Are Resource Packs Safe?

Let's explore how Minecraft can be customized. The knowledge we gain from that is very useful to identify interesting attack surface.
Timber Forge: / @timberforge
McMakistein: / mcmakistein
Information leak in Minecraft 1.8: blog.punkeel.com/2018/09/12/m...
Fuzzing Java: • Fuzzing Java to Find L...
Chapters:
00:00 - Intro
00:44 - Herobrine's Bunker
03:06 - Researching Creepers
05:16 - SUPER FAST BUILD MODE
06:43 - How Custom Models Work
11:33 - Attack Surface Overview
12:44 - Resource Pack Security Research
20:46 - Open Server Experiment
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Instagram: / liveoverflow
→ Blog: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow

[@Zekrom_64]

If you want a far too long explanation of why custom item models are different that block models, here goes: Like lerokko has already pointed out, items and blocks operate differently in the game. Items are stored as "ItemStack"s, which store the item type, count, and some additional NBT data. NBT is used a lot in Minecraft to store arbitrary data such as item enchantments or potion information and is conceptually similar to JSON (although NBT is a bit special, it is a binary format and has more specific data types). Minecraft's model system can read this custom model data from an ItemStack's NBT and change the model if it matches a specific value. However, blocks are a very different beast. Blocks have a corresponding item which lets players store them in inventories but the actual in-world model for a block is determined by "BlockState"s, but to explain those its helpful to know how blocks actually store data. Minecraft stores the type of block at each position in the world, but in ye olde Minecraft each block could only store 4 bits of 'metadata' associated with itself (this is why there are 16 colors of wool, it is the maximum number of permutations of 4 bits!). If you want to store more state information you need use a TileEntity/BlockEntity which is a custom Java object mapped to the block's position. Every block that needs to store a complex state (persistent inventories, banners/signs/mob heads for rendering information) has its own BlockEntity, and they save and load using NBT data but their state information is limited to whatever the programmer specifies. BlockStates are the modern way Minecraft handles most block rendering, and they are just sets of properties (eg. what direction a block is facing, if it is "on" or "off", if it is connected on a given side, etc.) that the block defines. While blocks are pretty flexible in how they get the values for these properties (they can come from metadata, BlockEntities, or arbitrary access to any blocks in the world!) this is hardcoded with each block. BlockStates are used with a .blockstate file associated with each block to define a mapping of block states to block models, and while both the blockstate and model files can be modified by resource packs, they are still limited to whatever BlockState values the block itself defines. So you can give blocks custom models, but they must overwrite how the block looks for some state. Because the armor stand is rendering the *item* the custom rendering works, but when it is placed it is rendering the *block* and just renders as a regular carpet. Hopefully this long-winded explanation makes sense, I've been tinkering with Minecraft mods since 1.6.4 and had to figure most of this stuff out by looking at other mods because it hasn't always been well documented and has changed quite a bit over different versions.

[@rick-sanchez]

Thank you for writing such a good and detailed explanation! It seems my original comment was deleted :/ No idea why.

[@luca_nero]

🤓

[@pokemonXD1]

so would he able to get the carpet to render as the computer if he changed the blockstate file? If so, do people just use the armor stand so they don't have to deal with that?

[@rick-sanchez]

@@pokemonXD1 The game says which block states a block can have. For carpet for example that was only the color. But this has been changed so now each color of carpet is its own block and the block itself does no longer have any block state you cloud change. Also if you could it would only mean "all gray carpets now look like this". Artists often use note blocks or mushroom blocks since those have a lot of block states. The block states are like variables for the block. Mojang decides if a blocks has them and also which the block has and also what the valid values are. If you multiply all possible values with another you get the number of possible block models you can define for that block. 1 For each block state.

[@JackTheDev]

This, but now they can make as many wool colors as you want past 1.13

[@rick-sanchez]

FYI you can put a resourcepack also in a folder called resources inside that world folder. That pack will always load and can be even live edited when reloading with F3+T.

[@mikee.]

couldn't you do the same in the regular resourcepack folder? why move it into the world?

