Jump to content

Recommended Posts

Posted

I think it will need a small addaption to l2j or the pack that you use..I found that on a russian forum .

39794700.png

 

 

 


SecondaryPasswordAuth.java

package l2p.gameserver.network;

import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.util.Calendar;
import java.util.logging.Level;
import java.util.logging.Logger;

import jonelo.sugar.util.Base64;
import l2p.commons.dbutils.DbUtils;
import l2p.gameserver.Config;
import l2p.gameserver.database.DatabaseFactory;
import l2p.gameserver.model.Player;
import l2p.gameserver.network.GameClient;
import l2p.gameserver.serverpackets.Ex2ndPasswordAck;
import l2p.gameserver.serverpackets.Ex2ndPasswordCheck;
import l2p.gameserver.serverpackets.Ex2ndPasswordVerify;
import l2p.gameserver.utils.Log;
import l2p.gameserver.utils.Util;

public class SecondaryPasswordAuth
{
private final Logger _log = Logger.getLogger(SecondaryPasswordAuth.class.getName());
private final GameClient _activeClient;

private String _password;
private int _wrongAttempts;
private boolean _authed;

private static final String VAR_PWD = "secauth_pwd";
private static final String VAR_WTE = "secauth_wte";

private static final String SELECT_PASSWORD = "SELECT var, value FROM character_secondary_password WHERE account_name=? AND var LIKE 'secauth_%'";
private static final String INSERT_PASSWORD = "INSERT INTO character_secondary_password VALUES (?, ?, ?)";
private static final String UPDATE_PASSWORD = "UPDATE character_secondary_password SET value=? WHERE account_name=? AND var=?";
private static final String INSERT_ATTEMPT = "INSERT INTO character_secondary_password VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value=?";
// private static final String BAN_ACCOUNT = "UPDATE accounts SET banExpires=? WHERE login=?";

/**
* @param activeClient
*/
public SecondaryPasswordAuth(GameClient activeClient)
{
_activeClient = activeClient;
_password = null;
_wrongAttempts = 0;
_authed = false;
loadPassword();
}

private void loadPassword()
{
String var, value = null;

Connection con = null;
PreparedStatement statement = null;
ResultSet rset = null;
try
{
con = DatabaseFactory.getInstance().getConnection();
statement = con.prepareStatement(SELECT_PASSWORD);
statement.setString(1, _activeClient.getLogin());
ResultSet rs = statement.executeQuery();
while(rs.next())
{
var = rs.getString("var");
value = rs.getString("value");

if(var.equals(VAR_PWD))
_password = value;
else if(var.equals(VAR_WTE))
_wrongAttempts = Integer.parseInt(value);
}
statement.close();
}
catch(Exception e)
{
_log.log(Level.SEVERE, "Error while reading password.", e);
}
finally
{
DbUtils.closeQuietly(con, statement, rset);
}
}

public boolean savePassword(String password)
{
if(passwordExist())
{
_log.warning("[secondaryPasswordAuth]" + _activeClient.getLogin() + " forced savePassword");
_activeClient.closeNow(true);
return false;
}

if(!validatePassword(password))
{
_activeClient.sendPacket(new Ex2ndPasswordAck(Ex2ndPasswordAck.WRONG_PATTERN));
return false;
}

password = cryptPassword(password);

Connection con = null;
PreparedStatement statement = null;
ResultSet rset = null;
try
{
con = DatabaseFactory.getInstance().getConnection();
statement = con.prepareStatement(INSERT_PASSWORD);
statement.setString(1, _activeClient.getLogin());
statement.setString(2, VAR_PWD);
statement.setString(3, password);
statement.execute();
statement.close();
}
catch(Exception e)
{
_log.log(Level.SEVERE, "Error while writing password.", e);
return false;
}
finally
{
DbUtils.closeQuietly(con, statement, rset);
}
_password = password;
return true;
}

public boolean insertWrongAttempt(int attempts)
{
Connection con = null;
PreparedStatement statement = null;
ResultSet rset = null;
try
{
con = DatabaseFactory.getInstance().getConnection();
statement = con.prepareStatement(INSERT_ATTEMPT);
statement.setString(1, _activeClient.getLogin());
statement.setString(2, VAR_WTE);
statement.setString(3, Integer.toString(attempts));
statement.setString(4, Integer.toString(attempts));
statement.execute();
statement.close();
}
catch(Exception e)
{
_log.log(Level.SEVERE, "Error while writing wrong attempts.", e);
return false;
}
finally
{
DbUtils.closeQuietly(con, statement, rset);
}
return true;
}

public boolean changePassword(String oldPassword, String newPassword)
{
if(!passwordExist())
{
_log.warning("[secondaryPasswordAuth]" + _activeClient.getLogin() + " forced changePassword");
_activeClient.closeNow(true);
return false;
}

if(!checkPassword(oldPassword, true))
return false;

if(!validatePassword(newPassword))
{
_activeClient.sendPacket(new Ex2ndPasswordAck(Ex2ndPasswordAck.WRONG_PATTERN));
return false;
}

newPassword = cryptPassword(newPassword);

