+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: Entertainment (https://hackforums.net/forumdisplay.php?fid=446)
+---- Forum: Gaming (https://hackforums.net/forumdisplay.php?fid=65)
+---- Thread: [Server] Securing BungeeCord (/showthread.php?tid=5652995)
Securing BungeeCord - SysAdmin - Jun 22, 2017
I've stumbled across people that don't really know how their MC servers got compromised, of course, as BungeeCord is used a lot these days, people often forget that Bungee as a Proxy still has exploits that can be used.
I'm here to tell you about an Exploit that can potentionally harm your Servers and how to protect against it.
Let me start by explaining on what it is and how it works.
Explanation
BungeeCord accepts connections from servers on your network. It works as a proxy, intercepting connections and routing them through to the servers you point them to. That's all fine and dandy until we get to the technical side. BungeeCord doesn't look at localhost IP's, as it has a function to connect to servers outside of the local network. (This is useful if you want to hide the IP's of the servers, run a BungeeCord Instance on a VPS and run the servers on a dedicated server)
Exploit
The actual exploit happens when you don't secure your instance enough, you bring up a BungeeCord Service yourself and input the Server's IP's. By doing this, you fool the servers into thinking Bungee is actually sending a player it's way and it accepts it. This enables the attacker to use a cracked client, bypass any authentication (If you're running auth's that require your BungeeCord instance) and use your account to mess up anything on the server that you have access to. BungeeCord requires Servers connecting to it to have offline-mode set to true in the Configuration Files.
Fixing the problem?
It's quite easy actually, there's a guide on Linux Distro's on BungeeCord's Spigot website.
What you essentially do is you either run a script that only allows Bungee to accept connections from certain IP's (Servers) or use a Firewall that does the same.
You can read more about it here: https://www.spigotmc.org/wiki/firewall-guide/#redhat-centos-distributions
Hope everybody is a tad bit safer after this!
* - Nicᴋ - Jun 22, 2017
I kind of thought this was a known exploit that people secured right away. But anyways, nice HQ post and I hope it helps some people!
* - ๖ۣۜCreative - Jun 22, 2017
There are still people who don't block against this and get the entire server griefed but For people that arent running on their own dedi's and are using 3 plans on a mc host you can use IPwhitelist, It works just as well.
* - SysAdmin - Jun 23, 2017
(Jun 22, 2017 08:27 PM)Nicᴋ Wrote: I kind of thought this was a known exploit that people secured right away. But anyways, nice HQ post and I hope it helps some people!
You'd be surprised by how many people don't know about this. Specifically those that are setting up a server their first time.
* - Osuka - Jun 24, 2017
I have this setup all under the same machine
Bungee: 25565
Hub: 25566
Prison: 25567
Factions: 25568
And I ran this as root am I secured?
iptables -I INPUT ! -s 127.0.0.1 -p tcp --dport 25566:25568 -j DROP
I tried my ip:port and i get denied access to it on MC all good then?
* - Nicᴋ - Jun 25, 2017
(Jun 24, 2017 03:51 PM)Osuka Wrote: I have this setup all under the same machine
Bungee: 25565
Hub: 25566
Prison: 25567
Factions: 25568
And I ran this as root am I secured?
iptables -I INPUT ! -s 127.0.0.1 -p tcp --dport 25566:25568 -j DROP
I tried my ip:port and i get denied access to it on MC all good then?
Yes. You can make a script for that as well https://www.spigotmc.org/wiki/firewall-guide/
* - SysAdmin - Jun 27, 2017
(Jun 25, 2017 11:35 AM)Nicᴋ Wrote: Yes. You can make a script for that as well https://www.spigotmc.org/wiki/firewall-guide/
IP Tables should be enough, no need for a script as long as the IP Tables only accepts connections from localhost and not from inbound IP's