Resource CK Mods v41 Mod 41

[Delta19]

Me as a simple member of this graet site I would like to understand why the person is wrong!

 

[kimo007]

Me as a simple member of this graet site I would like to understand why the person is wrong!

plz try the commande

curl "http://127.0.0.1:80/system_api.php?...on=stop&stream_ids[]=1&password=1111111111111"

127.0.0.1 = change whit ip of any lb u have
80: port of lb
=1 het id of channels u want stop hem
1111111 = u Live Streaming Pass

 

[GTAXUI]

Because the API is IP and password restricted. If you somehow got the live streaming password for someone's server, you still wouldn't be able to do anything as the API wouldn't allow you in without being in the authorised IP list. That list consists of the load balancer IPs, 127.0.0.1 (localhost) and any IP you've added to the list manually in the settings page.

There's no way around this, the information you're being fed is just false.

 

[GTAXUI]

plz try the commande

curl "http://127.0.0.1:80/system_api.php?...on=stop&stream_ids[]=1&password=1111111111111"

127.0.0.1 = change whit ip of any lb u have
80: port of lb
=1 het id of channels u want stop hem
1111111 = u Live Streaming Pass

Well obviously that would work IF you're running it from the server you own, as your IP is verified. Try running it from your mother's basement and let me know the results.

 

[akawi11]

i will explain again the backdoor


curl "http://(ipofloadbalance)portloadbalance)/system_api.php?&action=stream&function=stop&stream_ids[]=(idofhannels)&password=(Live Streaming Pass)"

example

curl "http://127.0.0.1:80/system_api.php?...on=stop&stream_ids[]=1&password=1111111111111"


find Live Streaming Pass is easy whit scan
ip of lbs, juste do wget of any stream u can find ip and port

rest is use putty and done, u stream is stop

what you mean exactly with "find Live Streaming Pass is easy whit scan " ??

 

[GTAXUI]

what you mean exactly with "find Live Streaming Pass is easy whit scan " ??

He has no idea what he's talking about. The absolute best you can do with bruteforce is get the md5 hash of the streaming pass but that's useless for the supposed exploit he's talking about

 

[akawi11]

Because the API is IP and password restricted. If you somehow got the live streaming password for someone's server, you still wouldn't be able to do anything as the API wouldn't allow you in without being in the authorised IP list. That list consists of the load balancer IPs, 127.0.0.1 (localhost) and any IP you've added to the list manually in the settings page.

There's no way around this, the information you're being fed is just false.

i think he is trying to explain a new thing
firstly
....system_api.php... it's not related to table "api_ips" and "api_pass" in setting
"api_ips" and "api_pass" in setting is related to ...api.php...

you say "any IP you've added to the list manually in the settings page."
that's wrong when we talking about system_api.php

the thing is all LB IP's are authtorised IP's to access to system_api.php
it's not a backdoor because it's need access ssh to LB servers

to understand the issue
test what he say about stop start stream from any of the LB servers for same stream ID even not added any IP in authorised ip list or not put api password


the bug is if you have non working LB in your manage servers, so it's an authorised IP
try to put your public IP as new LB in manage servers
and try to access to http url in your browser

http://iplbserverortlbserver/system_api.php?&action=stream&function=stop&stream_ids[]=831&password=11111
you will see "{"result":true}"

so the bug is do not leave any offline server in manage server that you not have access to it

and need also to talk about attack "live_streaming_pass"

 

[Delta19]

@ cesarkrespo thanks a lot for your work great man

/stream_stats.php giving page not found!!

 

[mr.more]

thank you so much

can you please check this problem ?

After extending a line, the bouquets will be Selected again for that line

@cesarkrespo


Please Can you check this problem ?

?????

https://imgur.com/PIqpbd3

 

[lenske]

Added Download Playlist inside edit user ( admin and reseller - device mags and users )

Thanks for update ..can you add ISP LOCK and FORCED COUNTRY option in Reseller Packages ? like this so resellers can choose by default ISP LOCKED packages and in edit User Forced country option..please check this photo..https://prnt.sc/15pqzfx

 

[urgodfather]

Thanks for update ..can you add ISP LOCK and FORCED COUNTRY option in Reseller Packages ? like this so resellers can choose by default ISP LOCKED packages and in edit User Forced country option..please check this photo..https://prnt.sc/15pqzfx

That is admin function! Do your job or make them admin.

 

[lenske]

ok i think it would be helpful if packages had option from default ISP LOCKED

 

[noris]

@cesarkrespo


Please Can you check this problem ?

?????

https://imgur.com/PIqpbd3

No have problem here, check what bouquets have included in 1M package.

 

[mr.more]

No have problem here, check what bouquets have included in 1M package.

1M package is selected All bouquets

After Extending the bouquet changes will go back to default packages selection

 

[urgodfather]

ok i think it would be helpful if packages had option from default ISP LOCKED

Just enable isp lock and it will apply to all packages. Restreamers are omitted.

 

[lenske]

Just enable isp lock and it will apply to all packages. Restreamers are omitted.

i have enabled ISP LOCK but when creating packages and subscriptions by default is off the ISP LOCK

 

[darkunited]

@cesarkrespo you are the king, mods 29 is great, you did a great thing with this mod. thank you

 

[evo]

I am having users that do not disconnect even after 10 hours+. I searched and i found that is an issue with user_activity_now table, but how can i have this resolved? Is the fact that i have the lb's on ubuntu 20.04 and the main on ubuntu 18, a potential issue? Thank you!

 

[cesarkrespo]

I am having users that do not disconnect even after 10 hours+. I searched and i found that is an issue with user_activity_now table, but how can i have this resolved? Is the fact that i have the lb's on ubuntu 20.04 and the main on ubuntu 18, a potential issue? Thank you!

 

[evo]

Thank you, i will try that and update.