Connection con = null;
PreparedStatement statement = null;
ResultSet rset = null;
try
{
con = DatabaseFactory.getInstance().getConnection();
statement = con.prepareStatement(UPDATE_PASSWORD);
statement.setString(1, newPassword);
statement.setString(2, _activeClient.getLogin());
statement.setString(3, VAR_PWD);
statement.execute();
statement.close();
}
catch(Exception e)
{
_log.log(Level.SEVERE, "Error while reading password.", e);
return false;
}
finally
{
DbUtils.closeQuietly(con, statement, rset);
}
_password = newPassword;
_authed = false;
return true;
}

public boolean checkPassword(String password, boolean skipAuth)
{
password = cryptPassword(password);

if(!password.equals(_password))
{
_wrongAttempts++;
if(_wrongAttempts < Config.SECOND_AUTH_MAX_ATTEMPTS)
{
_activeClient.sendPacket(new Ex2ndPasswordVerify(Ex2ndPasswordVerify.PASSWORD_WRONG, _wrongAttempts));
insertWrongAttempt(_wrongAttempts);
}
else
{
if(Config.SECOND_AUTH_BAN_ACC)
banAccount(_activeClient.getActiveChar());
Log.add(_activeClient.getLogin() + " - (" + _activeClient.getIpAddr() + ") has inputted the wrong password " + _wrongAttempts + " times in row.", "banned_accounts");
insertWrongAttempt(0);
_activeClient.close(new Ex2ndPasswordVerify(Ex2ndPasswordVerify.PASSWORD_BAN, Config.SECOND_AUTH_MAX_ATTEMPTS));
}
return false;
}
if(!skipAuth)
{
_authed = true;
_activeClient.sendPacket(new Ex2ndPasswordVerify(Ex2ndPasswordVerify.PASSWORD_OK, _wrongAttempts));
}
insertWrongAttempt(0);
return true;
}

private void banAccount(Player plyr)
{
long banTime = Config.SECOND_AUTH_BAN_TIME;

try
{
plyr.setAccessLevel(-100);
ban(plyr, banTime);
plyr.kick();
}
catch(Exception e)
{
_log.log(Level.SEVERE, "Error while banning account.", e);
}
}

private void ban(Player actor, long time)
{
long date = Calendar.getInstance().getTimeInMillis();
long endban = date / 1000 + time * 60;
String msg = "Secondary Password Auth ban Player" + actor.getName() + " on " + time + " sec";

Connection con = null;
PreparedStatement statement = null;
try
{
con = DatabaseFactory.getInstance().getConnection();
statement = con.prepareStatement("INSERT INTO bans (account_name, obj_id, baned, unban, reason, GM, endban) VALUES(?,?,?,?,?,?,?)");
statement.setString(1, actor.getAccountName());
statement.setInt(2, actor.getObjectId());
statement.setString(3, "SU");
statement.setString(4, "SU");
statement.setString(5, msg);
statement.setString(6, "SU");
statement.setLong(7, endban);
statement.execute();
}
catch(Exception e)
{
_log.warning("could not store bans data:" + e);
}
finally
{
DbUtils.closeQuietly(con, statement);
}
}

public boolean passwordExist()
{
return _password == null ? false : true;
}

public void openDialog()
{
if(passwordExist())
_activeClient.sendPacket(new Ex2ndPasswordCheck(Ex2ndPasswordCheck.PASSWORD_PROMPT));
else
_activeClient.sendPacket(new Ex2ndPasswordCheck(Ex2ndPasswordCheck.PASSWORD_NEW));
}

public boolean isAuthed()
{
return _authed;
}

private String cryptPassword(String password)
{
try
{
MessageDigest md = MessageDigest.getInstance("SHA");
byte[] raw = password.getBytes("UTF-8");
byte[] hash = md.digest(raw);
return Base64.encodeBytes(hash);
}
catch(NoSuchAlgorithmException e)
{
_log.severe("[secondaryPasswordAuth]Unsupported Algorythm");
}
catch(UnsupportedEncodingException e)
{
_log.severe("[secondaryPasswordAuth]Unsupported Encoding");
}
return null;
}