[@misode]

It can't be in a folder, it has to be a zipped resource pack called resources.zip, as seen in the video

[@mikee.]

@@misode but that's server-side, right? I don't think lerokko was talking about modifying the pack on the server because I don't think it's possible to live edit it in that way, or is it?

[@fledermaus7061]

@@mikee. Well it's complicated because single player also hosts a local server. If you're doing it in a local world you can live reload it. Otherwise you cannot.

[@rick-sanchez]

@@mikee. From experience windows does not let you delete accessed files and if memory serves me right that is not the case for the resources folder. That might also just be because its zipped ass another user pointed out.

[@simply-dash]

Armor stands are actually mainly used a lot because they are entities which can be posed in anyway so it makes it easy to rotate and move to make something like a car for example.

And also because they do very little on their own, so they cause little lag and interference. Before 1.8, people used wither skulls which were somehow made to not interfere with stuff.

[@Embuer]

Man I can't get enough of this series! I absolutly love it.

[@zanehannan5306]

Wasn't expecting GoodTimesWithScar here

[@rick-sanchez]

Ohh, with the experiments you do you woould love minihud and scarpet. A sophisticaed overlay and a scripting interface for minecraft.

[@TheoParis]

I had no idea this was a thing either, thanks :)

[@lekuru]

The "I think you get used to it" describes Club Mate so well...

[@Andy-lf4di]

For a long time "Man gewöhnt sich dran" in German, or "You get used to it" in English, was the official marketing slogan of the manufacturer for it.

[@lekuru]

Warum wusste ich das nicht hahaha

[@m1k3y_m1]

Nen freund von mir meinte Schmeckt wie Aschenbecher. Dennoch gut. Und irgendwie hat er recht

[@lekuru]

Auch ne gute Beschreibung

[@TheMAZZTer]

Very interesting look into the path traversal stuff. I personally find the best way to validate paths is to wait for the validation after the path has been fully assembled. So for the case of level:// I would tackle it by building my path and then using an API like .NET's Path.GetFullPath which will resolve any ..s and .s and give you an absolute path string. Then I make sure that path string starts with the path I am looking for, ending with a / or \ (depending on OS). If it does, the file referenced is where it should be. This would still possibly allow an attacker to determine where this path IS... testing one path at a time with ..s to see if any pass the validation... but in and of itself that would not be a useful attack.

[@Respectable_Username]

Even so, allowing any evaluation of ".." to appear in the final path could lead to other vulns. What you _could_ do though based on that idea is to get what you expect to be your final URL string, then do a full evaluation of a _copy_ of that string, compare the values before and after, and reject if the string changes at all. That way you preemptively check for any path traversal exploits you didn't think of yourself either 😊

[@PiesekLeszek90]

Could we use query parameters to get over the check for "/resources.zip"? I'm not sure how exactly Java url parser works but adding "?q=/resources.zip" to the string should get past the check but not appear when reading absolute path?

[@xdjiijii6543]

Yeah I though about the same, just make it ?=%2Fresources.zip So encoded value would match all conditions while being whatever it actually is

[@randomsoul294]

If you look at the actual implementation it seems that 1) the /resources.zip is only made for the level:// protocol and 2) this protocol is simply a way to hold a local path, it's not an http(s) URL, the query string is not treated in any way so in the end if you put level://foo?q=/resources.zip then the file system would try to open the file "resources.zip" in the folder "foo?q=". There would be nothing special.

[@xdjiijii6543]

@@randomsoul294 Thanks for info, No idea why I assumed it would act same as urls lol

[@Reichstaubenminister]

​@@xdjiijii6543 You came, you saw, you assumed. Makes perfect sense to think this might work if you're not used to seeing protocol URIs outside of HTTP.

[@seraphina985]

@@xdjiijii6543 Making wrong hypothesizes and proving them wrong is all part of the process in actual security research so you are along the right lines to consider the possibility of interactions like this.

[@rx97_mc]

Yay, you entered the world of data packs! There's so much to explore especially on how creative the community has become in creating weirdly technical applications of computer science! I hope you explore more of the data pack space in future episodes!

