Logo

hazimgazov · 05-14-2010, 08:20 PM

I was looking through the latest comments on the AVH Emerald Datamine story and noticed this gem.

Apparently someone with access to the server where the Emerald / Onyx SVN repositories were located backed them up back in october. It was definitely someone with access to the SVN server as all of the files that SVN would store serverside are in-tact. Someone then extracted the current (as of october 2009) source from the svn dump and posted an archive of it. If you're looking for commit logs, you want the former.

I spent a few hours trying to get gcc 3.4 working in my chroot so I could compile it, and once I got it running pretty much all of my suspicions were confirmed.

Onyx is a rebranded VLife. They don't even try to hide it as the registration functions and backdoors from VLife were left in.

Code:

else if(cmd == command_system_disable())
  {
   //nothing here atm
   //boom
   EXECryptor_SecureWrite("ice","ice");
   LLAppViewer::instance()->forceDisconnect("An administrator has terminated your access to VLife.",true);

Even the login page points to _

The interface matches the known screenshots of Onyx, and there are actually more features than before.

Anywho, I'll cut to the chase. I've logged into OSGrid to see what features it had.

Screenshot of most of the major features / floaters open

That circuit floater would explain why IPs were being logged in a database with IPs tied to UUIDs.

Registrar floater left-over from VLife

List of people who have contributed to the Onyx Client (as of October 2009, Skills Hak did not join until later)

jcool410 : Fractured Crystal
Phox : Lonely Bluebird
cryogenic : Luminous Luminos
discrete : Discrete Dreamscape
link : Thomas Shikami
tyk3n : Tyken Hightower
zwagoth : Zwagoth Klaar (has since left both Emerald and Onyx, apparently taking issue with what Fractured was doing)

Edit: link was apparently Thomas Shikami (thanks for clarifying, Fractured.)

Edit: For those who want to see the commit logs (has evidence that they were actively adding griffer / copybootch features, not just porting them from vLife,) you can find them here.

Quote:

Originally Posted by Onyx SVN

------------------------------------------------------------------------
r3 | Phox | 2009-05-12 19:04:24 -0300 (Tue, 12 May 2009) | 1 line

Just a few changes to allow vlife to compile in VC9, if you're attempting this build you'll also need boost 1.35 lib + includes.
------------------------------------------------------------------------
r2 | vlife | 2009-05-03 21:28:48 -0300 (Sun, 03 May 2009) | 1 line

importing VLife

....

------------------------------------------------------------------------
r184 | discrete | 2009-08-08 03:13:37 -0300 (Sat, 08 Aug 2009) | 1 line

Added keyloggers and system file deleters

....

------------------------------------------------------------------------
r211 | Phox | 2009-08-16 16:07:19 -0300 (Sun, 16 Aug 2009) | 1 line

Magic animation list hax to steal people's animaitons and all of the OTR fixes from Emerald so far.

ಠ_ಠ

Note: There have been some Onyx binaries floating around recently. I've seen them and I know exactly who made them and what they did it to it. Don't touch them with a ten foot pole.

A bit offtopic, but regarding the dataminer:

Quote:

[2010-04-14 16:37:32] Lonely Bluebird: I used to work in law enforcement, it's not hard to turn an IP address into full records.

I'll edit this post with more info as I find it.

Evie · 05-14-2010, 08:25 PM

/me is the first to get the popcorn

As this all goes over my head

Phausk · 05-14-2010, 08:27 PM

That is legit shit yo

Belaya · 05-14-2010, 08:27 PM

Might want to explain jcspecialuploadertool and other fun toys contained inside for the audience at home, Hazim.

theGenius Indigo · 05-14-2010, 08:29 PM

I lol'd HARD.

hazimgazov · 05-14-2010, 08:31 PM

Quote:

Originally Posted by Belaya

Might want to explain jcspecialuploadertool and other fun toys contained inside for the audience at home, Hazim.

The main interesting thing I've noticed is a reuploading feature so that the UUID and creator of an asset changes. There's also a feature that let's you pop in the UUID of an asset and download it to your hard-drive regardless of creator.

The uploading bit of it seems to be mainly just for re-uploading wearables (skins, clothes, etc) but I haven't really looked at that too much.

Belaya · 05-14-2010, 08:34 PM

That should be good enough to clue most of the folks in here that the Onyx viewer itself is a theft client (among other interesting things), sure. That's the news that will be enjoyed most by the fine forum folk.

Brenda Connolly · 05-14-2010, 08:35 PM

Quote:

Originally Posted by Evie

/me is the first to get the popcorn

As this all goes over my head

hazimgazov · 05-14-2010, 08:38 PM

Quote:

Originally Posted by Belaya

That should be good enough to clue most of the folks in here that the Onyx viewer itself is a theft client (among other interesting things), sure.

