Holo security fix #2
Good evening habboons! You are lucky today, thanks to good ole Niggus + Aaron from ForceHotel.com, another SQL vulnerability in the emulator was detected. Well, actually ‘thanks’ to the scriptkiddies that tried to abuse it…
We were discussing the weak security of running MySQL under it’s almighty root account, and after I told him to create a limited account and disable file functions etc for it, errors showed up in the server log. A scriptkiddie was using this SQL vulnerability in an attempt to create a new database table, but was caught in the act: he failed to use it properly thus leading into errors in the server log, notifying Aaron of a SQL exploit. Congratulations, the ‘I failed at haxing’-award goes out to you. 
This is a SQL vulnerability, which allows badguys to execute any SQL query that they want at your database. This includes modifying data, but, under an insecure server setup, creation of new files in the filesystem like shells etc: so they can take over your server and stuff! Bad times! How to fix?
1) Open up virtualUser.cs of the emulator sourcecode
2) Search for:
dbClient.runQuery(“UPDATE users_badges SET slotid = ‘” + slotID + “‘ WHERE userid = ‘” + this.userID + “‘ AND badgeid = ‘” + Badge + “‘ LIMIT 1″); // update slot
replace it with…
dbClient.AddParamWithValue(“badge”, Badge);
dbClient.runQuery(“UPDATE users_badges SET slotid = ‘” + slotID + “‘ WHERE userid = ‘” + this.userID + “‘ AND badgeid = @badge LIMIT 1″); // update slot
3) Save and recompile
Woop, another SQL vulnerability patch. Provided free of charge by Pvt. Nillus, with help from ForceHotel and a noob scripter.
Another tip: don’t use MySQL’s root user for your private server: it’s not safe. Create a limited account like ‘holo_user’, and only give it access to SELECT, UPDATE, INSERT, DELETE. Then configure your emulator and CMS to use this account. This prevents them from using the file functions, incase they find a SQL exploit. Good evening boons, and stay safe. 
Don’t forget to apply the previously published fix too, it’s another SQL vulnerability in the emulator: click here for the other patch
Also, if you are feeling generous: you can always donate to me with PayPal. Any amount is welcome, I have never charged money for my work so any amount is welcome. Thank you!
Also: Angelo check it out.
Thanks for this. I’ve been making adjustments like this for awhile now thanks to Jordan tipping me off a couple weeks ago. Glad ForceHotel and you managed to figure this one out, because I was nowhere near patching that up with Params.
I’m glad to help out.
Thanks for calling me a n00bscripter :@
- Martin
When you give a man power his true self shows or so when the man finds the power Destruction occurs.
Ik praat maar even Nederlands omdat ik weet dat je een Nederlander ben.
Zoals je ziet is op leethotel.com jouw naam weg gehaald.
Thanks in advance.
When i updated my server with this fix, all of the badges at the hotel didnt work anymore. Can you help me?:)
I Fixed that SQL vulnerability ! After compiling , i saw 41 Error .
Is That Normal ?
I think the SQL Patch should be re-writen .
Special thanks to Nillus .
Hola nillus era para preguntarte si podrias ayudarme en algunas cosas quiero hacer Emulador yo tengo vb 2010 express seria increible que me ayudaras por favor te he seguido siempre desde USA111 hasta ahora por favor responde
By Pablo
Si escribi algo mal es que no se escribir muy bien el ingles
Hello nillus was to ask if you could help me in some things I want to do emulator I have vb 2010 express would be awesome to help me please I have followed ever since USA111 so far please reply
By Paul
If I wrote something wrong is that you write very good English
sorry the comment above
Escuchar
Leer fonéticamente
Dear Pablo,
Nillus’s work with Habbo Hotel private servers has been stopped.
He don’t help you with your Habbo Hotel private server.
He help you for money I think?
Sorry for my bad English.
I am from The Netherlands.
engelish:
hello nillus,
can you please upload youre java blunk framework again?
dutch:
hoi nillus,
kan je a.u.b jouw java blunk framework opnieuw uploaden
ik wil daar mee een v54+ habbo server gaan maken,
ik hou natuurlijk wel de copyrigts van jou er in!
Great Nils,
You may be Retired, but you doing good work.
But still you are stingy
Later Nils.
