Collection Mod Unity Virt-A-Mate Mod Assets: Clothing,Environments,Objects,Scenes,Looks,ect.

5.00 star(s) 5 Votes
Discussion Reviews (5)
Status
Not open for further replies.
U

user330033

Newbie
Nov 3, 2020
24
12
celine.dijonnaise said:
You might want to look at the FileManagerSecure portion of the VAM API doc since it shows other ways things can get mangled. Food for thought.. Pretty ridiculous that a plugin can be made that can physically delete files from your system with no user interaction.

Google "Class FileManagerSecure" and its the only result.
Click to expand...
I think it would be a good idea to keep a list of all confirmed infected var's, would make it easier to track who's been sharing this and maybe it will link us to the originator.

IMHO this is a pretty serious exploit for VAM in general. Who would have thought giving "content creator$" free reign to execute arbitrary code would be a bad idea?
 
  • Like
Reactions: Heatwave, Deleted member 2265313, Matze1985 and 1 other person
Bfrop

Bfrop

Member
Dec 22, 2017
361
1,062
Now that the word about the exploit is going to spread, all the weight is going on meshedvr's shoulders.
He has to patch is shit asap.
His game is a fucking trojan horse.
I mean you don't necessarily have to be a disgruntled creator to fuck shit up, anyone could use this just for the lulz.
 
  • Like
Reactions: NakedSnakeCQC
D

dmoot

Newbie
Sep 28, 2020
15
112
Bfrop said:
Now that the word about the exploit is going to spread, all the weight is going on meshedvr's shoulders.
He has to patch is shit asap.
His game is a fucking trojan horse.
Click to expand...
I doubt he'll do anything about it. There's already a warning when you enable plugins, and currently the only affected plugins are pirated ones.
 
Bfrop

Bfrop

Member
Dec 22, 2017
361
1,062
dmoot said:
I doubt he'll do anything about it. There's already a warning when you enable plugins, and currently the only affected plugins are pirated ones.
Click to expand...
B.but...it opens the doors to ransomware... Someone could lock your computer with this, is meshed retarded or something?
Can it runs bitcoin miners? Circumvent firewalls? This is some serious shit.
 
Last edited:
  • Like
  • Haha
Reactions: Robert Monotoli, understandtim, xe02 and 5 others
K

KingSmile

Newbie
Oct 21, 2020
18
37
Bfrop said:
Whoever did this has opened the Pandora's box. It would be a shame if the word was spread out on 4chan, reddit, hacker forums...
Click to expand...
geez :ROFLMAO: it was just a matter of time till someone would bust some shit.. you can just deactivate plugins to stay safe and if you are too lazy to run a quick search.. plugins are mostly free anyway and can be downloaded from the hub and for the looks and scenes you dont need the var, you can also extract them.. tons of options here..
all hail hazard654 - the hero who literally gave everything to reveal this shit..
 
  • Like
Reactions: Bigrabi, frewgew, Heatwave and 3 others
W

whymeazn

Newbie
May 3, 2017
98
449
celine.dijonnaise said:
I just got the same results with "dngrep"
You must be registered to see the links

and its free.

Install, click on options and scroll down to Archive Options. In the "Add" box put VAR and hit the save button.
Select the folder with your VARs, RARs and other archives that you downloaded from here. Next go to the "Search" section and select "Text" then search for FileManagerSecure.DeleteFile(f) and press "search".

This will show you all the files that contain files that call "FileManagerSecure.DeleteFile(f)" in them. Clean them by editing the JSON and delete the script or just delete them, up to you.

Hope this helps.
Click to expand...

Great help, thanks for sharing this tool, didn't know about it!
Question, wouldn't it be better to search for "FileManagerSecure.DeleteFile(" instead? I'm not some crazy computer science guy, but I assume the "f" in the parenthesis is a variable. Future attackers will simply just change the name of the variable from "f" to something else (like x) right?
 
  • Like
Reactions: John McMaster, 3D_Adict, tarlity and 1 other person
celine.dijonnaise

celine.dijonnaise

Member
Dec 1, 2020
132
763
whymeazn said:
Great help, thanks for sharing this tool, didn't know about it!
Question, wouldn't it be better to search for "FileManagerSecure.DeleteFile(" instead? I'm not some crazy computer science guy, but I assume the "f" in the parenthesis is a variable. Future attackers will simply just change the name of the variable from "f" to something else (like x) right?
Click to expand...
I don't know much about this also but that would make sense. Also searching for the "rd(" since rd stands for remove directory. There is no reason a script would need to evoke the rd command that I can think of.
 
  • Like
Reactions: whymeazn
B

beldritch

Newbie
Oct 7, 2020
36
60
Although I recognise the implications of this malicious code, at least MeshedVR implemented this in a safe way which prevents access to files outside of your VAM folder.

