTo_-114598_-249431_-2979"

END_SCRIPTSome screen shots of it working.....

In L2 Abandon the AIO item is a "Deck"






Loading the L2.Net Script for the fake bypass


Sent the fake bypass
[/hide]