[@DM-qm5sc]

You don’t understand how important and great these videos are. They may not have the views your others do yet but I feel they are so much more impactful

[@CosmodiumCS]

Awesome vid as always man, I love your content! Please do consider using darkreader in your screenshots for a more constant "dark mode"😅

[@m4rt_]

it was that way because you changed the item model (what you hold), instead of the block model (what it looks like when placed), but then you can't have multiple models for the same block, because when you place something it looses it's nbt data.

[@krzysztof-ws9og]

Now with Zelda easter egg too, this series is getting even better, keep it up!

[@anand_bhasme]

What are your thoughts on recent 'player chat banning' feature introducing in 1.19.1?

[@fledermaus7061]

You could've also covered shaders inside resource packs and how core shaders could be abused for misrendering things like menus.

[@eliblaney]

I absolutely love the Scar reference, well done

[@Ashnurazg]

I think the chance that someone finds your server and joins it with a Minecraft client is relatively high if you left the door intentionally open and the server is reachable from the internet. You searched for open Minecraft servers and joined a lot of them in your small research project with the log4shell vulnerability. The real good questions are: Did they just join to check if it's a MC server and left before burning to death? (aka bots/scripts vs real players) How many hacked Minecraft clients joined with flying on by default and don't fall in your death trap? (aka hacked vs normal client) What did they do on your server? Like: Curiously flying around, but don't touch anything? Griefing your base? Flood the server chat with spam? (each are it's own categories)

[@gavros9636]

The only way to access it is if you randomly ping the servers IP address, given that 2b2t players were able to build a massive list of open servers using bots that didn't even need to join the server, just send a special ping, those guys are likely the only folks who will find it.

[@Ashnurazg]

@@gavros9636 I watched some videos about 2b2t by FitMC and SalC1 and it's sure amazing how much impact 2b2t has on the Minecraft community when it comes to hacking, exploits, etc. I think you are right. I'm looking forward to see the video about it. PS: I run an open endlessh SSH Tarpit at my local raspi as a research project and they managed to send me around 11.4MB to my tarpit and received 13.5MB from my tarpit within the last 10 days. That's impressive for a tarpit!

[@Sch8ill]

Propably no clients will join the server, because its a huge pain to let a bot join thousends of servers. A simple statusping would be enough to identifiy the server.

[@Kynatosh]

When I compare this base to the one you have on your server that I saw when I logged on, I see that there are quite a few more episode :D

[@sturmpelz1277]

What is the ip xD

[@Eliasazerty]

Can you proof it?

[@QUINT_09]

Is it still online and can you give a clue about how you found it?

[@Eliasazerty]

@@QUINT_09 maybe in one of the first videos we can see the ip in a shell or something like that

[@Kynatosh]

@@QUINT_09 check the video where he talks about mass scanning minecraft servers. I basically did that

[@Respectable_Username]

It's only been about a year since I stopped watching MCYT but hearing Howling by Lupus Nocte was already nostalgia! Such a bop, such Good Times.

[@mikee.]

hahahah super fast build mode, gotta love a good scar reference

[@LosTigeros]

11:20 You can also use the mob / monster spawner ;) You can then place and mine them, they are not entities so they won't lag server and client with higher amount of them.

[@malbacato91]

they are block entities that preform complex operations. way more than "Marker:1b" armourstands. the server will only load a few hundred of those before starting stalling, the vanilla client will only happily render a few thousand

[@karlkastor]

8:23 "Crypto is a joke. Don't get invested in this scam." I agree, but didn't you say a big part of your job was searching for possible exploits in Etherium smart contracts?

[@LiveOverflow]

Love the technology, hate everything else ;)

[@liquidmagma0]

@@LiveOverflow monero and other privacy coins seem to be the only interesting thing about cryto currently.

[@backjitter]

It's funny to see people giving advice in areas they know nothing about

[@boristodorov779]

@@backjitter u good?

