[Open Source] CryptoBlackJack & CryptoDice Gambling Scripts

[LOBSTER]

I can check out the blackjack script and see if any of jonnys work is in there. The newbie verifications in this thread doesn't instill a lot of confidence here. Scripts have been long posted here that led to thefts and backdoors, so downloaders beware.

Well, that didn't take long.  At least for the blackjack, this is a pirate copy of johny1976's coinjack.

Install from the OP

Code:

if (isset($_GET['checkCons'])) {
  if (@!mysql_connect($_POST['db_host'],$_POST['db_user'],$_POST['db_pass']) || @!mysql_select_db($_POST['db_name'])) {
    header('Location: ./?step=3&db');
    exit();
  }
  $included_=true;
  include __DIR__.'/db_data.php';
  
  $db_file=fopen('../inc/db-conf.php','wb');
  fwrite($db_file,"<?php \n");          
  fwrite($db_file,'$conf_c=true;'."\n");          
  fwrite($db_file,'mysql_connect(\''.$_POST['db_host'].'\',\''.$_POST['db_user'].'\',\''.$_POST['db_pass'].'\');'."\n");
  fwrite($db_file,'mysql_select_db(\''.$_POST['db_name'].'\');'."\n");
  fwrite($db_file,'mysql_query("SET NAMES utf8");'."\n");
  fwrite($db_file,"?>");      ?><?php
  fclose($db_file);

Install from official Coinjack:

Code:

if (isset($_GET['checkCons'])) {
  if (@!mysql_connect($_POST['db_host'],$_POST['db_user'],$_POST['db_pass']) || @!mysql_select_db($_POST['db_name'])) {
    header('Location: ./?step=3&db');
    exit();
  }

  $included_=true;
  include __DIR__.'/db_data.php';
  
  $db_file=fopen('../inc/db-conf.php','wb');
  fwrite($db_file,"<?php \n");          
  fwrite($db_file,'$conf_c=true;'."\n");          
  fwrite($db_file,'mysql_connect(\''.$_POST['db_host'].'\',\''.$_POST['db_user'].'\',\''.$_POST['db_pass'].'\');'."\n");
  fwrite($db_file,'mysql_select_db(\''.$_POST['db_name'].'\');'."\n");
  fwrite($db_file,'mysql_query("SET NAMES utf8");'."\n");
  fwrite($db_file,"?>");      ?><?php
  fclose($db_file);

As I said...but he meant that he fixed some bugs.

[elm]

I can check out the blackjack script and see if any of jonnys work is in there. The newbie verifications in this thread doesn't instill a lot of confidence here. Scripts have been long posted here that led to thefts and backdoors, so downloaders beware.

are there many open source gambling scripts with backdoors on github?

[johny1976]

due to me giving this away for free there have been some "authenticity issues", I can assure you this is authentic and working and can only suggest you get someone with PHP skills to read through if you are unsure. - I cannot emphasise this enough.

And it's also copyrighted. Please stop sharing our scripts for free.

SCAMMER

I recommend everyone not to download this backdoored versions of our software. These are not even the latest versions and contain security bugs.

If you buy full license from us, you'll get free lifetime support + updates. See my signature.

[elm]

confused now...where are the backdoors? who is honest here? what is going on here? I cant code so I cant check. whom can I trust?

[LOBSTER]

confused now...where are the backdoors? who is honest here? what is going on here? I cant code so I cant check. whom can I trust?

So true...best option: develop your own script!

[cloverme]

As I said...but he meant that he fixed some bugs.

Sorry, I missed your post on it too. I went through some of the code, but not all of it. Since it's a pirate copy, who knows if it has any exploits in there or not, my advice is to avoid the pirate copy and just buy the script from johny if you want it.

[LOBSTER]

As I said...but he meant that he fixed some bugs.

Sorry, I missed your post on it too. I went through some of the code, but not all of it. Since it's a pirate copy, who knows if it has any exploits in there or not.

At first he should tell us which bugs are in the script and how he fixed it. That would help to trust and retrace.

