From 1823bfd8e7599fc465e45024e9323307b50563cf Mon Sep 17 00:00:00 2001 From: wolf Date: Mon, 24 Mar 2025 21:07:27 -0500 Subject: [PATCH] Vaccine will do a deeper jar scan, looking for suspicious class loading. --- .gradle/8.5/checksums/checksums.lock | Bin 17 -> 17 bytes .gradle/8.5/checksums/md5-checksums.bin | Bin 42047 -> 43747 bytes .gradle/8.5/checksums/sha1-checksums.bin | Bin 174221 -> 202619 bytes settings.gradle | 5 ++- .../sentinel/data/storage/NBTStorage.java | 24 ++------------ .../violations/players/EthanolPacket.java | 5 +++ .../sentinel/startup/BackdoorDetection.java | 6 ++++ .../sentinel/startup/PluginInspector.java | 31 ++++++++++++++++++ .../me/trouper/sentinel/utils/FileUtils.java | 9 ----- 9 files changed, 49 insertions(+), 31 deletions(-) create mode 100644 src/main/java/me/trouper/sentinel/server/events/violations/players/EthanolPacket.java create mode 100644 src/main/java/me/trouper/sentinel/startup/PluginInspector.java diff --git a/.gradle/8.5/checksums/checksums.lock b/.gradle/8.5/checksums/checksums.lock index 07a8063499933d62fa31b746c98b537b37844f69..e3800009d21fd6910bbc5cea414564d663fd2c67 100644 GIT binary patch literal 17 VcmZSfyWC&;{v_{G1~A|a1pqnO1oZ#_ literal 17 VcmZSfyWC&;{v_{G1~A~c2mm@$1#kcW diff --git a/.gradle/8.5/checksums/md5-checksums.bin b/.gradle/8.5/checksums/md5-checksums.bin index 840cbf237373afccef3f2effa22490031db92614..dd00658c2df04fb79747bd430cbf5b54abe1aca5 100644 GIT binary patch delta 2387 zcmZvd3p7-D9LMhrljn4AO(F_I9y#73GgBU8E0PW?n;ssOJYt9~YBxLR5GzHOMk;I` zgY_sk6|LkMc_wO=3Y!#3wMDhc-aG&6oOWja=ge=;`Ofe2{r&F$|G&SfYo-3xPrbBS zW!a|~_EewABtHNWtwM`Aa$%M#6e-xqQ$c>?ixBXmun{#d6>Xo-m95)g{l3T}0_gd9n58j=3g>frs%ma80b+4HYGgVLE1%#_1*qO2O)p?H zvzO9vM)r^gl*=YvYq3$wASrlxw4a>vfG3&B!q&483bK(qT^L!>Yz5T9eW(kYsb?M+ ze9pa&4z&FK`KBC0+FrZ2thht!w%9&)k~EBl{N21Y{4;4QgO1t+BD+U~R;6v5z9U@) z=z7~g#INR)TTrZ78xVyb&;naGIJoR#Co?F9q=V5(+hN!kes137;{~*$DYV(n72##g zwcm7U^#Nir6QkSfQ;>s&4SuKRf>MB5;({7+gWxb$+S5OzQb{}+OX1p4kfUSKOzxVc z#y}OOq0J5#sU|^b%p%O*an6>OK3BVii4NzgVm^sOYPuG9-YWdVBtFQlTiZf?LqmH@ zRMcHeeyEd!AWBB7!M#(cNxCY^%v-{5HMqYBIMa!1WBgw{Ma{l`%=J0L@MT~*yL#=c z2oD&>zllXXjt4QK)8FF93nmq7G#uRaH>lH20AjRP1VA#xEAuVE$9rtFau}+L|5=#W z|Mh_2>g(4487l?