private boolean validatePassword(String password)
{
if(!Util.isDigit(password))
return false;

if(password.length() < 6 || password.length() > 
return false;

if(Config.SECOND_AUTH_STRONG_PASS)
{
for(int i = 0; i < password.length() - 1; i++)
{
char curCh = password.charAt(i);
char nxtCh = password.charAt(i + 1);

if(curCh + 1 == nxtCh)
return false;
else if(curCh - 1 == nxtCh)
return false;
else if(curCh == nxtCh)
return false;
}
for(int i = 0; i < password.length() - 2; i++)
{
String toChk = password.substring(i + 1);
StringBuffer chkEr = new StringBuffer(password.substring(i, i + 2));

if(toChk.contains(chkEr))
return false;
else if(toChk.contains(chkEr.reverse()))
return false;
}
}
_wrongAttempts = 0;
return true;
}
}


 

Config.java

 

find that

 

HTM_CACHE_MODE

 

and add bellow

public static boolean SECOND_AUTH_ENABLED;
public static boolean SECOND_AUTH_BAN_ACC;
public static boolean SECOND_AUTH_STRONG_PASS;
public static int SECOND_AUTH_MAX_ATTEMPTS;
public static long SECOND_AUTH_BAN_TIME;
public static String SECOND_AUTH_REC_LINK;

 

after find that

 

HTM_CACHE_MODE = serverSettings.getProperty("HtmCacheMode", HtmCache.LAZY);

 

 

and add bellow

SECOND_AUTH_ENABLED = serverSettings.getProperty("SAEnabled", false);
SECOND_AUTH_BAN_ACC = serverSettings.getProperty("SABanAccEnabled", false);
SECOND_AUTH_STRONG_PASS = serverSettings.getProperty("SAStrongPass", false);
SECOND_AUTH_MAX_ATTEMPTS = serverSettings.getProperty("SAMaxAttemps", 5);
SECOND_AUTH_BAN_TIME = serverSettings.getProperty("SABanTime", 480);
SECOND_AUTH_REC_LINK = serverSettings.getProperty("SARecoveryLink", "http://www.my-domain...harPassRec.php");

 


 

open Util.java go to the bottom and insert

 

Public static Boolean isdigit (String text) 
{ 
if (text == null | | text.isEmpty ()) 
return false; 
for (char C: text.toCharArray ()) 
if (! Character.isDigit ©) 
return false; 
return true ; 
} 
}

 


 

open server.properties and add

 

# ============================ ============ 
# Settings to set a password on your character SA (Secondary Auth) 
# Pre-include this option in the client (UseSecondaryAuth = true) 
# ============== ========================== 
# include whether the system SA 
SAEnabled = True 
# ban account after a user has exceeded the number of password attempts? 
SABanAccEnabled = True 
# Enhanced password system, combined with the odd even sure! 
SAStrongPass = False 
# The maximum number of password attempts 
SAMaxAttemps = 5 
# Banlength Chara for failure password (min) 
SABanTime = 480
# link to the password recovery page 
SARecoveryLink = http://www . My-Domain ... charPassRec.php
# ======================================= = 

 


 

SQL Part

 

DROP TABLE IF EXISTS `character_secondary_password`; 
CREATE TABLE `character_secondary_password` ( 
  `account_name` VARCHAR (45) NOT NULL DEFAULT'', 
  `var` VARCHAR (20) NOT NULL DEFAULT'', 
  `value` VARCHAR (255), 
  PRIMARY KEY (account_name ``, `var`) 
) ENGINE = MyISAM DEFAULT CHARSET = utf8;

 

credits : kick

Posted

thats looks great i will test it right now man ! thanks for share

 

also fix this line in your config's

 

# Banlength Chara for failure password (min)

= 480 SABanTime

 

i think this must be like

 

# Banlength Chara for failure password (min)

SABanTime = 480

Posted

thats looks great i will test it right now man ! thanks for share

 

also fix this line in your config's

 

# Banlength Chara for failure password (min)

= 480 SABanTime

 

i think this must be like

 

# Banlength Chara for failure password (min)

SABanTime = 480

fixed topic updated
  • 9 months later...
Posted

make it for interlude and send me from message :P

 

OKAY BOSS, NOW IM GONNA DECOMPILE INTERLUDE CLIENT AND CREATE THIS PACKET FOR YOU, GIMME A SEC PLZ

Guest
This topic is now closed to further replies.