[TechnoBibble]

For Your Information, I have just found a backdoor in /admin/login.php

Please see this post (https://bitcointalk.org/index.php?topic=908996.msg9994462#msg9994462)

[elm]

confused now...where are the backdoors? who is honest here? what is going on here? I cant code so I cant check. whom can I trust?

So true...best option: develop your own script!

I cant code ( so what should I do?

[cloverme]

Everybody should remove this ASAP. You don't know what else could be hidden in here.

I am unsure what MD5 password this ("6d2aff483952d904179ca0c8c536a2c7" ) hash is, maybe someone with more experience in cracking password would know.

cloverme, I am assuming you have the original game? What line is meant to be in login.php?

I do have the licensed game yes, none of that code is in there, so it looks like you found the exploit in scammers attempt.

[johny1976]

confused now...where are the backdoors? who is honest here? what is going on here? I cant code so I cant check. whom can I trust?

Just compare his modified admin login script with our original:



(original) https://i.imgur.com/NjX9IW5.png
(backdoored) https://github.com/felinegambler/CryptoDice/blob/master/admin/login.php

This should help you guys make clear who is the scammer here. :-)

[cloverme]

confused now...where are the backdoors? who is honest here? what is going on here? I cant code so I cant check. whom can I trust?

Just compare his modified admin login script with our original:



(original) https://i.imgur.com/NjX9IW5.png
(backdoored) https://i.imgur.com/NjX9IW5.png

This should help you guys make clear who is the scammer here. :-)

You posted the same image by accident.

[johny1976]

confused now...where are the backdoors? who is honest here? what is going on here? I cant code so I cant check. whom can I trust?

Just compare his modified admin login script with our original:



(original) https://i.imgur.com/NjX9IW5.png
(backdoored) https://i.imgur.com/NjX9IW5.png

This should help you guys make clear who is the scammer here. :-)

You posted the same image by accident.

Thank you, corrected.

[redsn0w]

Scam accusation against you : https://bitcointalk.org/index.php?topic=909282.0

 Please try to resolve it ( I've left you a negative trust for only a questio of security , when you will resolve this situation I will remove it).

Thanks for the attention , have a great day .

[TechnoBibble]

I have posted a scam report in "scam accusations"

Please post what else you find in there - https://bitcointalk.org/index.php?topic=909282.0

johny1976, Do you have a link to your version that I can put in the solution?

[redsn0w]

I have posted a scam report in "scam accusations"

Please post what else you find in there - https://bitcointalk.org/index.php?topic=909282.0

Thanks I've seen it. Now I suggest to leave a negative trust to  the OP ( for a security reason , it will remove when all the situation will be clarified).

[johny1976]

I have posted a scam report in "scam accusations"

Please post what else you find in there - https://bitcointalk.org/index.php?topic=909282.0

johny1976, Do you have a link to your version that I can put in the solution?

https://bitcointalk.org/index.php?topic=718910.0 - CoinJack
https://bitcointalk.org/index.php?topic=507515.0 - CoinDice

It's also in my signature.

[TechnoBibble]

I have posted a scam report in "scam accusations"

Please post what else you find in there - https://bitcointalk.org/index.php?topic=909282.0

johny1976, Do you have a link to your version that I can put in the solution?

https://bitcointalk.org/index.php?topic=718910.0 - CoinJack
https://bitcointalk.org/index.php?topic=507515.0 - CoinDice

It's also in my signature.

lol, did not see in your sig, I tend to ignore them

added to post.

[elm]

but to  be frank Johnny has the worst support for his Black Jack script IMO please see here
https://bitcointalk.org/index.php?topic=718910.0

[LilGhost]

The admin login page is vulnerable to SQL injection.

Code:

mysql_query("INSERT INTO `admin_logs` (`admin_username`,`ip`,`browser`) VALUES ('".$_SESSION['username']."','".$_SERVER['REMOTE_ADDR']."','".$_SERVER['HTTP_USER_AGENT']."')");

This line is vulnerable to SQL injection if an attacker sends a custom user agent.


Edit: This is a recurring issue through out the script. Frequently the script records the user-agent without sanitizing it first.