|tSN@zL}q#BI?lPZkug_h?6Mc{834qK_kb|^C`r_Gx>tP43d=Hk zU{f;9p7}r$LRo;A!l->XgC8>a;{IW?VMn6n}$ zMf%b5ga^s)!5t*RArJ^sL-FwKmg4)<^6aY$@?fV^ZD~&O@oxMY5oa=~0TAh5 zC6S|Cjm2?1^;+l1k*>IU6EzVLnCuG(YC9V1&EVG@@HI_JNzTzc(k?yd4R$o}WC_TT z>XCGfR9tuBsfy;P@>syN=_AqjaK`%xJf#B&c(Wv7d?t+*+Y{H~;c#7fFx*^9MDT8k z<}5xKsr8b`Y$yHwFgx*aLGx8!W`Zt0r|}}Z+s{D}nXjl>27{j$A2A`&%5Ac!c#I?j zEd@DkM9cVszv4mcoSG+ZI)0Ej-BfWtp);>?9K1Tb4&vJ2OU@1tV#GsRW{St6%AQvd ztEUY;kK@;d=%bUk|4<-~Y?nj=&J6fiR=v|PG<;In>{Wn2oCrxL5C}pt@gP=&5ttfZ z#!Pgt<;Klqm9vxp(M3*OBnKUiVeq{Vnty-$!PK_mL%Z+V+|dL%-Hn7N1f_-ILCjTy z8J27v;WMBqTu{oY^uqtFh(3B)A^?&bl_cJcUJNUCTs6Iw!BU#B;0OS5S2QQ^TaO4O zkt6KVMyu+W%j*UE>zuSgj{u~X2a3>>BnkN&8@F(UE(`BfE7?&s&x2vaBPTCJ`=1)B eD<@dp8tIkJ^)1&IblV^J0*dsJFN=CEQRH7o=ehF$ delta 174 zcmV;f08#(r)dIiB0w`l9Vbu$vxO+h0kdW*umQ6!EH49-jW02??l1TOlm0Q-v+gqB1heKhU<0#W zI|l)ieLNYn#yo%olU_kzlhr|BlTAWNldeM8lb%CIv;9LL0h2XFVY9A9HvyCVMw$XF cIk6$w1G7O$|33wl3ldW-li{EmvtNkd8-R93IsgCw diff --git a/.gradle/8.5/checksums/sha1-checksums.bin b/.gradle/8.5/checksums/sha1-checksums.bin index 38b29399ffb586dee186da81554d38d9691d9fce..81202a75de94fae7d437296cd1887f71e5364e3b 100644 GIT binary patch delta 5062 zcmbW53p`Y5AIIl8V@89VVaP2?g^gse)MSZd(@ml6O>I#T79(n3+lA3arCegNC)d(N zQK%g{m84dY+;vrijaBR_i4^fZXP)VOcSqj!zUTAlJahif@B9D%pUXM_M=^DBgSiS9 zzElTHk%c--77vNN5OsTL8jZTJ9B-k;6dryo;~#sK9z7A;=&CbCUQ-rhxL`&}RjPd) z5}qSPr*&KD_z4yBsE1qjAtfFn3e^h&xTe?Hk7rhkkWtw}*sjmRjn~M_EqdXPZ0tgj zs(~HAAE&*Z66Ps~jH(r)%V94|<1)eKXvN49f+hze%G zFyFq;=J%IyCA7Oxdv+3j%MI&%+Gv414%6?(MD;{3K7>~jOSYo$l3&34Huo-H}K{2k-Z^AjYxGIWH& zHom`bprdsE5yWO&lMWbgX5zQzf9ao-^cq>u50Wtxzyv1Sx}6o_FvY|dna{o_V-!Ih zP@Ej<$x>@rgRD8^DmFMtCy%LsY#%T}E(rzY0H3pNP*6@kAOT|tIRVhcPihS}t}}We zHqzNEh-m^amtE4yj?w$Lp$l16dPx@nmC$yhLiwmL1>_)m8<89d%5i~42Ya~WGLot$ zl56(?XFBdaQz=kU?kKWO0_2G(z@y{SgXG&bx}wR%vSo?-XyA)y=bc~k(n$|_J?}=E z#Q?b7GRhYz?wL4&1=l zEx#^17C=i{jLd2{c`yMa(Q)s=wtf4KNcMJiGpYF#$dJWzr~Q%6S!aW^Dq7^vY2b=1 zemj%kT=-&%*ovK7N^Uw08ZbO+=y8p!b2QRU3LwqS!uiK#dw9DZwW0Z^<95V{EWpFl zhL7rl`}}gY_JJnChy~Q)d`{vC=$szz>>P{WgHnPa*7t(?b0N_$^}kL&_*80 z2d%)s>_@*8*W!ti98^EOT#o+b-L9qDcac5IgxGuuIOCkSm1_^PVv#Y&lstEd8uGe` z*yZkPWKb3=&Vq%iTfbT)@^Vp_?Zw^a5+$MW(10{e9{d;e( z3i^Po=k^eTr6394myA{Wg%%@YP8xZr48Sj6OLudm)`IiMEjyB|D5p}m`rg@hk7+rw zDj5)36>vXzRc4ti_V7d#jAeO|y%hj3@Y(opX4USJ7nx&EcGXfTB#%^FUw+3OdEn%c zy>%c9!}(2B-sTB=kyXus6y68%7@qlyXTpeY46;r-NoqX;rWhW`i*LS0M?<44`;qny z;0nM)Dnd3fHo1wlST2j~eM0$FI_i>N_*ffxz;j4p6Zj6pjDs%f9>++y_VLc*CD$b` zF2yv7P)p2`gtyn0MDq?zhd2~~IT7Se_^XDGsgpP#d!