Money Making Guide…
If you want a good to check good money making guide and want to learn how to make money on internet then check out my site….
mods…
Just so you know, I linked to this great blog on my site…
[...]Sites of interest we have a link to[...]……
[...]usually posts some very interesting stuff like this. If you’re new to this site[...]……
[...]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[...]……
[...]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[...]……
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
[...]the time to read or visit the content or sites we have linked to below the[...]……
[...]here are some links to sites that we link to because we think they are worth visiting[...]……
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
[...]Sites of interest we have a link to[...]……
[...]usually posts some very interesting stuff like this. If you’re new to this site[...]……
Know the way much you might be keen to spend…
There are different ways to get great discounts. In case you are in the army, a senior citizen or a member of an organization resembling AAA, you will find that there are a lot of reductions out there to you….
[...]the time to read or visit the content or sites we have linked to below the[...]……
[...]here are some links to sites that we link to because we think they are worth visiting[...]……
[...]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[...]……
[...]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[...]……
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
one of the most important tips for online writing…
If you should articulate every aspect there may be to detail about the issue you’re more unlikely for getting still others putting their viewpoints because you’ll have discussed whatever they may have added in….
car stereo installation san diego…
Any time you said everything you will find to say around a subject you’re more unlikely to have people contributing their own sentiments simply because you’ll have discussed what they might have contributed….
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
on a school with 400 students :…
Sue, Sharon, and gang, A special thanks to each of you for giving us a glimpse into these amazing experiences that you are having. May God be with you and make your trip to the village successful and rewarding. With love, margaret…
I will share an exceptional story :…
Sharon, Susan and team–I will be praying for your upcoming trip to the village to provide needed health care and supplies. Your work is an inspiration to all of us. Thanks for keeping us updated….
Online reputation management…
Too many companies do not ever pay for website advertising not to mention advertising campaign so one can clear up open controversy and additionally untruths because of particular people….
[...]Sites of interest we have a link to[...]……
[...]usually posts some very interesting stuff like this. If you’re new to this site[...]……
powerfull forex system in hand…
ready to make serious trades. You will have unlikley seen this forex trading system taught anywhere….
Advertise throughout the internet?…
Regarding search engines like google, we have figured it out that it is crucial to experience a clean public word wide web appearance in the arena you get with the internet….
Better walk in prepared…
than get lost along the way. Buying a home by getting a loan is one of the most important investments in your lifetime, and a certain degree of getting ready is in order….
[...] that is the end of this article. Here you’ll find some sites that we think you’ll appreciate, just click the links over[...]……
[...] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose [...]……
[...]Sites of interest we have a link to[...]……
[...]usually posts some very interesting stuff like this. If you’re new to this site[...]……
Most of the people get it…
at some point during their life time. There are number of natural tips to cure acne….
Unhelpfully, Ron Paul suggested…
there were really five agencies he should cut. And then someone did try to help him, and this to me was the most memorable moment of the evening. From somewhere on the panel, a voice reached out to the struggling Texan, a suggestion that might help Per…
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
No small amount of blame…
for the “protect the program” mentality that has grown in college sports lays at the feet of the NCAA. There is no better analog for Big Government than the NCAA. Obsessed with its own rules on recruiting and amateur status, and eager to enforce even t…
We provide custom fitted…
stock promotion for individual investors, third party owners, or small-cap and micro-cap public companies on any of the North American exchanges….
Romney’s suggestion…
when most of the others were squirmingly silent was an act of pure kindness and self-sacrificing generosity. It was not especially noticeable. But if you were Rick Perry in that moment, you were well aware that Romney was the one who tried to save you….
Others will likely be specified by totally different areas…
For instance, while some travelers would reasonably spend a more on a higher class of lodging, others would reasonably save money by staying at decrease priced inns or motels splurge on sightseeing or their food finances for the family….
Know the way much you might be keen to spend…
There are different ways to get great discounts. In case you are in the army, a senior citizen or a member of an organization resembling AAA, you will find that there are a lot of reductions out there to you….
car stereo san diego…
As you don’t need to specially lose a lot of matters unsaid we have an fine art to penning open-ended articles which leaves space for your target audience to be analysts also….
Others will likely be specified by totally different areas…
For instance, while some travelers would reasonably spend a more on a higher class of lodging, others would reasonably save money by staying at decrease priced inns or motels splurge on sightseeing or their food finances for the family….
Know the dimensions vehicle you’ll need…
Often you will see that nice offers on-line, similar to -for-one deals, free admission for youngsters, special diminished admission days, even discounts on food and lodging….
abductor…
ugg classic tall sandand then the ugg presented itself in the fashion shows of the major cosmopolitan fashion centers.ugg damen coquette nuss…