Bot Got Hacked??

[Gamer80]

I woke up this morning and I realized that a guy named "You offered sorry, i am poor" with an private backpack sent my bot offer and eventually taking all my refined metal from my backpack. I made the bot myself and I don't really know what could it be apart from hacking or whatever? 

 

That guy steam acc: http://steamcommunity.com/profiles/76561197966699544

 

Here's my code

var Winston           = require('winston'); // For logging
var SteamUser         = require('steam-user'); // The heart of the bot.  We'll write the soul ourselves.
var TradeOfferManager = require('steam-tradeoffer-manager'); // Only required if you're using trade offers
var config1           = require('./config1.js');
var fs                = require('fs'); // For writing a dope-ass file for TradeOfferManager
var SteamTotp         = require('steam-totp')
var Steamcommunity    = require('steamcommunity');
var Steam 			  = require('steam');
var colors 			  = require('colors');
var TeamFortress2 	  = require('tf2');
var Language 		  = require('./language.js');
var timestamp 		  = require('console-timestamp');

var handlers = TeamFortress2.prototype._handlers;
var client = new SteamUser();
var user = new SteamUser();
var admin = config1.admin

//Price of items
//They are all in scrap
//Calculate it in : https://calculator.tf/

//show price
var showsellkeyprice = 34
var showbuykeyprice = 33.88
var showselltodprice = 13.66
var showbuytodprice = 13.55

//sell order
var sellkeyprice = Math.round(showsellkeyprice * 9)
var selltodprice = Math.round(showselltodprice * 9)
//buy order
var buykeyprice = Math.round(showbuykeyprice * 9)
var buytodprice = Math.round(showbuytodprice * 9)


var manager = new TradeOfferManager({
	"steam": client, 
	"domain": "example.com",
	"language": "en"
});

colors.setTheme({
  silly: 'rainbow',
  input: 'grey',
  verbose: 'cyan',
  prompt: 'grey',
  info: 'cyan',
  data: 'grey',
  help: 'cyan',
  warn: 'yellow',
  debug: 'blue',
  error: 'red'
});

var community = new Steamcommunity();
const POLLDATA_FILENAME = 'polldata.json';

var appid = {
    TF2:   440,
};

var contextid = {
    TF2:   2,
}

if(fs.existsSync(POLLDATA_FILENAME)) {
	try {
		manager.pollData = JSON.parse(fs.readFileSync(POLLDATA_FILENAME));
	} catch(e) {
		log.verbose("polldata.json is corrupt");
	}
}

manager.on('pollData', function(pollData) {
	fs.writeFile(POLLDATA_FILENAME, JSON.stringify(pollData));
});

var logger = new (Winston.Logger)({
        transports: [
            new (Winston.transports.Console)({
                colorize: true, 
                level: 'debug'
            }),
            new (Winston.transports.File)({
                level: 'info', 
                timestamp: true, 
                filename: 'cratedump.log', 
                json: false
            })
        ]
});

var client = new SteamUser();
var offers = new TradeOfferManager({
    steam:        client,
    domain:       config1.domain, 
    language:     "en", 
    pollInterval: 10000, 
    cancelTime:   50000 
});

fs.readFile('polldata.json', function (err, data) {
    if (err) {
        logger.warn('Error reading polldata.json. If this is the first run, this is expected behavior: '+err);
    } else {
        console.log('Welcome back my master.'.green);
		console.log("Found previous trade offer poll data.  Importing it to keep things running smoothly.".info);
        offers.pollData = JSON.parse(data);
    }
});

client.logOn({
    accountName: config1.username,
    password: config1.password,
	"twoFactorCode": SteamTotp.getAuthCode("YpZO9e5\/s9gzgCidJ9G+xt0sh4=")
});

client.on('loggedOn', function (details) {
    console.log(timestamp("[hh:mm:ss] Logged into Steam as " + config1.username.green));
    // If you wanted to go in-game after logging in (for crafting or whatever), you can do the following
    client.gamesPlayed(440);
});

client.on('webSession', function (sessionID, cookies) {
    console.log("Got web session".info);
    client.setPersona(1)
    offers.setCookies(cookies, function (err){
        if (err) {
            logger.error('Unable to set trade offer cookies: '+err);
            process.exit(1); 
        }
        logger.info("Trade offer cookies set.");
		console.log(colors.bold.bgGreen("Currently Price: "))
		console.log(colors.bold.green.bgYellow("Buy : Key " + showbuykeyprice + " Refined Metal."));
		console.log(colors.bold.green.bgYellow("      ToD " + showbuytodprice + " Refined Metal."));
		console.log(colors.bold.cyan.bgYellow("Sell: Key " + showsellkeyprice + " Refined Metal."));
		console.log(colors.bold.cyan.bgYellow("      ToD " + showselltodprice + " Refined Metal."));
		
    });
});

