installation crack - script - server blocked(atr

[qualines]

why the server generates the attack?
I use a script 0521

17:18:46.332737 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332749 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332761 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332779 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332792 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332804 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332817 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332829 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332842 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332855 IP 91.196.50.103 > 188.213.174.113: icmp

 

[kingston]

why the server generates the attack?
I use a script 0521

17:18:46.332737 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332749 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332761 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332779 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332792 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332804 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332817 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332829 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332842 IP 91.196.50.103 > 188.213.174.113: icmp
17:18:46.332855 IP 91.196.50.103 > 188.213.174.113: icmp

What does it have to do with teamspeak and why would you assume that at all?

 

[qualines]

1: on this server is only teamspeak
2: on any other server (9) I do not have such problems
3: the server was blocked after the installation crack ts

 

[kingston]

1: on this server is only teamspeak
2: on any other server (9) I do not have such problems
3: the server was blocked after the installation crack ts

So why is it just you claiming a dark matter here? There should be hordes of people yelling at their blocked servers so far.

 

[qualines]

because there are files r4p3.net

the server itself does not generate attacks.
This is a question for the administration

 

[kingston]

because there are files r4p3.net
the server itself does not generate attacks.
This is a question for the administration

But the server can be rooted in many ways and connecting that with r4p3.net, serving people for 2 years, is silly. I have been using these releases myself (just not installed through script but it doesn't matter) and never had such problems. And your question applies to anyone concerned and caring about this community. You come here accusing staff of hacking people with teamspeak crack, putting some silly tcpdump garbage of unknown origin and making dirty claims. So people like me just have to react on this. That being said i will let others speak for themselves.

 

[qualines]

I accuse? it is only a question! not the first anyway in this forum.

Show me, where I said that it was certainly r4p3.net?

 

[kingston]

I accuse? it is only a question! not the first anyway in this forum.
Show me, where I said that it was certainly r4p3.net?

So come back when you are sure it is. For now you are not it seems and you are running around and making noise. And it is not "only a question". You clearly connect r4p3 with the hack of your box in this thread. While all you got there are just a few pings being send to some Romanian host, first of all. Could be even you sending them or someone else with root on that box. The rest would need to be proven with strace and such to make any statements like you did.

 

[qualines]

how do I be sure if my server is blocked?

If the server does not have anything other than teamspek its natural that my first question will be in this direction.


if the answer here to be just offensive, please delete the post and I thank r4p3.

 

[Supervisor]

We use the AccountingServer Team Mesmerize and Team Cube provided when they first released the crack in 2011. Also, you may view the source of the Accounting Server (You'll find the according files in the VIP section). I can guarantee that the ts3server binary doesn't include any malicious changes at all (well, except for breaking the license ) as I edited the binaries myself. All we do is to change 1 value so the server accepts the self created licensekey.dat.

You should check your box with some rootkit scanner such as rkhunter (http://rkhunter.sourceforge.net/)

 

[kingston]

Indeed it is easy to md5 the actual accounting server binary and compare it with an old Mesmerize one - they are exactly same file in r4p3's release.

 

[ehthe]

Indeed it is easy to md5 the actual accounting server binary and compare it with an old Mesmerize one

But is also relatively easy to collision md5 hashes

https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities

 

[kingston]

Thanks for pointing me to that - always happy to learn new stuff. So i also sha1-ed the sucker and still we got a match there