`_hP;h!D*|QVV*OBq7>6=J6 zCt+s9@+8cXy6F%ZNtin97-SMfNtlm9LP1`rIJyC?lE`QW9KtXaQzO?UW7jd_c`5{E zref*@eAXdM&cYy(Y1jmLA|M@8)cX2B@u5AIUg16GW)C~%E>y&Pi{aM}B;GNsB5ZeH z<}!B-YbS^^pPac>W?6BAg;VvOsqP=*8~d&>SwA7^y*MH$0Mq;qdf z>Puk^|50BTJr!b3!Zq7LFXoEIQp@iL8P;#-V9Ugmck2)ozzd_Q&)-vmabR~@lc)M; z1q^R&u@bW1&9EzbD9=Q}+R@jCCd(ZiYBp3gB%LcK+l@c`kw7c-Q(t^({} zh`fecWY|U(>vIm7uiq+`(AhntH2`cd>SRDrCj|d_crtAju#xz2zI) z@p;Io{OD7mFiF`vWah&4K=w%uq&6MwV0`Xu0jsv#%MX__wO1i6X9xK}o;q5TyewoF z#saYw%Oz4Lg7^Q+DFjo8$Fc)z;(}-D-JGYuQEas>vZ}DkF5Ap7pK^JpWO}Ig6kZGu zc>DMC&_xeS%4P87QPU@;m>N<2G&-kUl=$ULIov*x-|gnmFELIO7T6>!TFn!_wJkuV zNpnOF^OGlF>TVZxFQfQ^?Z!I7)}4yKKHpBaPi+eKj_z)(lEk+XQ#36hY^64KXFquD zU}e&@((z-R@fnAKw-$qvz0l>0D23$FlmhRmV_@#%Wt)x;eH9=weAi!k_v;OkU;>1( zo{q*=cQu{RTySq=?p!5N@>bU&?)o)O66y}3^a!PVz!CIEnsEz@w$+qAu*yGd$`Lll z*Ta)0{7QTOZY^<79Y>|cVtF}6Dc)$q)Px!j*8R1adJ*3yexgt%rZK5XFGYO_wU(_6 zUlnGoTI|TXr@wpiZcl*;3ibyoax~6@(HN&MBD{CRpXK$~VcYy4);ymcA6Oxwrl1sM z4vwZy`ReG+HKp$qU9D?Pdm)>m!uvf#O!*x0KokbO2&8iyA0|yLYFW>ksnOM;eW@jK zAr@R?{OE%$3KpAXif zi*$;grvz}N|0~wa?M*-SfXQ&aRu-uJYI9!G#jp-Evbdko$nvPAlUivb-dDV7DI2cL z(XiTZsfstr-z#&5mGUrkJ9(@PBISm>B=%Mifkf{e|kuIPkIo(u(IC}B|8jTsT2_<_zcGHmLD5)&}<8?+hMs?)id1Q!pi4<^crsx1uLgk z7+&~if{jTD_&xs|8(VN@N|*zEf!1P^h32Wu;B^1M1Mn|exMTs9)H@F^mMy$VjciPc z|0a-P{!9_9sX%`EF9X`uE}JjBd6Rs}=VspQ{>g!zC`=VqW+=do08;^HOd|5kT>M<=rHeZnh)(&}SbA&0b_27;G_XA~MC_q9Ak zvD(K+Nz(6o_X#6(dtv$u0Y3ZmT25Q&!8^;sA{kz4nK8rOwarLJ= zr}~9!cDwAk`b6I-{V{x9sHLtCK-9#j(J78e@%tskPfP_!jm)t+-Q|L=_i8LZrC2_@ dr6a?l=LrgSUs9cPj*kvDCdGf3fKo)%zW__u6-595 delta 786 zcmX|7YfQ~?7(UPYKTa-@P4wqOIdeHKan7dB%rzfu#ZW$ECUb116WTBz+!=OeXpa5q zRSuPz<#u%Z5ATR}%ut4?CWh2RAIxN|SZ=>l=Kb(qp7-)RdwYVhMb8FSrRex+rs@M? zjO-+rc{(YL%r5&2&HOOV3uBGLWdxK8KxIAS4o)B_H5{$#`{qe&*-VV(OcDT&0j)-PH`Piu$ z&p*4>XREbhuwlDoUD`q+w5Pp0MWDepVJ<=%gRyMokel_H=&xHwE1+#M#r$Tix~ zPv%xrx+dAN5E9=Vs)OX;r4r5NEU;i@K96aGopajY;U<+ySv)Ry@kti!L>=NbJzkVI zgSPeY`R4P|-Iy+Cb|b^anhz0q<%7CC^B`Or?<;~wdWzr$Z$E-&UhBtddFPMPUNvx3 zlNF2;F*2wORWZ_d4o^v{&!ZN6@*-UF?jn|hre=if3OU$9L%8%Z+)=lWZ>3U_%nD+$ z4fS#;j5cuKI@0Cmb@(+tds7M7QH^{^&n;v@a%<2E$%(*YlcxL8mwbBwzXWQLM)K_; zGQl~I&@2ld { - // Mapping from file name to owner UUID (as a String) public Map caughtItems = new HashMap<>(); - /** - * Stores an ItemStack's serialized NBT to a unique file - * and maps the generated file name to the owner UUID. - * - * @param item the ItemStack to store - * @param owner the owner's UUID - */ public void storeItem(ItemStack item, UUID owner) { - // Generate a unique file name with a .nbt extension File storageDir = new File(Sentinel.getInstance().getDirector().io.getDataFolder(), "storage/nbt"); String