//Chat Command
client.on('friendMessage', function(steamID, message) {
				
		if (steamID == config1.admin) {
			console.log("Friend message from admin: " + message);
		} else {
			console.log("Friend message from " + steamID+ ": " + message);
		} 
		if (message == "hi") {
			client.chatMessage(steamID, "Hi. This is Ashley. How can I help?");
		} else if (message == "price") {
			client.chatMessage(steamID, "Current Price:");
			client.chatMessage(steamID, "Buy : Key " + showbuykeyprice + " Refined Metal.");
			client.chatMessage(steamID, "        ToD " + showbuytodprice + " Refined Metal.");
			client.chatMessage(steamID, "Sell: Key " + showsellkeyprice + " Refined Metal.");
			client.chatMessage(steamID, "        ToD " + showselltodprice + " Refined Metal.");			
		} else if (message == "help") {
			client.chatMessage(steamID, "Available commands: help, price, owner");			
		} else if (message == "owner") {
			client.chatMessage(steamID, "This bot is working for http://steamcommunity.com/profiles/76561198302774496/. Feel free to add my owner if you have any problems.");			
		} else if (steamID == config1.admin) {
			if (message == "code") {
				var code = SteamTotp.getAuthCode("YpZO9e5\/M+9gzgCidJ9G+xt0sh4=")
				client.chatMessage(steamID, "Here is the code " + code + " .");
			}}
		  else {
			client.chatMessage(steamID, "Hi. You can type in help for more command.");
		}
});

client.on('emailInfo', function (address, validated) {
    console.log("Our email address is ".info + address.green + " and it's " + (validated ? "validated" : "not validated".info))
});


client.on('wallet', function (hasWallet, currency, balance) {
    if (hasWallet) {
        console.log("We have ".info + SteamUser.formatCurrency(balance, currency).green +" Steam wallet credit remaining".info);
    } else {
        logger.info("We do not have a Steam wallet.");
    }
});

//Account Limitations
client.on('accountLimitations', function (limited, communityBanned, locked, canInviteFriends) {
    if (limited) {
        // More info: https://support.steampowered.com/kb_article.php?ref=3330-IAGK-7663
        logger.warn("Our account is limited. We cannot send friend invites, use the market, open group chat, or access the web API.");
    }
    if (communityBanned){
        // More info: https://support.steampowered.com/kb_article.php?ref=4312-UOJL-0835
        // http://forums.steampowered.com/forums/showpost.php?p=17054612&postcount=3
        logger.warn("Our account is banned from Steam Community");
        // I don't know if this alone means you can't trade or not.
    }
    if (locked){
        // Either self-locked or locked by a Valve employee: http://forums.steampowered.com/forums/showpost.php?p=17054612&postcount=3
        logger.error("Our account is locked. We cannot trade/gift/purchase items, play on VAC servers, or access Steam Community.  Shutting down.");
        process.exit(1);
    }
    if (!canInviteFriends){
        // This could be important if you need to add users.  In our case, they add us or just use a direct tradeoffer link.
        logger.warn("Our account is unable to send friend requests.");
    }
}); 

//Trade Offer Part
//If you want to change the price, go to the top and find var price.
//It is just for key trade offer only.

manager.on("newOffer", function(offer) {
	console.log(colors.bgBlue(timestamp("[hh:mm:ss] Incoming offer from " + offer.partner.toString())));
	
	//Declining all Trade Holds
	offer.getUserDetails(function(err, me, them) {	
	if (them) {
		if (them.escrowDays > 0) {
		offer.decline();
		console.log(colors.bgRed(timestamp("[hh:mm:ss] They have trade holds. Declining.")));
		client.chatMessage(admin, "User sent a offer with trade hold. Declined.")
		client.addFriend(user);
		setTimeout(function() {client.chatMessage(user, "Sorry. We don't accept offer with trade hold.")}, 10000);
	}}
});
	
	var Rkey = 0
	var Gkey = 0
	var Gmetal = 0
	var Rmetal = 0
	var RToD = 0
	var GToD = 0
	var user = offer.partner.getSteam3RenderedID()
	
	offer.itemsToReceive.forEach(function(item) {
		if (item.name == "Mann Co. Supply Crate Key"){
			return Rkey++
		}
		else if (item.name == "Tour of Duty Ticket"){
			return RToD++
		}
		else if (item.name == "Refined Metal"){
			return Rmetal += 9
		}
		else if (item.name == "Reclaimed Metal"){
			return Rmetal += 3
		}
		else if (item.name == "Scrap Metal"){
			return Rmetal == 1
		}}
	);
	
	offer.itemsToGive.forEach(function(item) {
		if (item.name == "Mann Co. Supply Crate Key"){
			return Gkey++
		}
		else if (item.name == "Tour of Duty Ticket"){
			return GToD++
		}
		else if (item.name == "Refined Metal"){
			return Gmetal += 9
		}
		else if (item.name == "Reclaimed Metal"){
			return Gmetal += 3
		}
		else if (item.name == "Scrap Metal"){
			return Gmetal == 1
		}
	});
		