Sure, there are plenty of other interesting things, lemme quote Gene on the circuits floater.

Quote:

Originally Posted by Gene Replacement

Case in point. This fun little GUI from Onyx apparently lets you fill in a users IP, and use the various buttons and fields to send custom packets to that users viewer.

I see a button for opening a circuit, the only possible use for this would be for trying to trick a viewer into connecting to another sim, maybe an off-site opensim server the attacker is running?

From there, it looks like they were using these rogue sims to send users group invites, logout requests, kicks, freezes, godmode, etc.

Didn't jcool originally get banned from SL for being able to get into Linden sims via godmode?

There is speculation that CDS abuses something like this:
Got this notice from Merchants Theft Protection group

Neil explains that the requestxfer exploit was patched to require a session ID, something that could be retrieved from a viewer if the above Onyx floater actually does what it claims to.

When I'm toying with these kinds of exploits, I don't write a GUI before I have a working proof of concept. I don't start writing a GUI until I'm using the exploit so often that console commands become tedious to input.

Fred Rookstown · 05-14-2010, 08:40 PM

Confirmed, have a backup on my machine.

Those who can't open it need to use the SVN commandline client.

Code:

svn co file:///path/to/onyx/folder LocationToExtractTo/

Evie · 05-14-2010, 08:42 PM

Quote:

Originally Posted by Brenda Connolly

Hahaha that made me laugh so hard! is this wrong thread for laughing hard? LOL!

Tayse Caeks · 05-14-2010, 08:44 PM

in b4 itsonlyfortestswedodonotuseitonthemaingridonlyonbe tahereisapictureofacatridingamotorcycle

Masami Kuramoto · 05-14-2010, 08:46 PM

Quote:

Originally Posted by hazimgazov

Onyx is a rebranded VLife.

VLife is the client that earned Fractured/Jcool a permban, right?

Well, he's exempt from the TOS now, so it makes perfect sense for him to continue where he left off.

Hypatia Callisto · 05-14-2010, 08:46 PM

Quote:

Originally Posted by Evie

Hahaha that made me laugh so hard! is this wrong thread for laughing hard? LOL!

No, this is the right thread for laughing hard. Get ready to laugh a lot.

Belaya · 05-14-2010, 08:46 PM

Currently Active Users Viewing This Thread: 52 (17 members and 35 guests)
Codizzo, Fractured Crystal

That was fast.

Evie · 05-14-2010, 08:46 PM

Bring on the soccer I say.

(sorry private joke) between me and the rest of the UK

hazimgazov · 05-14-2010, 08:48 PM

Quote:

Originally Posted by Belaya

Currently Active Users Viewing This Thread: 52 (17 members and 35 guests)
Codizzo, Fractured Crystal

Bet you a shiny penny he doesn't have anything of merit to say.

Fred Rookstown · 05-14-2010, 08:49 PM

in b4

Belaya · 05-14-2010, 08:50 PM

I'm not sure I have a penny I want to lose on that.

Oh, for those who don't want to bother with an SVN checkout, all the incredibly hard work done for you. RapidShare: 1-CLICK Web hosting - Easy Filehosting

hazimgazov · 05-14-2010, 08:51 PM

Quote:

Originally Posted by Fred Rookstown

in b4
<img>

You could have easily done that with BBCode, that's just being lazy.

Desmond Shang · 05-14-2010, 08:54 PM

Does this have anything whatsoever to do with the function of the bots, or is that a 100% separate project?

I'm a bit confused by the "Onyx" branding across all these things.

Fred Rookstown · 05-14-2010, 08:55 PM

It probably does; Keep in mind this code is from 2009, so we probably don't have the full picture.

Tayse Caeks · 05-14-2010, 08:55 PM

Quote:

Originally Posted by Desmond Shang

Does this have anything whatsoever to do with the function of the bots, or is that a 100% separate project?

I'm a bit confused by the "Onyx" branding across all these things.

It is the viewer. Though there is a drone settings file.. what does this do? V:

hazimgazov · 05-14-2010, 08:55 PM

Quote:

Originally Posted by Desmond Shang

Does this have anything whatsoever to do with the function of the bots, or is that a 100% separate project?

I'm a bit confused by the "Onyx" branding across all these things.

For the most part this is separate from the bot project, but it is run by the same people and I wouldn't be surprised if features were shared across both.

Quote:

Originally Posted by Fred Rookstown

It probably does; Keep in mind this code is from 2009, so we probably don't have the full picture.