[@nezu_cc]

@@LiveOverflow "hate everything else". What's wrong with paying for stuff or getting paid. Yes there is sthe whole market of scams but a currency is still a currency. I use crypto to pay/get paid on weekly basis.

[@loganalt1838]

Could you do “\0resource.zip” at the end? Not sure all the specifics of decode but that might cut off resource.zip and open up the original information leak.

[@CooksBooks]

He shows this not working in the video. At around 19:07 he puts an encoded null byte %00, which is \0 after URL decoding. Because the string gets URL decoded before it gets passed to the OS (where the null byte problem occurs) %00 will evaluate as \0. If you mean use a null byte in the string instead of a URL encoded null byte, it’s likely that URLDecoder won’t work with that directly, but even if it did, after URL decoding the strings would be functionally identical. Because Java strings aren’t null byte terminated the problem comes when the string with a null byte is passed to the OS, hence why we only care about what the string looks like after URL Decoding, as that is what will be sent to the servers OS to grab the file and is when the \0 might be used to terminate the string early.

[@loganalt1838]

Oh, I completely missed that, you’re right. Thanks for pointing that out.

[@black_platypus]

So what were those trees without leaves about? I clicked on this video expecting important insight in the deterioration of our ecosystem! :P (Was that just an eye catcher for the area with the hacker cave?)

[@ShiftSad]

It is a reference about the “legend of herobrine” which say that trees with no leafs is a sign of herobrine

[@chonkydog6262]

Herobrine removed the leaves

[@black_platypus]

@@ShiftSad Oooh, thank you! (Had to look it up. For others wondering: It's a creepypasta about a kind of doppelganger human entity, with the default Steve skin, except for missing pupils/white eyes)

[@cyancoyote7366]

Heya! It's been a looong time, been following you since you had a few thousand subscribers and pretty much binged your binary exploitation series hahaha. Just want to say, thanks for getting me into exploitation and hacking. As well as pen spinning; I wouldn't be doing any of these now if it weren't for you.

[@programorprogrammed]

Such a great minecraft series

[@tristanmacc]

love this series

[@ben-brady]

Another attack vector of resouce packs could be the shaders. You can use shaders in a resource pack, that use OpenGL Shader Language. That could potentially be exploited but I'm unsure on that.

[@FalcoGer]

Checking for ".." is often not nearly enough. different uri parsers handle things differently. You could escape the dots, or have characters between the dots that are stripped after the check, or have characters that are substituted for dots, perhaps some unicode characters. After checking something you need to use what you checked, not the input used to generate the object you checked.

[@2f510]

Would registering the domain resource.zip do anything useful?

[@teggolT]

Good mix of hacker culture, gameplay and education. I wish school was like this. How much time do you spend on these videos from both a video making and researching standpoint?

[@adrianklamut8533]

Can't you just use query params to bypass that /resources.zip check?

[@computerdores]

thought the same, but I don't think it's as simple as that, because it would still have to be a valid path after joining. That said, combining this with some quirk of the path parsing might make it possible

[@bdot02]

I think I found the server but the connection keeps timing out. Would it happen to be located on a german residential ISP IP address?

[@fxiqval]

i know this is an old video, but minecraft added a new item_display item, that doesn't need any changes, it just takes an item id as the nbt data. one downside is that rotations on item, block and text displays are really weird, still not quite sure how they work

[@BenjaminGoldberg1]

If you want to not use an armor stand, there are two alternatives. First, you can put your item in an item frame, and make the item frame invisible. You might need to start with a map instead of a grey carpet, due to how item frames work. Second, you could create a mob spawner block and have the spawner produce mobs which are wearing your computer carpet item on their heads. You'll need to make the spawner not actually spawn, and keep it from spinning, and you'll need to make spawners in general invisible.

[@Onako2]

18:30 theoretically could Minecraft servers use that to check what mods are installed and then a anticheat could detect cheaters. Or the server could see what resourcepacks are downloaded(example if there is a xray)

[@cs127]

these videos are amazing!

[@susseduud]

How could I get my hands on the Club Mate resource pack :D ?

