Jump to content
MaxCheaters Official Group at Discord
--> Place your ad text here <--

Trying some Funny Things with L2phx

ptitlaby
 Share

Recommended Posts

ptitlaby Apprentice

ptitlaby

Posted
Posted

Hello Men and Women

I'm trying to use L2phx since ... 4/5 minutes on a Lineage II Gracia Final Server.

 

My first aim is to "hack" their GMshop. This GMshop has been done with multisell, so I think it's possible to buy Oe'd item

So as soon as I buy an item (a Leather Helmet for Example) , I get this packet :

 

68 08 52 00 00 80 1A 06 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00

 

I tried to send this packet to the server, sucessfully ! I could buy item without being near the shop. Ok I know it's pretty useless but It's a begin =)

 

I want know to know how work this packet. I heard that 6th and 7th Group of Number/Letters (here : 80 1A) are for OE, but theses numbers are not null.

I tried to change others items,  What I found is how to buy item number 1,2,3,4 or 5 in the Multisell ^^

I found that the number in Yellow are the quantity ^^

 

So I would like to know what I must modify to buy item directly +3 for example (I just need +45621 to be roxxxor, just want to avoid farm =)

 

 

Link to comment
Share on other sites
  • 3 weeks later...
Nvidia Newbie

Nvidia

Posted
Posted

Well if you find a server that phx works you can take +64315 example byt his way :

 

you Buy something from gm shop a i will talk for a crystal dagger when you buy it you will see request multishell choise or multishell choise then you copy the code that will be at the right of you and paste it at send then copy 6th and 7th number go at advance and down there is something that says hex world and some other thing then you paste the 6th and 7th number at the right box and chose world then press this button < and you will take some numbers e.g. 5315 and if you want to get +100 you make 5315 + 100 with a calucation and you will find 5415 then press this button > and coppy the numbers that you will see then go at send and paste them at 6th and 7th number then press the button send and you will get +100 cyrstal dagger

Link to comment
Share on other sites
AlemanOtaku Newbie

AlemanOtaku

Posted
Posted

Well if you find a server that phx works you can take +64315 example byt his way :

 

you Buy something from gm shop a i will talk for a crystal dagger when you buy it you will see request multishell choise or multishell choise then you copy the code that will be at the right of you and paste it at send then copy 6th and 7th number go at advance and down there is something that says hex world and some other thing then you paste the 6th and 7th number at the right box and chose world then press this button < and you will take some numbers e.g. 5315 and if you want to get +100 you make 5315 + 100 with a calucation and you will find 5415 then press this button > and coppy the numbers that you will see then go at send and paste them at 6th and 7th number then press the button send and you will get +100 cyrstal dagger

 

its not like that, the numbers you get in the packet on phx are in hex, how you now to exactly buy a +16 weapon (or w/e)

 

take the 6th and 7th number, in example, 64 27 (Hex numbers)

convert them to decimal (25639)

you want +16 weapon? 25639 (decimal number of the packet) + 16 (the enchant you want) =  25655

now convert this decimal number to hex again = 6437

replace the old hex number with the new (64 27 old, 6437 new)

send the packet

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing


  • Posts

    • L2LIVEpro
      L2jOrion - Sourcecode.