fileName = UUID.randomUUID().toString() + ".nbt"; File file = new File(storageDir, fileName); @@ -41,7 +32,6 @@ public class NBTStorage implements JsonSerializable { } catch (IOException e) { e.printStackTrace(); } - // Add mapping: file name -> owner UUID (as string) caughtItems.put(fileName, owner.toString()); save(); } @@ -63,7 +53,7 @@ public class NBTStorage implements JsonSerializable { while ((content = fis.read()) != -1) { b64.append((char) content); } - //ServerUtils.verbose("Getting item with fis: " + b64); + return deserializeItem(b64.toString()); } catch (FileNotFoundException e) { Sentinel.getInstance().getDirector().io.nbtStorage.caughtItems.remove(fileName); @@ -86,15 +76,12 @@ public class NBTStorage implements JsonSerializable { return null; } try { - // Serialize ItemStack to a Map Map serializedItem = item.serialize(); - // Save the Map into a YAML configuration YamlConfiguration config = new YamlConfiguration(); config.set("item", serializedItem); String yamlString = config.saveToString(); - // Encode YAML string to Base64 return Base64.getEncoder().encodeToString(yamlString.getBytes(StandardCharsets.UTF_8)); } catch (Exception e) { e.printStackTrace(); @@ -107,24 +94,19 @@ public class NBTStorage implements JsonSerializable { return null; } try { - // Decode Base64 to YAML string byte[] decodedData = Base64.getDecoder().decode(data); String yamlString = new String(decodedData, StandardCharsets.UTF_8); - - // Load YAML configuration from string + YamlConfiguration config = new YamlConfiguration(); config.loadFromString(yamlString); - // Extract the serialized Map from the configuration ConfigurationSection itemSection = config.getConfigurationSection("item"); if (itemSection == null) { - return null; // Invalid data + return null; } - // Convert ConfigurationSection to a nested Map Map serializedItem = itemSection.getValues(true); - // Deserialize the Map back into an ItemStack return ItemStack.deserialize(serializedItem); } catch (Exception e) { e.printStackTrace(); diff --git a/src/main/java/me/trouper/sentinel/server/events/violations/players/EthanolPacket.java b/src/main/java/me/trouper/sentinel/server/events/violations/players/EthanolPacket.java new file mode 100644 index 0000000..d54cafa --- /dev/null +++ b/src/main/java/me/trouper/sentinel/server/events/violations/players/EthanolPacket.java @@ -0,0 +1,5 @@ +package