[@alanafk]

You need to see the pirate or cracked versions of Minecraft, some have an environment for skins administration

[@ArnarF]

I love the storytelling it brings me back to when I was a kid

[@etopowertwon]

The lore is getting insane!

[@nikoshalk]

Entertaining to watch!

[@bobwillett5663]

Liveoverflow + Mumbo Jumbo colab when? lol that'd be dope

[@asdfghyter]

16:30 This reminds me of a Haskell blog post with the title "Parse don't validate" which is about a very closely related principle: Try to avoid using a validation function that just returns a bool and then later assuming that the invariants from the validation are satisfied, because now the assumptions are completely disconnected from the actual validation. Instead write a "parser" which at the same time both validates and structures the data in a way that enforces as many as possible of the invariants in its structure and then only use the structured (and thus validated) data afterwards. That way you know that any time you have data of the parsed/structured type it must be valid and your compiler's type checker can help ensuring that. The perspective in the blog is more of an "avoiding crashes" than a security perspective, but similar principles apply. The main goal is to reduce the number of possible states of our program, so we can avoid unpleasant surprises. This is also related to the "make invalid states unrepresentable" principle, where you design your types so that only valid states can typecheck. Here's a link to the blog post: lexi-lambda.github.io/blog/2019/11/05/parse-don-t-validate/

[@Zappexe]

Ahh... I was watching video and expecting Zip entries being extracted on disk. Zip itself can contain entry with path traversal, e.g. entry `../../../minecraft.jar` and you potentially could replace original MC jar with a malicious one, I guess.

[@xXEternalisXx]

What About GLSL Shaders aka CoreShaders ? It's basically code in resourcepack, could it be exploited somehow ?

[@nezu_cc]

Is the server still up? If yes then expect my bot on it in the near future ;) Thanks for the motivation to finally finish it.

[@devttyUSB0]

Awesome content!

[@average-enjoyer7]

A bit out of place, but great aesthetics on your creeper farm!

[@istvanbarta]

Since the Minecraft singleplayer world is an integrated server, I wonder if it's possible to join in from outside somehow? Is it possible some talented hacker joins into my singleplayer world somehow?

[@floskater99]

What about ZIP-Bombs as server resource packs? Is that possible?

[@KaseCami]

Is the server still live?

[@abuhamza2771]

Any tips on how to get used to Club Mate? Tastes like 'bongwasser' to me...

[@iradnuriel9087]

Wasn’t expecting scar’s great sfbm music!

[@S4ber_]

Still love your Minecraft video ! =)

[@henke37]

Null byte? good idea. it's my first idea too. but how about... alternative file streams? That's a surprise feature for much file handling code. And then we have the bag of tricks that is reparse points. Sadly, I don't have any experience exploiting those features.

[@MichaelOfRohan]

Damnit, your going to make me 100% oot again..

[@MrTechguy365]

Drinking mate along the way is the best easter egg I have seen in years. Reminds me of me...right now... ... **sip**

[@sandplanet471]

I challenge you to find a item duplication glitch which works on the Minecraft server software known as PaperMC

[@m4rt_]

19:00 can't you use a webserver with flask, and add a custom route that is "/resources.zip" that pretends to be a .zip file but does normal website stuff For example do some shady js stuff, then respond with a file... if that is even posible.

[@bgalcia]

How about a http link that returns a local path redirect? :) Have you tried that?

[@AshtonSnapp]

How do I find the server… _is this an excuse to finally make that Rust minecraft server wardialer_

[@luukvanoijen7082]

ashton i think its time to make that rust minecraft server wardialer

[@codehookin]

i would want your resource pack, but i cant even find it anywhere. Seems you made it private so i have to make my 3d resourcepack

[@0xgodson119]

actually a great video

[@BryceDixonDev]

What about `level://some/malicious/path.txt?/resources.zip`? Now the url string ends in `/resources.zip`, but URL decodr would treat it as part of the parameters? Or does that only apply to HTTP/S?

[@fr0zert]

is the server still online? Are there any tips on how to search (references)? Maybe at least a range of IP addresses?

[@Sch8ill]

Just scan the german ipaddress ranges and identifiy the server by its motd.

