Note
This project is part of the Lizerium ecosystem and belongs to the following direction:
If you are looking for related engineering and supporting tools, start there.
Warning
This project is published strictly for research and educational purposes.
Its goal is to demonstrate architectural and configuration weaknesses in remote administrative interfaces of Freelancer (2003) servers.
Important
During the research, a remote administrative access issue was identified on a public community server.
The issue was responsibly disclosed to the administrators, and fixes were applied.
For example:
Caution
If similar configurations are still used on other servers, they may be vulnerable to the same risks.
FreelancerAdminAudit is a simple TCP client designed to analyze and test remote administrative consoles of Freelancer (2003) servers.
With it, you can:
- connect to a server’s administrative TCP panel
- authenticate using a password
- send commands to the server console
- evaluate how exposed and insecure remote access is
- reproduce configuration and architectural weaknesses
While researching legacy server implementations for Freelancer (2003), I noticed that some servers use remote admin panels with extremely weak protection:
- open TCP port
- password-based authentication only
- no additional restrictions
- lack of proper network isolation
- overly powerful administrative commands
During testing, I confirmed that under certain conditions, it is possible to access the server’s administrative interface.
This is not a “magic exploit”, but a demonstration of how dangerous misconfigured legacy systems can be.
Depending on server configuration and installed plugins, a remote console may allow:
- reading player information
- accessing character data
- modifying money / reputation / cargo
- kicking / banning players
- executing administrative actions
- managing plugins
- retrieving internal server data
The issue is not a “clever hack”, but the fact that some servers historically exposed powerful admin capabilities with weak protection.
The application:
- connects to a specified IP and port
- waits for authentication prompt
- sends password
- after successful authentication allows manual command execution
- displays server responses in the console
- C#
- .NET
- TCP / Socket communication
- ASCII protocol interaction
- Legacy game server protocol testing
[+] Connection established.
[<] Welcome to FLHack, please authenticate
[>] Sent login: pass test
[<] OK
Enter command: help
[>] Sent command: help
[<] Server response:
[version]
4.0.0-Dormammu plugin
[commands]
getcash <charname>
setcash <charname> <amount>
...
OK
