Problem/Bug Some super weird hackers and a fix for it

Hey. I have this guy that somehow did /eco give <username> 100000 (3 times). And it went through the server 3 times wihout giving an error that he dosen't have permission. According to my permissions file, he does not have (essentials.eco). And he also does not have op.

I really need a fix for this.

 

@Tails_Prower_24 Please follow these instructions

Stop your server
Start your server
Once it's fully loaded, stop it again
Go to your logs folder
Go into the latest.log file
Copy the contents to http://pastebin.com and provide us with the link.

Also, provide the permissions.yml file would be helpful and pointing out what group they are in.

 

@Tails_Prower_24
Also wouldn't hurt to check your ops file, maybe he somehow op-ed himself via a hack? I thought I had heard of a hack like that at some point...

That's the only plausible explanation I can think of. Afaik it would be impossible for him to have a hack that could manipulate a plugin, and the only other thing I can think of is that he somehow gained access to your server files (much much much less plausible).

One other possible explanation is that you somehow accidentally overlooked a permission node in your permissions file. It happens

 

@Rayzr522 You could briefly do it through books because MC added the meta crap to them. That was quickly fixed though and was quite a few versions ago now.

 

@bwfcwalshy

Heres the log: http://pastebin.com/3PFqrr2n

 

@Tails_Prower_24
Did you also check your ops file? Could we see that too?

 

@Rayzr522

Code:

[
  {
  "uuid": "db30c366-3394-4deb-bc22-3230565a0c31",
  "name": "UhhOk",
  "level": 4,
  "bypassesPlayerLimit": false
  },
  {
  "uuid": "a3053ab3-0f25-4eab-a29b-b095b57397e4",
  "name": "DoUEvenGapBruo",
  "level": 4,
  "bypassesPlayerLimit": false
  },
  {
  "uuid": "19fe0948-220f-495f-ad2a-4ce0b3811294",
  "name": "CharlieSant",
  "level": 4,
  "bypassesPlayerLimit": false
  },
  {
  "uuid": "bb5c59c0-37aa-438f-839f-9525257ee36b",
  "name": "TomSant",
  "level": 4,
  "bypassesPlayerLimit": false
  }
]

I deoped him before making this thread.

 

@Tails_Prower_24 and all these are users that you know are opped? UhhOk, DoUEvenGapBruo, CharlieSant, and TomSant?

 

@oceantheskatr

I did not know that uhhhok, Douevengapbro, and Tomsant were opped.

When I go to the console to deop them, it says it cant deop them.

I deleted their sections and restarted the server.

 

@Tails_Prower_24 Have you installed any plugins these people told you to? Likely that it was an infected plugin. Only download from trusted places and from trusted people!

 

@Tails_Prower_24
Type in /deop and then hit tab. It will auto-complete and show all opped players. Are they in that list?

 

@bwfcwalshy No I did not download a plugin they suggested to me.


@ipodtouch0218 Well now it's just me and CharlieSant

But I think I know what might have happened -- So CharlieSant told me that he gave Tomsant account to who is now known as G7s, and Tomsant was an opped player on my server before for testing. Then he changed Tomsant's account to G7s. I am unsure if I deoped him because his name appeared in the opped players yml.

Or

I know that when I told Charliesant that I banned G7s, he told me that he heard G7s talking about a cool hack he got or somethin. I think like Force ______ (Force something).

Here is the permissions file: http://pastebin.com/s6j3KEbK

 

@Tails_Prower_24
There was only one way to OP yourself back in 1.8.whatever, but as @bwfcwalshy said that's been patched. No mod, hack, etc can force OP someone through Minecraft itself (as far as we know). The first options seems more realistic.

 

@ipodtouch0218

My server is 1.8.8

 

@Tails_Prower_24 @ipodtouch0218 The issue was in 1.8.4 and fixed in 1.8.5, 1.8.8 is unaffected by this op bug.

 

Ok. Thank you!