[@fr0zert]

@@Sch8ill it's still too much)

[@fr0zert]

@Ryan what cloud did you use and the rate settings?

[@fr0zert]

@Ryan I'm having trouble compiling masscan, and couldn't find a solution on the internet :c

[@fr0zert]

@Ryan how do u get list of all ips of german? i find sites what can only give a city range of ips

[@Oreoezi]

No, armor stands are not the trick! Usually to have blocks with persistent custom data, note blocks and mushroom blocks (both with many modifiable properties which aren't used) are used instead.

[@pigeon_cheesburger]

You have to change the block moddel not just the item moddel.

[@jakob_123]

Nice video 👍

[@redcrafterlppa303]

You missed the fact that your island is slowing down your creeper farm. It is recommended to only place a glass block above to stand on. This works because the game picks spawn attempts randomly between the highest spawnable block and the bottom of the world. This means the lower a farm is built (and all terrain is removed above) the higher is the output of the mob farm since the same amount of spawn attempts are spread between fewer hight layers.

[@danielnielsen24]

If i'm not mistaken, 1.18 actually changed this behaviour, where spawn attempts are made within each subchunk (16x16x16) instead of chunks (16x16) but im not sure lol

[@redcrafterlppa303]

@@danielnielsen24 no that got canceled last minute as far as I know

[@danielnielsen24]

@@redcrafterlppa303 oh well nvm then lmao

[@19joni69]

Der gute Aschenbecher Geschmack von Mate

[@mrbruh_officalvevo]

Hey liveoverflow! No idea if you'll see this but I was one of the people who found your server. I used copenheimer to locate it then I left a sign next to some other people's ones as a calling card. :)

[@Sch8ill]

How did jou get copenheimer!?!?!?

[@friedkeenan]

Hurts me seeing you put your models and such in the minecraft namespace

[@krispyking2450]

if seethium was still up and working then i and a few other people would already have found the server

[@ignvqm]

Server still available? :D

[@tercmd]

Just noticed the reference to Hextree at 1:49

[@LiveOverflow]

👀

[@PartikleVT]

So thats why I like club mate

[@Plexisity]

Try cancelling the damage packets it might make you immortal

[@yiaro222]

goodtimeswithscar

[@dotsubmission]

log4j came along and turned this into a Minecraft channel ❤️

[@JTRNSmedia]

Anyone else thinking: “LiveOverflow Minecraft community server”? Maybe approach your GCP rep with an opportunity to foster a community of (future) security researchers 😉💸

[@fxshlein]

11:23 Welcome to Minecraft development! Nobody really understands... :D

[@MAKMED1337]

12:15 automaGically ?

[@thevideoman12]

Club Mate und Cryptobashing lol, hab grade angefangen den Kanal zu mögen

[@choleralul]

Why is Bitcoin a scam according to you? Could you do a video on it?

[@Delayrix]

this is released after 2 months after recording

[@MisterQuacker]

Have you seen PewDiePies A.S.S.?? It's beautiful. (Automated Sorting System)

[@yiaro222]

i love this

[@mkDaniel]

When you place item it becomes block. That is the problém.

[@idkkdi8620]

Cant use "..", but what about "~"?

[@tg7943]

Push!

[@Ganerrr]

8:16 otherwise smart tech youtuber having terrible takes about crypto part ∞

[@pcsiipher]

I was thinking about how you might be able to get a level file through https. Couldn’t you possibly host a site and on that site a level file is stored so using javascript in the url, you can get the level file through https?

[@ItIsJan]

As a german, i can say, klub mate is very yummy

[@muha0644]

I'm guessing not a lot of people tried to join so you're advertising it?

[@fledermaus7061]

No as he said he doesn't know at the point of recording

[@nullity1337]

cool

[@glorytoarstotzka330]

"crypto is a joke btw. don't get invested in this scam" mind if you elaborate?

[@stacklysm]

8 minutes in and I'm already dead with the crypto jokw

[@BRLN1]

LiveOverflow for next Hermitcraft season!