spec_goto: How to instantly crash any L4D2 server (and how Admins can patch it)

Valve has hasn't abandoned L4D2 because this was fixed in under 5 days! ORIGINAL POST: TurtleRockStudio's recent announcement of Back 4 Blood has made this clear. It takes L4D1's original developers to create a proper L4D3, 10 years later. If Valve doesn't want to patch an exploit I've personally emailed [e-mail] / https://list.valvesoftware.com/cgi-bin/mailman/listinfo/l4dmapper over twice (first time late 2010), that's on them, not me. I'd urge you to report this guide as I have reported it myself in my own last-ditch effort to get Valve's attention on it, but know that will double as a disservice to legitimate server Admins looking to patch any and all possible crashes. This guide is NOT about pistol duplication: that is a separate, and profoundly obvious exploit whenever somebody does it (and not even traditional lag, it's only because the pistols are constantly colliding with each other).

Some boring history first

You can see for yourself this guide was originally posted Mar 26, 2016 @ 1:54am. At the time, I reconsidered, reported it to Valve channels one last time, making this guide private and forgetting about it.

L4D1 had a well-known exploit where you could freeroam spectate not even that far out of the map to cause the server to lag. Near Death Toll 3's train drop, you've probably even caused lag unknowingly if you were freeroaming there in L4D1.

L4D2 requires this distance to be much larger and was at one point map dependent (L4D2 maps requiring higher values) but that no longer seems to be the case, and they're all equal. So I sought ways to streamline this, finding source code to some esports casting plugin I came across a decade ago, finding "spec_pos" and by dumb luck, "spec_goto". In L4D2's console, you'll see the latter is undocumented:

] help spec_pos
"spec_pos"
 client
 - dump position and angles to the console
] help spec_goto
help:  no cvar or command named spec_goto

It was only natural for a "spec_goto" to exist, since these complement each other (notice how "setpos" is tidily cheat-flagged):

] help getpos
"getpos"
 client
 - dump position and angles to the console
] help setpos
"setpos"
 game cheat
 - Move player to specified origin (must have sv_cheats).

Back in L4D1's final days when Crash Course was new and the L4D2 boycott fresh there was one other undocumented command, "outro_stats_done", which would instantly score the round and end the game. This ran absolutely rampant once made public and within the chaotic unknown of what would become of L4D1, it destroyed the game until Valve was absolutely forced to patch it.

Believe it or not my intent is not to destroy L4D2, I love this game -- too much. Like many, I just disagree with what Valve has become -- and TurtleRockStudios is offering us a fresh breath of air... a fresh start. TRS actually listens.

10 years ago L4D1 even had niche server plugins that detected this abusive behavior even though more often than not it was accidental and unbeknownst to the perpetrator -- so I'm sure you can understand my bewilderment in the L4D2 community's collective forgetfulness that it was ever a thing.

It was long my outright (and wrong) assumption that competitive servers protected against (or even instantly banned with maximum prejudice) use of this ludicrously infantile exploit, because a fix has been public for 2 years. I've run my own servers and ignore competitive play -- it was not until sharing this with a temporary acquaintance https://steamcommunity.com/id/sharkybeats who plays competitively that I learned every single L4D2 server out there succumbs to this exploit. One simple bind that invalidates any and all administrative efforts with IPtables etc. to block crashers, and Valve's proven ineptitude in fixing it.

Legalities and technicalities

https://en.wikipedia.org/wiki/Denial-of-service_attack

DDoS'ing is illegal. It's utter crap. Don't ruin company and family livelihoods that way.

DoS's come in many forms, and "spec_goto" certainly is one. However, its origins are from situations in L4D1 where people were unknowingly causing server lag just by doing something as innocent as freeroaming to those pretty 3D skyboxes you've probably found lying outside each map if you've ever floated about yourself.

http://www.l4d.com/blog/

An update has been released for Left 4 Dead. - Dev command 'director_log_scavenge_items' can only be executed by the server. Reported via HackerOne.