I'm guessing based on vague release notes that prior to 1.19, scripts had complete file system access and now they do not.

We can all stay safe from the malicious code by using a simple methodology when trying out new VAR package;

1. Have a sandbox VAM instance where you try out all your new downloads. Be honest - 95% of the shit you download here, you'll never load again! So just pile all your new downloads into your sandbox to check them out.

2. Have a "Favs" VAM instance or whatever you want to call it, where you place any VAR files that you particularly like.


This methodology keeps your "Favs" instance clear of dross that you'll never load again and completely safe from these malicious scripts.
 
  • Like
Reactions: Starfreek, John McMaster, understandtim and 5 others
J

Jeriho3

Member
Aug 13, 2019
148
951
Bfrop said:
Now that the word about the exploit is going to spread, all the weight is going on meshedvr's shoulders.
He has to patch is shit asap.
His game is a fucking trojan horse.
I mean you don't necessarily have to be a disgruntled creator to fuck shit up, anyone could use this just for the lulz.
Click to expand...
I've sent a dm to meshedvr on discord about it with the code that was used and asked him if there anything that can be done about it.. let's see if he replay
We also need someone to start a discussion about it in the official discord to raise awareness and get more attention about this security issue.

Bfrop said:
1. Have a sandbox VAM instance where you try out all your new downloads. Be honest - 95% of the shit you download here, you'll never load again! So just pile all your new downloads into your sandbox to check them out.
Click to expand...
The only good thing from having all of my shit deleted is that now I can rebuild a way more cleaner VAM after everything I know now of what to keep and how to organize stuff better.
 
Last edited:
  • Like
Reactions: Bigrabi, Whudeee19, thamajal and 6 others
M

minh1992

Newbie
Aug 6, 2017
42
8
hazard654 said:
I've sent a dm to meshedvr on discord about it with the code that was used and asked him if there anything that can be done about it.. let's see if he replay
We also need someone to start a discussion about it in the official discord to raise awareness and get more attention about this security issue.


The only good thing from having all of my shit deleted is that now I can rebuild a way more cleaner VAM after everything I know now of what to keep and how to organize stuff better.
Click to expand...
Poor u mate, so it deleted all the things you got ?. Thank u for the warning, i was going to download that file causing you the trouble but it was quite late last night so i didn’t.
 
fixstuffsometimes

fixstuffsometimes

Newbie
Dec 15, 2020
94
492
Yunjitzu said:
this are just the Hairs.
But will test a bit more...
but tried it and looks like it works
Click to expand...
Yeah hairs\clothes will load if U will repack them, VaM is calling them by UID if it can't find them in the declared location. Textures are a different thing tho, their paths must be correct.
I was only talking about dependiency errors caused by missing 'original' vars with hairs if someone would replace them with Yours repack of them. Having both [repack & original] seems kinda silly too cuz of dupes.
And I still got no answer if You doing repacks for looks 1:1, or actually ripping scenes like i do.
The only point I'm doing repacks of looks is to get rid the scenes json files from them, to reduce my total scenes amount and make Vam load menu faster... Having them all in a single var is just a little bonus idc too much.

Don't get me wrong. I'm not trying to attack You, or reduce Urs motivation. I'm actually happy someone started fixing stuff like I do. I was just curious the way U doing stuff. Guess I'm gonna download one of Urs repack and check it out.

/Edit/
Okay, seems like You doing 1:1. I'll pass.
 
Last edited:
Bfrop

Bfrop

Member
Dec 22, 2017
361
1,062
beldritch said:
Although I recognise the implications of this malicious code, at least MeshedVR implemented this in a safe way which prevents access to files outside of your VAM folder.

I'm guessing based on vague release notes that prior to 1.19, scripts had complete file system access and now they do not.

We can all stay safe from the malicious code by using a simple methodology when trying out new VAR package;

1. Have a sandbox VAM instance where you try out all your new downloads. Be honest - 95% of the shit you download here, you'll never load again! So just pile all your new downloads into your sandbox to check them out.

2. Have a "Favs" VAM instance or whatever you want to call it, where you place any VAR files that you particularly like.


This methodology keeps your "Favs" instance clear of dross that you'll never load again and completely safe from these malicious scripts.
Click to expand...
I would very much have the Meshed's confirmation about this.
 
Y

Yunjitzu

Member
Aug 24, 2020
176
773
"The only point I'm doing repacks of looks is to get rid the scenes json files from them, to reduce my total scenes amount and make Vam load menu faster... Having them all in a single var is just a little bonus idc too much."

Thats the Point why i do it...
But with fixing i am still a noob.

Thing is... My English isnt the best.
I am still searching for a German Tutorial but didnt found some.
So its just Learning by Doing xD
 
Status
Not open for further replies.
Top Bottom
5.00 star(s) 5 Votes