	//sell key
	if (Gkey || GToD > 0) {
		currency = Rmetal - Gmetal
		if (currency === Gkey * sellkeyprice + GToD * selltodprice) {
		offer.accept(function(err) {
		if (err) 
			console.log(err);
		else 
			console.log(colors.bgGreen(timestamp("[hh:mm:ss] Sold " + Gkey + " Keys and " + GToD + " Tour of Duty Tickets.")));
			console.log(colors.bgGreen(timestamp("[hh:mm:ss] Amount Correct! Accepting the trade offer.")));
			if (Gkey > 0) {
			client.chatMessage(admin, "Sold " + Gkey + " Mann Co. Supply Keys.");
			} else {
			client.chatMessage(admin, "Sold " + GToD + " Tour Of Duty Tickets.");
			}
			setTimeout(function() {client.chatMessage(user, "Thanks for using AshleyBot. http://steamcommunity.com/id/AshleyBot")}, 5000);
		});
	}
	else {
		offer.decline(function(err) {
			if (err)
				console.log(err);
				else 
					console.log(colors.bgRed(timestamp("[hh:mm:ss] Trade offer not validated. Declining")));
					client.chatMessage(admin, "They are buying it for " + currency + " Refined Metal.");
					client.addFriend(user);
					setTimeout(function() {client.chatMessage(user, "Your offer is incorrect. Please check it again or resent it later.")}, 10000);
		});
	}}
	
	//buy key
	else if (Rkey || RToD > 0) {
		currency = Gmetal - Rmetal
		if (currency === Rkey * buykeyprice + RToD * buytodprice) {
		offer.accept(function(err) {
		if (err) 
			console.log(err);
		else 
			console.log(colors.bgGreen(timestamp("[hh:mm:ss] Bought " + Rkey + " Keys and " + RToD + " Tour of Duty Tickets.")));
			console.log(colors.bgGreen(timestamp("[hh:mm:ss] Amount Correct! Accepting the trade offer.")));
			if (Rkey > 0) {
			client.chatMessage(admin, "Bought " + Rkey + " Mann Co. Supply Keys.");
			} else {
			client.chatMessage(admin, "Bought " + RToD + " Tour Of Duty Tickets.");	
			}
			setTimeout(function() {client.chatMessage(user, "Thanks for using AshleyBot. http://steamcommunity.com/id/AshleyBot")}, 5000);
		});
	}
	//Admin give keys to the bot
	else if (offer.partner.getSteamID64() == config1.admin){
		offer.accept(function (err) {
            if (err) {
                console.log(colors.bgGreen(timestamp("Error. Offer not accepted.")));
            } else {
                console.log(colors.bgGreen(timestamp("[hh:mm:ss] Recieved " + Rkey + " Keys From Admin.")));
            }
	})}
	
	else {
		offer.decline(function(err) {
			if (err) console.log(err);
				else 
					console.log(colors.bgRed(timestamp("[hh:mm:ss] Trade offer not validated. Declining")));
					client.chatMessage(admin, "They are selling it for " + currency + " Refined Metal.");
					client.addFriend(user);
					setTimeout(function() {client.chatMessage(user, "Your offer is incorrect. Please check it again or resent it later.")}, 15000);
		});
	}}
	
	//other offers will be declined
	else {
		offer.decline(function(err) {
			if (err) 
				console.log(err);
				else 
					console.log(colors.bgRed(timestamp("[hh:mm:ss] Trade offer not validated. Declining")));
					client.chatMessage(admin, "User provided a wrong offer. Declined.");
					client.addFriend(user);
					setTimeout(function() {client.chatMessage(user, "Your offer is incorrect. Please check it again or resent it later.")}, 15000);
		});
	}});
	
  community.on('confKeyNeeded', function(tag, callback) {
    var time = Math.floor(Date.now() / 1000);
    callback(null, time, SteamTotp.getConfirmationKey('CbkNXcqKOPv9O6s89jnDWy9pyTc=', time, tag))
	console.log(colors.bgGreen(timestamp("[hh:mm:ss] Trade offer accepted.")));
});

offers.on('pollData', function (pollData) {
    fs.writeFile('polldata.json', JSON.stringify(pollData));
});



////Mobile Confirmation Part
client.on('webSession', function(sessionID, cookies) {
	manager.setCookies(cookies, function(err) {
		if (err) {
			console.log(err);
			process.exit(1);
		}
	});

	community.setCookies(cookies);
	community.startConfirmationChecker(15 * 1000, 'CbkNXcqKOPv9O6s89jnDWy9pyTc=');
});

Edited October 25, 2017 by Gamer80

[Enemtia]

At first sight, the number of refined metal is wrong.

 

return Rmetal == 1

return Gmetal == 1

 

It got a fixed value as 1. You need to increase the number of refined metal you have in the trade. This should be increased with:

 

return Rmetal++;

return Gmetal++;

What was in the trade exactly?

[timgfx]

A friend of mine got all his items taken by that exact profile too. The thing is that some guy helped him set up the bot, and could just download the config..