To my awareness, Valve has only ever patched DoS's that flood the server with evidence, in the above case GB's worth of server log data.

https://old.reddit.com/r/Steam/comments/5ghjlf/vac_banned_trying_to_make_server_plug_ins/dasgtib/

However, "spec_goto" leaves absolutely ZERO evidence of what caused it. There is no empirical or quantifiable evidence the command is even a problem, and this is why Valve ignores it.

DDoS'ing, however, is always accompanied by mounds of evidence, with its primary preventative measure being strong IPtables.

https://javapipe.com/blog/iptables-ddos-protection/

Idiosyncracies & the buffer overflow

This is a bit of a lazy eyesore but works all the same -- even 1 less 9 will NOT crash the server:

spec_goto 999999999999 999999999999 999999999999 0 0

The angles are necessary but can be 0. In actuality, only the XY->Z<- value matters.

This will NOT crash any L4D2 server / map:

spec_goto 0 0 274877923328.0 0 0

But this WILL:

spec_goto 0 0 274877923328.1 0 0

And so will this:

spec_goto 0 0 274877923328.0001 0 0

Beware the infinitesimal nature of if it's at all above 28.0 your spectator entity's coordinates become a dangerous command. The decimal has nothing to do with it, you could round it to 29 and it'll still crash -- it's only there to illustrate how quirky it is.

Additionally, if you use the highest possible value that does NOT crash a server, then follow up with "spec_pos", you'll actually see that the maximum Z that can be achieved is:

274877906944.0

Keeping in mind that 274877923328.1 or beyond will result in a crash.

Now let's look at our power of 8's:

8 16 32 64 128 256 512 1024 2048 4096 8192 16384 32768

274,877,923,328 (the rounded value Z must be to crash the server)
- 274,877,906,944 (the highest value Z can actually be without ever going over)
= exactly 16,384 -- this is no coincidence.

From the best I've been able to discern from only hobbyist intrigue in netsec, this is a buffer overflow vulnerability:

https://en.wikipedia.org/wiki/Buffer_overflow

In short, the actual value of 274877923328 has no significance, as it's instead the difference from the absolute maximum Z that identifies it as a buffer overflow.

Malformed parameters & unknowns

I can think of at least one application where this could be employed to more nefarious extents that's mostly beyond the scope of just crashing a server and perfect grounds for necessitating the severity of this decade overlooked joke.

But just to give you an idea:

Malformed parameters can be fed into "spec_goto" to revive original behavior seen towards L4D1's release where it was possible to i.e. "kick smoker" on Coop Campaign play on Official Servers. However, there's lots of quirks -- and no, I'm not talking about "callvote kick #" that can be used to kick Smoker bots when you're SI in Versus, but rather kicking SI bots as Survivor.

And deleting players on the opposing team -- I'm not talking kicking, but the same "CBaseEntity::Input kill ()" you'll see if you're still inside when the Dark Carnival 5 finale is started. You might know that you can interrupt bots from healing players as Infected... this extension is related, and not open for public disclosure.

And I really am kind of scared what other unknown possibilities there are.

The attack

1. Basic settings:

OPTIONS > Keyboard/Mouse > ALLOW DEVELOPER CONSOLE > Enabled
OPTIONS > Multiplayer > SPECTATING FREE LOOK (spec_allowroaming) > Enabled

2. Open up console and bind it to your delete key, since you're basically heartless if you hop around random servers doing this:

bind del "spec_goto 0 0 274877923328.1 0 0"

If that number is even 1/10th of a unit smaller it will NOT overflow.

3. Join any L4D2 server in existence -- they're all unpatched, even competitive, but if you use it on any populated server you are the bane of L4D2 toxicity.

4. Die and enter freeroam.

5. Press delete.

For Admins

Made for CS:S, but will work for L4D2 as it's basically a mod:

[CS:S] spec_goto crash fix https://forums.alliedmods.net/showthread.php?p=2484329

It only makes sense for "spec_goto" to be cheat-flagged, as bewilderingly similar commands forever have been.

L4D1 can only have servers lagged by spectating very minor distances outside of maps, unlike L4D2 where it exclusively crashes on overflow. For years it was my assumption that in L4D2 there'd be some lower / upper boundary that'd cause lag but not instantly crash, but this is not the case: there is no lag up to reaching the limit, only instantaneous crashing. Interestingly, your Z is actually permanent once you reach the 274877906944.0 maximum even if you were to move (though X / Y and angles still change).

