Minecraft

  • 🔎 If you see an alert for analytics.usips.org, this is a self-hosted system I am running as a test. It is GDPR compliant and collects no invasive information.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
StacticShock said:
https://youtube.com/watch?v=hJ62mQukdicis he for real a gay chud? zamn chuddies be diverse...
Click to expand...
1783811130802.png
bruh.
 
Another RCE exploit has landed.

The Vulnerability​

The vulnerability is that the filename is not sanitized. By supplying a filename like ../../mods/evil.litematic.jar, the path resolves outside the schematics/transmit/ directory and into the mods/ folder. Since the file is written as-is (not validated as a real schematic), any arbitrary JAR file can be deployed and loaded as a Fabric mod on the next client restart.

Litematica has already posted patches in version 0.26.11 for Minecraft 1.21.x. Clients running patched versions are not vulnerable. I found the message about the existence of this vulnerability in the DupersUnited Discord server and started digging into Litematica's source code, comparing the patched version against the unpatched one to understand the exact mechanism.

How the Exploit Works​

  1. Server-side Fabric mod registers a payload on channel servux:litematics.
  2. When a client connects, the server fabricates three NBT-compound packets matching Litematica's schematic transmission protocol (TransmitStart, TransmitData, TransmitEnd):
    • TransmitStart: declares the filename, file type, total size, and slice count. The filename is ../../mods/<payload>.litematic.jar.
    • TransmitData: contains the raw bytes of the payload JAR.
    • TransmitEnd: signals completion so Litematica writes the file to disk.
  3. Litematica receives these packets, resolves the filename against schematics/transmit/, and writes the payload to .minecraft/mods/<payload>.litematic.jar.
  4. On the next client restart, the payload JAR is loaded as a mod.
Each message is sent as its own PacketSplitter session with 2-tick delays between them to ensure the client processes them sequentially.
 
Last edited:
Wiggerlicious said:
Doesn't even matter. An intersection between the mechanics of copper golems and lodestones created an exploit which players can abuse to teleport infinite distances. 7 months after its discovery Mojang still hasn't patched it despite it trivializing all other transport methods.
https://youtube.com/watch?v=QFs1zEXVQgk
Click to expand...
I think that's cool, and autistic enough to be too frustrating for most people to bother with.
 
Nameless One said:
I think that's cool, and autistic enough to be too frustrating for most people to bother with.
Click to expand...
Fair, but I think it's indicative of Mojang giving up on limiting players entirely, and being unwilling to balance features due to the fear of outrage. The machine is also a lot cheaper than you might think, with the crucial components being copper golems, lodestones and ender pearls, all items which are incredibly easy to obtain.
 
We were on the topic of those crazy modern builds a little bit ago, and the main dude in that space, Shovel, uploaded a video doing all that.
This is what I mean when I say I respect the builders who take Minecraft to the extreme, just watching the video I learned a lot of technical details and various techniques I’ll be using. In my opinion, I really like seeing how far people can push the game as a way to make art.
 
I apologize for not staying with the topic, I just wanted to come in here and mention how much better PolyMC is than the regular Minecraft launcher, as well as half of the alternatives (CurseForge, Prism, Modrinth)

It just works. There’s no fluff, gay bullshit like Bedrock and movie promos added on to eat up resources and make the interface a cluttered ADHD nightmare. I mean, why is it necessary to have an entire section for news about DLC for a version of the game that isn’t the focus of the launcher? Why does the entire UI need to be reskinned every time a new update comes out? I miss the old Minecraft launcher and its emphasis on function. Minimal graphics, the only news section listing features of the recent patches, etc. Add the better modding support, profile separation and offline mode support on top of that, and I can’t imagine accessing Minecraft in a more robust way.

Using such a solid piece of software for something so trivial makes me upset that gay globohomo fag shit and jeets have rendered functional, visually appealing software a rarity worth commending.
 
I don't understand the Prism hate. Like sure, they're faggot redditor developers, but it's functional and it doesn't change its appearance for fag month or shout trans rights at me randomly.
 
Dante Alighieri said:
Letting a rainbow icon be a dealbreaker is retarded. I'm not inconveniencing myself to avoid a rainbow icon I never meaningfully see.
Click to expand...
In 2026 software devs being faggots is par for the course, but Prism’s entire existence was brought about by hysterical tranny faggots attempting a hostile takeover of a software that rightfully tried to remain apolitical. PolyMC is based for standing firm in the face of that hostility. Hostility which, by the way, included the entirety of Prism’s dev team and userbase smearing PolyMC as malware and its sole developer as a malicious, bigoted thief and control freak, and still continues to this day in most Minecraft modding communities. You are retarded niggercattle if you still willingly support the devs of Prism after knowing everything they’ve done to fuck with one guy for not caving to tranny screeching.

It also works exceptionally well and is still updated, so the excuse of there being no readily available or sufficiently functional alternatives to Prism is invalid.
 
StacticShock said:
wtf do you mean with that? why waste time trying to fight prism to get offline mode when other options offer that from the get go?
View attachment 9268631
Click to expand...
It's not a checkbox or option, but it *was* doable with a terminal command or file edit. I also don't give a shit about offline mode, but if I did then I would use PolyMC.
Super Dilator Duel 3D said:
You are retarded niggercattle if you still willingly support the devs of Prism after knowing everything they’ve done to fuck with one guy for not caving to tranny screeching.
Click to expand...
lol at"willingly support" as if I'm giving them money, or they get anything from my installation via the AUR.
Super Dilator Duel 3D said:
It also works exceptionally well and is still updated, so the excuse of there being no readily available or sufficiently functional alternatives to Prism is invalid.
Click to expand...
1783988136742.png
Prism works for me, and I really don't give that much of a shit about offline mode.
 
Dante Alighieri said:
lol at"willingly support" as if I'm giving them money, or they get anything from my installation via the AUR.
Click to expand...
Dante Alighieri said:
Prism works for me, and I really don't give that much of a shit about offline mode.
Click to expand...
Fair enough. I don't really care what you use, I just hate trannies. Apologies if I sounded needlessly hostile.
 
You must log in or register to reply here.
Back
Top Bottom