      By L2LIVEpro · Posted

      Well, sorry not sorry for resurrecting old topic, but I believe it's ultimately stupid to implement license checks like Vilmis did 🙂   private static String url = "jdbc:mysql://185.80.128.233/" + getData("Zm9ydW1fZGI="); private static String username = getData("bXJjb3B5cmlnaHQ="); private static String password = getData("Y29weXJpZ2h0XzEyMw=="); con = GlobalDB.getInstance().getConnection(); PreparedStatement statement; statement = con.prepareStatement("SELECT field_6 from core_pfields_content WHERE member_id = ?"); statement.setInt(1, Config.FORUM_USER_ID); ResultSet rset = statement.executeQuery();   This awesome way of coding things leaves us with base64-encoded credentials and DB exposed and accessible globally 😉 Btw he checks his licensing data from some plugin generated table his forum uses. Vilmis took action and ensured that mrcopyright user would have only needed accesses and rights for this operation. But he forgot to ensure that his INFORMATION_SCHEMA database would not be exposed and readable... That leads us to fully readable server variables like version used (10.1.26-MariaDB-0+deb9u1 - pretty ancient DB and OS, I'd assume). From here you can go south and do some kinky stuff, if you want and have knowledge for that. But who cares, right?   Ooh, table core_pfields_content field_6 is IP address which is checked by FORUM_USER_ID. Yep, you can query all IP addresses there (124 of them right now) and also do whatever you want with them! 🙂  The most fun part? Files source has been shared what, more than 2 years ago?  Vilmis still uses very same credentials and never changed it after sources exposure - who cares. Although, "sources" may be way too strong word here. If anyone still use paid Orion versions, I'd suggest packing your shit and leaving immediately, or at least fix this incompetent fool caused problems. It's obvious Vilmis don't care or maybe doesn't even know from the first place how to solve this problem (hint hint - tiny PHP Rest API microservice which would do absolutely the same but without exposing sensitive data?). By doing that, he exposes his infrastructure and YOUR data, and he does that for more than 2 years now 🙂 Developer of century!    
    • lol021
      ⭐ LIST OF FORUMS FOR YOUR NEEDS ⭐ [OVER 100 RUSSIAN FORUMS]

      By lol021 · Posted

      discord please   
    • Finn
      Help with folder system!

      By Finn · Posted

      rename the l2.bin into l2.exe
    • L2LIVEpro
      [L2j] L2LIVE

      By L2LIVEpro · Posted

      L2LIVE.PRO- Dynamic Mid-rates Essence Seven Signs GRAND OPENING - July 5, 20:00 GMT+3 (EEST) TEST SERVER IS OPEN - COME AND CHECK IT OUT TODAY! Join our community and be part of it at: https://www.l2live.pro https://discord.gg/k3NMgR4Dmu   Server description * EXP/SP: Dynamic (x1- x100 based on your level, *before* Sayha and EXP buffs * Adena: x50 / Item Drop: x10 / Fishing EXP increased / Attribute EXP increased * Simplified gameplay to stay in the loop while not spending hours and hours farming * Starter Pack containing very useful items for beginners * MP replenishing potions with auto-consumption * No overpowered donations L2LIVE shop * All spellbook coupons, pet spellbook coupons and master books are sold via Game Assistant * Additionally you can buy SP pouches, enchanted talismans, pet training guides and various other consumables for Adena and L-Coin * More items such as cloaks, more talismans, agathions, belts, pendants, enchantment scrolls of various grades, evolution stones, etc will be added! Shop server as a shortcut, and all retail-like ways of earning items are still here! L-Coins * Drops with small change and in random amounts from Lv60+ monsters  * All raidbosses drop random amount of L-Coin Pouches generating up to 420 Lcoin per unit. **Grand Olympiad and Events** * Grand Olympiad is held week day * Format is 1v1, unlimited weekly fights  * Heroes are declared weekly at Sunday * There are three automated events - TvT, CTF and Deathmatch, running at evenings * Orc Fortress, Battle with Balok, Keber Hunter, Archievements Box, Daily Gift Calendar provisional events are active too Custom user commands * .offlineplay command, your character will keep playing till death or server restart * .offlineshop command, keeps your shop sitting until all items are purchased * .apon / .apoff - enable/disable HP/MP autoconsume And lots of other small improvements are waiting for you!   Join our community and be part of it at: https://www.l2live.pro https://discord.gg/k3NMgR4Dmu
    • milozare
      ⭐ LIST OF FORUMS FOR YOUR NEEDS ⭐ [OVER 100 RUSSIAN FORUMS]

      By milozare · Posted

      Relevant! List of forums on sale! Contact us!

  • Topics

×
×
  • Create New...