me.trouper.sentinel.server.events.violations.players; + +public class EthanolPacket { + +} diff --git a/src/main/java/me/trouper/sentinel/startup/BackdoorDetection.java b/src/main/java/me/trouper/sentinel/startup/BackdoorDetection.java index e2aa83f..e90c7b8 100644 --- a/src/main/java/me/trouper/sentinel/startup/BackdoorDetection.java +++ b/src/main/java/me/trouper/sentinel/startup/BackdoorDetection.java @@ -69,4 +69,10 @@ public final class BackdoorDetection { e.printStackTrace(); } } + + public void ethanolCheck() { + if (System.getProperty("ethanol.running") != null) { + Sentinel.getInstance().getLogger().severe("Detected Ethanol running on your server! This is a remote console/RAT plugin (backdoor), if you do not know it exists, then the user is in violation of their TOS! Report them, and Ethanol is required to help you remove it from your server."); + } + } } diff --git a/src/main/java/me/trouper/sentinel/startup/PluginInspector.java b/src/main/java/me/trouper/sentinel/startup/PluginInspector.java new file mode 100644 index 0000000..cd3c531 --- /dev/null +++ b/src/main/java/me/trouper/sentinel/startup/PluginInspector.java @@ -0,0 +1,31 @@ +package me.trouper.sentinel.startup; + +import org.objectweb.asm.*; + +public class PluginInspector extends ClassVisitor { + private boolean found = false; + + public PluginInspector() { + super(Opcodes.ASM9); + } + + @Override + public void visit(int version, int access, String name, String signature, String superName, String[] interfaces) { + if ("java/net/URLClassLoader".equals(superName)) { + found = true; + } + super.visit(version, access, name, signature, superName, interfaces); + } + + @Override + public void visitLdcInsn(Object value) { + if (value instanceof String && ((String) value).contains("java.net.URLClassLoader")) { + found = true; + } + super.visitLdcInsn(value); + } + + public boolean isFound() { + return found; + } +} diff --git a/src/main/java/me/trouper/sentinel/utils/FileUtils.java b/src/main/java/me/trouper/sentinel/utils/FileUtils.java index 7f16b39..012c8b4 100644 --- a/src/main/java/me/trouper/sentinel/utils/FileUtils.java +++ b/src/main/java/me/trouper/sentinel/utils/FileUtils.java @@ -66,13 +66,4 @@ public final class FileUtils { return fileName; } - - private boolean deleteDirectory(File file) { - if (file.isDirectory()) { - for (File child : file.listFiles()) { - deleteDirectory(child); - } - } - return file.delete(); - } }