  • Posts

    • Since technical talk offends people, I believe I should return back to writting my Lineage 2 lore stories. Here's the next one:   Once upon a time, there was a boy and a small adorable wolf.    The boy really loved the wolf but as the wolf grow older and bigger, it became agressive and would bite the boy. One day the boy and the wolf decided to go to the city to buy potions. The road was long and hilly so the boy moved all his adena to the wolf bags to help his legs and reach the city easier.   When they reached the city, the boy tried to take the adena out of the wolf's bags. But the wolf would not ! He bit the boy and said "You will not get this adena back, this is my adena". The boy got angry. He decided to go to the pet master and ask for help.    "Pet master, pet master ! My wolf is big, bad and angry and it won't obey me. I want my adena back and it bites me. "   The pet master looked at the big angry wolf, then looked at the boy and said. "I have a solution for your problem young one. I have magic. Dark magic. I can turn your big bad elder wolf into a younger puppy for free, all you have to do is spell the magic chants. Nothing more, no wolf modifying wands, just your say".   The boy thought about it for a bit, and decided that he indeed wanted to turn things back. But when he was about to spell the magic words, guards arrived at the pet master.    The city guard captain said "Is this the big bad angry wolf that bites people and doesn't give back his adena ? We will kill this wolf !"    For a moment the boy hesitated but he said "This wolf is big bad and angry, but I love this wolf and I dont want it to die ! Please don't kill the big bad angry wolf." But the boy was not fast enough. The guards jumped the wolf and started slashing on him with their swords. The boy didn't know what to do, so in it its final moments right as the wolf was about to die, it spelled the magic words. "Pet master, make my wolf young and adorable again !"   But he was not fast enough. The wolf got slashed and killed by the guards just one moment before the boy could finish his last word.    But as the words came out of his mouth, with the wolf's dead body on the floor, a younger wolf manifested out of thin air. The magic was real. The guards got scared and run away. Now the boy was left with a dead old bad angry wolf and next to him an alive younger version.    The boys joy was even bigger when it opened the new wolfs bags and his adena was finally there. He took the adena and went back to buy potions in the city.   Twenty four hours later, the boy couldn't believe how his fortune would change ...   (No AI was used to write this story)
    • This is like 2017 MaxCheaters. i love it.
    • NEW SEASON GRAND OPENING FROM - 30 OCTOBER 2026, FRIDAY, 20:00 +2 GMT !
    • My bug report was a proper submission. I shouldn't have shown the exploit, I will accept that. Let's end it here. 
    • To Finish this, because it's need a explanation   1. “I come to your forum” — It's the L2JMobius forum, not mine. I'm a contributor, not the owner or the maintainer responsible for deciding which fixes get committed.   2. “Which is why I left” — That's not an accurate account of what happened. You may have left voluntarily once, but you were also banned from the Discord server three times after repeatedly returning and causing the same disruptions. Those are not the same thing.   3. “You personally reply and reject that it works” — I asked how a negative withdrawal could be performed and later requested a demonstration of the claimed exploit. At no point did I reject the patch or claim the vulnerability was impossible. Asking for evidence is not the same as rejecting someone's work.   4. “You leave it unpatched for days” — I don't make that decision. Whether and when a patch gets committed is entirely up to the project maintainer, not me.   5. “You challenge me to post a video” — Yes, I asked you to demonstrate the exploit. You interpreted that as a rejection of your work, which it wasn't. Requesting proof of a claimed exploit is a perfectly reasonable part of technical discussion.   6. “Asshole-ness is a mutually contracted disease” — You're responsible for your own behavior, just as I'm responsible for mine. Disagreeing with you or questioning your claims doesn't justify personal insults. If you believe I've treated you unfairly, address what I actually said rather than making my behavior an excuse for yours.   And one question remains unanswered: why did you publicly disclose the exploitationmethod before the fix was released, after previously saying you wanted to avoid harming the project?   The vulnerability was real, the fix was accepted, and the commit was published. I have no problem acknowledging any of that.   My disagreement has never been about whether the bug deserved to be fixed. It's about how you've handled the discussion and repeatedly misrepresented my role in it.     I have nothing against you personally. My issue is with the way you conduct yourself in these discussions.   And no, you're not obligated to prove anything to me. However, when you make a technical claim, the burden of proof is on you. You cannot reasonably expect others to accept your claims without sufficient evidence.   Questioning a claim is not the same as rejecting it, nor is it a personal attack.   This isn’t about fanaticism; it’s about pushing back against the completely senseless attacks constantly leveled at the project as a whole.   It’s always the same thing: they badmouth it, claiming the project is worthless—yet the very same people criticizing it are the first in line to download a leaked version.   Enough is enough. This discussion has dragged on far too long over something that ought to be straightforward; if you’re going to submit a bug report, you should at least do it properly.
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..