Furthermore, the instantaneous crash can only be triggered by this command -- manually moving to the 274877906944.0 limit would take a lifetime and you'd not be able to exceed it by the required 16384 to trigger the crash.

Exposure

All L4D2 servers fall for this crash.

SO FAR, I've made efforts to contact the following groups and this will be fixed on competitive servers soon enough:

https://steamcommunity.com/groups/SirPlease

https://steamcommunity.com/groups/ServerError404

And even though I hate them, Hentai land:
https://steamcommunity.com/groups/lewd4dead/discussions/0/1850323802585382330/

Again it was my profound assumption those communities already protected against the ancient act of spectators causing lag.

As word of mouth spreads the goal here is for Valve to finally patch this exploit -- but in seeing their utter disregard for not addressing the fact they disabled addons in Versus but mods can still be applied via workarounds... I'd be stunned if they did, and it won't be for years, because unlike other vulnerabilities this leaves no traces and is entirely gameplay-triggerable (discounting the fact that it'd take a very long time to cause this crash without command use).

In closing

I've been Googling this command yearly for a decade and 2017 was the first time anybody ever started talking about it... and not even a single mention of L4D.

Over the years amidst Valve's cold shoulder I have inquisitively shared this with the occasional person as a way to sanely actualize it as an actual thing when it's hard to believe it is just that simple and maximally effective. I'd be lying if I were to claim I've always been a pristine saint with regard to use of this crash, primarily reserving it for the profoundly obvious hacker given Valve's knack for doing nothing about them in L4D2 and the tunnel vision in which opponent teams have when they do have a legitimate cheater but do not kick -- in most cases of my use, a Lobby vote would've tied or passed anyway. However, the problem is people who are doing this exclusively to grief now, with zero end in sight for a patch. One exception is Lewd4Dead / Hentai servers -- IP blocking only gets so far, if I ever randomly end up on one of their servers I end them without hesitation as they are just squatting malicious script... and that being said, I'd recommend blocking MOTD's (Windows > Win+R > wf.msc > Block Ports 80 & 443 for left4dead2.exe).

I have never tested this in games besides L4D, but when you think about Versus games being a 1 hour investment of time where 1 bind can just shut it all down... it is a disastrous and despicable oversight for Valve to ignore fixing it.

So... let hell rain until they actually do.

And, Valve? While you're at it fix that "jointeam 2 name_of_taken_survivor" invincibility and ghost speed exploit too. It's inexcusable.

[Door stuck]

just here to say Back 4 Blood is a terrible game and has been since launch.
And also, My servers have been crashed 2 times today and I just turned it off :/

[Tsuey]

I can't account for wild usage. Valve should've cheatflagged spec_goto.

[MrKrailex ツ]

F

[Tsuey]

To be clear, this guide was written in 2016 and made private as I reported it one last time -- then forgot about it. It was made public only recently, gained traction, and was promptly patched.

But yes it is a 10 year old exploit that's existed since L4D1... hopefully they patched L4D1 too? But idk.

[SeriouS_Samurai]

but this was posted 2016, so it took 3 years until it was fixed?

[Tsuey]

Thanks to everyone reporting this across various channels -- HackerOne, Steam Support, Reddit, Discord, and social media -- to get this patched in only 5 days.

[Tsuey]

Left 4 Dead 2 - Update
March 27, 2019 - L4D Team

An update has been released for Left 4 Dead 2. - Fixed a spectate command exploit that caused servers to hang. - Fixed lobby chat messages not appearing on Linux.

[Tsuey]

https://hackerone.com/valve + "The following items are considered out-of-scope for all Valve offerings:" = "Denial of Service Attacks."

To all naysayers who have said this report belongs on HackerOne -- Valve explicitly says DoS are out-of-scope... especially when it leaves no traces.

They have ignored at least singular reports -- volume may speak differently, though.

[76561198448966597]

F

[Leslo]

nice #fixcsgo destroyed csgo, now this will destroy l4d. GJ FAG