SSO Exploit [HELP]

[adz]

Does anyone know how to fix the exploit where hotels can hack into yours and take advantage?
I'm pretty sure it's called the sso exploit;
I'm using PLUS EMU, Brain CMS.

You must be registered for see images attach

NextGenHabbo took advantage of this and obviously fucked up my hotel a little.
thanks guys <3

 

[HatemeLoveme]

Wow I can't believe NGH did this i was a big fan of them back in the day but heres a solution m8

You must be registered for see links

 

[treebeard]

^^^^^^^^^^^ Is that fix the same for Brain? I haven't really seen much about Brain SSO exploit

 

[adz]

NGH has hacked us more than once, it's got beyond a joke so we had to close for a couple days thank you @HatemeLoveme ; hopefully this will work when adapted with Brain.
 

You must be registered for see images attach

I applied the fix and boom? I legit cant be arsed LOOOOOL

 

[HatemeLoveme]

NGH has hacked us more than once, it's got beyond a joke so we had to close for a couple days thank you @HatemeLoveme ; hopefully this will work when adapted with Brain.
 

You must be registered for see images attach

I applied the fix and boom? I legit cant be arsed LOOOOOL

lmao run a vulnerability scanner on your hotel
 

NGH has hacked us more than once, it's got beyond a joke so we had to close for a couple days thank you @HatemeLoveme ; hopefully this will work when adapted with Brain.
 

You must be registered for see images attach

I applied the fix and boom? I legit cant be arsed LOOOOOL

pm me the results

 

[Muff]

Spoiler: SSOTicketEvent.cs

using System;

using Plus.Communication.Packets.Incoming;
using Plus.HabboHotel.GameClients;
using Plus.Communication.Packets.Outgoing.Handshake;

namespace Plus.Communication.Packets.Incoming.Handshake
{
    public class SSOTicketEvent : IPacketEvent
    {
        public void Parse(GameClient Session, ClientPacket Packet)
        {
            if (Session == null || Session.RC4Client == null || Session.GetHabbo() != null)
                return;

            string SSO = Packet.PopString();
            if (string.IsNullOrEmpty(SSO) || SSO.Length < 15)
                return;

            Session.TryAuthenticate(SSO);
        }
    }
}

Try this.

 

[Weasel]

Thread cleaned. Now behave.

 

[Zachariah]

You can refer to here

You must be registered for see links

and if i'm correct you was advertising there aswell