Indefinite Ban Request - wtfcat

Please Note: The TotalFreedom Forum has now been put into a read-only mode. Total Freedom has now closed down and will not be returning in any way, shape or form. It has been a pleasure to lead this community and I wish you all the best for your futures.
1st Official Post

    1. Username, UUID, IP(s), and short ban reason for each offender.

    Code
    wtfcat:
  uuid: '8bdfb829-5d90-433b-9406-c6fe7c835b07'
  ips:
    - 149.57.28.206
  reason: 'Abusing exploits to disconnect players'


    2. What did they do?

    This player maliciously abused an exploit related to NBT size limitations to kick nearby players from the server on several occasions.

    The exploit itself works by having several copies of a big list of numbers (in this case, NaN) applied to the NBT of an arrow. The cumulative NBT size of the arrow is about 463.72 KB. To deploy the exploit, a Crossbow with Multishot V is loaded with these arrows as combining the two items has just enough NBT to kick vulnerable players from the server.

    For players running 1.17.1, they will completely disconnect from the server with this message:

    2755Aac03JhanQN7.png

    Players using a combination of 1.17.1 and WNT are not affected by this exploit, as it includes patches to counter this exploit.

    For players running 1.18 and 1.19, they are sent back to the hub instead as the exploit causes problems with ViaVersion when it tries to convert 1.17 data to 1.18+ data and as a result kicks them from the server.

    3. What indefinitely bannable offense does this fall under according to the guidance for sanctions?

    1a. Attempts at harming the server.

    1g. Using an exploit that restricts a players experience.

    4. Add logs and/or screenshots of the occurrence here, and tag any witnessing staff.

    This item was found in the user's inventory.

    uTxmcmdbxOTOftKe.png

    The user created the crossbow using Itemizer. This is indicated by failed attempts to create the item right before players started getting kicked by the exploit.

    Code
    [17:17:30] [Server thread/INFO]: wtfcat issued server command: /ii enchant add multishot 5
[17:17:59] [Server thread/INFO]: wtfcat lost connection: Internal Exception: io.netty.handler.codec.DecoderException: java.lang.RuntimeException: Tried to read NBT tag that was too big; tried to allocate: 2097160bytes where max allowed: 2097152
[17:17:59] [Server thread/INFO]: wtfcat left the game.

    The arrow itself, however, was created using NBTExplorer.

    RirfKWhgv2sqdTG3.png

    Multiple players disconnected with the ViaVersion error message right after the user teleported to them with the exploit deployed.

    Witnesses:


    5. Are they known under any other names or IPs, and if so, are they currently (indefinitely) banned under those names and IPs?

    No.

    image.png

    Lyicx initially suspected the guy but I focused my entire search on the placement of tile entities meaning I ruled him out for a good while. In the panic of trying to work out what was going on, the guy eventually had crashed everyone from the server over time.

    We then kind of realised what he was doing and using at that point and I managed to catch the items in his inventory after we opened the server up and acted dumb.

    All in all, fair play to the guy. He had me panicking for an hour and mentioning other names and looking down all the wrong paths when lyicx got the answer first try.

    Vouch and witness.

    Patrolling the Mojave almost makes you wish for a nuclear winter.

    I Vouch. Also, I recommend adding me as a witness. He pulled this shit today (8/20/22).

    Today, he did his little chunkban trick. I decided to investigate and sure enough, he was pulling the same shit.

    Upon further investigation, I knew there was foul play because he disconnected due to large NBT.

    I managed to recover one of the crossbows he used and got a disconnect message as well. It was the same as the one he got. Another OP reported they were chunkbanned so he clearly was trying to cause harm.

    unknown.png

    unknown.png

    Code
    [23:19:46] [Server thread/INFO]: Alco_Rs11 lost connection: Internal Exception: io.netty.handler.codec.DecoderException: java.lang.RuntimeException: Tried to read NBT tag that was too big; tried to allocate: 2097160bytes where max allowed: 2097152 
[23:19:46] [Server thread/INFO]: Alco_Rs11 left the game.

    I successfully managed to toolbar the item milliseconds before being kicked as well, which reveals the 'blue ice' arrow in the crossbow. This user placed several of them around flatlands.

    unknown.png

    Upon pickblock, I got disconnected for the error below.

    Code
    [23:09:44] [Server thread/INFO]: wtfcat lost connection: Internal Exception: io.netty.handler.codec.DecoderException: java.lang.RuntimeException: Tried to read NBT tag that was too big; tried to allocate: 2097160bytes where max allowed: 2097152 
[23:09:44] [Server thread/INFO]: wtfcat left the game.

    As videogamesm12 pointed out, he used NBT explorer to copy the NBT and make the arrow. I've provided below a screenshot of the NBT of the crossbow in my saved toolbars file that I recovered.

    unknown.png

    Here's evidence of him removing crossbows to chunkban players. The item frames were used to obtain the crossbows.

    unknown.png

    unknown.png

    unknown.png

    javaw_VqNRNZdU6Q.png
    image.png
    image.png

    Edited 10 times, last by Alco_Rs11 (August 20, 2022 at 11:34 PM).