Minecraft-Backdoor icon indicating copy to clipboard operation
Minecraft-Backdoor copied to clipboard

Backdoor spreading failed

Open PerchunPak opened this issue 2 years ago • 17 comments

[20:10:39 ERROR]: Error occurred while enabling ChatEx v2.7.1 (Is it up to date?)
java.lang.NoClassDefFoundError: javassist/DirClassPath
        at javassist.ClassPoolTail.makePathObject(ClassPoolTail.java:267) ~[?:?]
        at javassist.ClassPoolTail.appendClassPath(ClassPoolTail.java:249) ~[?:?]
        at javassist.ClassPool.appendClassPath(ClassPool.java:1004) ~[?:?]
        at com.thiccindustries.debugger.Injector.patchFile(Injector.java:146) ~[?:?]
        at com.thiccindustries.debugger.Debugger.<init>(Debugger.java:70) ~[?:?]
        at de.jeter.chatex.ChatEx.onEnable(ChatEx.java:57) ~[?:?]
        at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:264) ~[kSpigot.jar:git-Paper-33d42c8e]
        at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:316) ~[kSpigot.jar:git-Paper-33d42c8e]
        at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:405) ~[kSpigot.jar:git-Paper-33d42c8e]
        at org.bukkit.craftbukkit.v1_12_R1.CraftServer.enablePlugin(CraftServer.java:395) ~[kSpigot.jar:git-Paper-33d42c8e]
        at org.bukkit.craftbukkit.v1_12_R1.CraftServer.enablePlugins(CraftServer.java:344) ~[kSpigot.jar:git-Paper-33d42c8e]
        at net.minecraft.server.v1_12_R1.MinecraftServer.t(MinecraftServer.java:442) ~[kSpigot.jar:git-Paper-33d42c8e]
        at net.minecraft.server.v1_12_R1.MinecraftServer.l(MinecraftServer.java:403) ~[kSpigot.jar:git-Paper-33d42c8e]
        at net.minecraft.server.v1_12_R1.MinecraftServer.a(MinecraftServer.java:341) ~[kSpigot.jar:git-Paper-33d42c8e]
        at net.minecraft.server.v1_12_R1.DedicatedServer.init(DedicatedServer.java:289) ~[kSpigot.jar:git-Paper-33d42c8e]
        at net.minecraft.server.v1_12_R1.MinecraftServer.run(MinecraftServer.java:616) ~[kSpigot.jar:git-Paper-33d42c8e]
        at java.lang.Thread.run(Unknown Source) [?:1.8.0_311]
Caused by: java.lang.ClassNotFoundException: javassist.DirClassPath
        at java.net.URLClassLoader.findClass(Unknown Source) ~[?:1.8.0_311]
        at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:156) ~[kSpigot.jar:git-Paper-33d42c8e]
        at org.bukkit.plugin.java.PluginClassLoader.findClass(PluginClassLoader.java:104) ~[kSpigot.jar:git-Paper-33d42c8e]
        at java.lang.ClassLoader.loadClass(Unknown Source) ~[?:1.8.0_311]
        at java.lang.ClassLoader.loadClass(Unknown Source) ~[?:1.8.0_311]
        ... 17 more

PerchunPak avatar Nov 30 '21 18:11 PerchunPak

Looks like a class from the javassist library that needs to be added to the resource paths in Injector.java.

I added all the ones needed on my end, maybe that one is only needed on windows?

Either way, that should fix it.

MajesticWaffle avatar Nov 30 '21 18:11 MajesticWaffle

So I tried reproduce it with debug messages, and seems like it is because plugin doesn't delete files after first patch, which ended with exception (example "File already in process") Maybe it isn't good idea to replace patched files while server running, I need more read about how plugins auto update it self.

PerchunPak avatar Nov 30 '21 19:11 PerchunPak

Full log https://pastebin.com/TBtBNuhP Interesting that error NoClassDefFoundError raises every time with different class

PerchunPak avatar Nov 30 '21 19:11 PerchunPak

Okay, I read. As I understand, auto update works because plugin didn't initialize fully. But backdoor trying replace plugins which already fully initialized. All what you can do as I understand, it is add "Yes|No inject in other plugins" menu when injecting plugin, and then try to find system that will replace plugins jars after their stop or like this.

PerchunPak avatar Nov 30 '21 19:11 PerchunPak

Merged and released as Version 2.1

MajesticWaffle avatar Dec 01 '21 00:12 MajesticWaffle

Doesn't fix issue with fail spreading thought server plugins, I only added switch to change this option.

PerchunPak avatar Dec 01 '21 15:12 PerchunPak

I'll leave this open for any other problems related to infection.

I also changed the option to warn that the feature is experimental.

MajesticWaffle avatar Dec 01 '21 16:12 MajesticWaffle

I'm guessing your specific problem is that on windows, different parts of the java assist library are needed.

Could you run java -Xlog:class+load=info:classloaded.txt -jar Backdoor-2.1.jar And inject a plugin (with infection enabled) and upload classloaded.txt (contains all classes loaded by the jvm)?

MajesticWaffle avatar Dec 01 '21 16:12 MajesticWaffle

Sorry for long time without answer

Unrecognized option: -Xlog:class+load=info:classloaded.txt
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.

PerchunPak avatar Jan 08 '22 08:01 PerchunPak

Oops, I was on Java 8. https://pastebin.com/dtLTfFsp

PerchunPak avatar Jan 08 '22 08:01 PerchunPak

With spreading enabled upon starting the server it fails to spread, and the plugin that was infected with the Injector does not work. This is the part of the plugins loading. https://pastebin.com/raw/U6kgDuLt The only plugins on the server are LuckPerms and ProtocolLib(infected). Both plugins work as if they were just downloaded, but neither seem to be infected

nullsoepic avatar May 02 '22 17:05 nullsoepic

@nullsoepic This is a certified "Im-a-dipshit" moment. will be fixed soon.

MajesticWaffle avatar May 03 '22 00:05 MajesticWaffle

@nullsoepic Should be fixed in v2.2.3

MajesticWaffle avatar May 03 '22 15:05 MajesticWaffle

image spreading doesn't work on windows? Temp folder created and these weird tmp files, but any jar doesn't contain any of backdoor files. When I open these temp files with 7zip I see backdoor package Log (I backdoored ProtocolLib) [19:29:56 INFO]: [ProtocolLib] [STDOUT] [Injector] Writing patched main class. [19:29:56 INFO]: [ProtocolLib] [STDOUT] [Injector] Finished writing file: TitleManager-2.3.6.jar [19:29:57 INFO]: [ProtocolLib] [STDOUT] Unknown IO error while copying new main class. [Ljava.lang.StackTraceElement;@5214e008 [19:29:57 INFO]: ## Backdoor ## Plugin 'ProtocolLib' has a Debugger installed.

erxson avatar Jun 26 '22 16:06 erxson

Full log (Latest release of backdoor, 1.19 Paper) https://paste.gg/p/anonymous/c00aef05ad254677ae1a9aacc97f8eb3/files/cae075bc83c94aab93bdbe2da07393c3/raw

erxson avatar Jun 26 '22 16:06 erxson

spreading doesn't work on windows?

Actually, spreading just doesn't work.

PerchunPak avatar Jun 26 '22 17:06 PerchunPak

Is it hard to unload plugin, before infecting?

erxson avatar Jun 26 '22 18:06 erxson