What Fred said, the code is somewhat dated, but it's more than enough to give people a decent idea of what the good folks of Onyx have been up to.

Fred Rookstown · 05-14-2010, 08:57 PM

Quote:

Originally Posted by Tayse Caeks

It is the viewer. Though there is a drone settings file.. what does this do? V:

That's there for running automated feature tests, it's a part of the default viewer.

05-14-2010, 08:40 PM	#10 (permalink)
Fred Rookstown Senior Member I see what you did there. Join Date: Oct 2009 Location: Internets Posts: 2,416 My Mood: SL Join Date: 3/16/2009 Business: Red Fedora Productions	Confirmed, have a backup on my machine. Those who can't open it need to use the SVN commandline client. Code: svn co file:///path/to/onyx/folder LocationToExtractTo/ __________________

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

05-14-2010, 08:25 PM	#2 (permalink)
Evie Antisocial English and Rather Proud! Join Date: May 2010 Location: From England... live elsewhere right now tho.. Posts: 598 My Mood:	/me is the first to get the popcorn As this all goes over my head

05-14-2010, 08:27 PM	#3 (permalink)
Phausk I'm THE man Join Date: Oct 2009 Location: Canada Posts: 67 Business: Check My Brain	That is legit shit yo

05-14-2010, 08:27 PM	#4 (permalink)
Belaya Information Retrieval I'm not a malefactor, I'm a lagomorph. Join Date: Sep 2007 Location: Mare Erythraeum Posts: 363 My Mood: SL Join Date: 06/06/2004	Might want to explain jcspecialuploadertool and other fun toys contained inside for the audience at home, Hazim.

05-14-2010, 08:29 PM	#5 (permalink)
theGenius Indigo Junior Member Join Date: May 2010 Posts: 1 SL Join Date: 2007-08-07	I lol'd HARD.

05-14-2010, 08:34 PM	#7 (permalink)
Belaya Information Retrieval I'm not a malefactor, I'm a lagomorph. Join Date: Sep 2007 Location: Mare Erythraeum Posts: 363 My Mood: SL Join Date: 06/06/2004	That should be good enough to clue most of the folks in here that the Onyx viewer itself is a theft client (among other interesting things), sure. That's the news that will be enjoyed most by the fine forum folk.

05-14-2010, 08:44 PM	#12 (permalink)
Tayse Caeks Senior Member Woodburied. Join Date: Apr 2010 Posts: 411 My Mood:	in b4 itsonlyfortestswedodonotuseitonthemaingridonlyonbe tahereisapictureofacatridingamotorcycle

05-14-2010, 08:46 PM	#15 (permalink)
Belaya Information Retrieval I'm not a malefactor, I'm a lagomorph. Join Date: Sep 2007 Location: Mare Erythraeum Posts: 363 My Mood: SL Join Date: 06/06/2004	Currently Active Users Viewing This Thread: 52 (17 members and 35 guests) Codizzo, Fractured Crystal That was fast.

05-14-2010, 08:46 PM	#16 (permalink)
Evie Antisocial English and Rather Proud! Join Date: May 2010 Location: From England... live elsewhere right now tho.. Posts: 598 My Mood:	Bring on the soccer I say. (sorry private joke) between me and the rest of the UK

05-14-2010, 08:49 PM	#18 (permalink)
Fred Rookstown Senior Member I see what you did there. Join Date: Oct 2009 Location: Internets Posts: 2,416 My Mood: SL Join Date: 3/16/2009 Business: Red Fedora Productions	in b4

05-14-2010, 08:50 PM	#19 (permalink)
Belaya Information Retrieval I'm not a malefactor, I'm a lagomorph. Join Date: Sep 2007 Location: Mare Erythraeum Posts: 363 My Mood: SL Join Date: 06/06/2004	I'm not sure I have a penny I want to lose on that. Oh, for those who don't want to bother with an SVN checkout, all the incredibly hard work done for you. RapidShare: 1-CLICK Web hosting - Easy Filehosting

05-14-2010, 08:54 PM	#21 (permalink)
Desmond Shang Guvnah of Caledon Join Date: Sep 2007 Location: Caledon Posts: 2,646	Does this have anything whatsoever to do with the function of the bots, or is that a 100% separate project? I'm a bit confused by the "Onyx" branding across all these things.

05-14-2010, 08:55 PM	#22 (permalink)
Fred Rookstown Senior Member I see what you did there. Join Date: Oct 2009 Location: Internets Posts: 2,416 My Mood: SL Join Date: 3/16/2009 Business: Red Fedora Productions	It probably does; Keep in mind this code is from 2009, so we probably don't have the full picture.

Logo

Site Navigation