Server got hacked and hacker got Owner rank
XDRmc opened this issue ยท 6 comments
So One day I joined my server to see everything was griefed. I checked the console to see they have done world edit commands. but They should not have had permission. I checked the Luckperms editor and 3 people that are not staff on the server had OWNER rank.
I cant rly say the steps because IDK how they got owner
Erm... not give owner to random players???
Environment details
- Server type/version:
papermcrunning version1.17.1latest build - LuckPerms version: 5.3.52 also using mysql accross 1.16.5-1.17.1 servers
This is the console: https://hastebin.com/ekutubaqun.yaml
I did not give perms to do /promote
By the way the log is in the kitpvp server not anyother servers. other servers got griefd to
[14:53:59] [LoginProcessingThread/INFO]: UUID of player Asi33r is d318071e-f37d-3f9f-b991-04dcbcca479e This is an offline mode uuid. So there is 3 possible issue that are all unrelated to luckperms:
- You want the cracked client to join your server, so you allowed offline-mode UUID (you really shouldn't)
- Your backend IP is not secure behind firewall, so a player manage to bypass your bungeecord and join the server directly.
- A bungeecord config issue cause wrong uuids to happen, steps to check:
How do i fix: Your backend IP is not secure behind firewall, so a player manage to bypass your bungeecord and join the server directly.
How do i fix: Your backend IP is not secure behind firewall, so a player manage to bypass your bungeecord and join the server directly.
That is completely dependent on how your server is hosted. There is no one answer to it.
bungee mode was not enabled on 1 server but was on others so it is not: 3. A bungeecord config issue cause wrong uuids to happen, steps to check thingy.
One server having the wrong config is all that is needed to cause the problem. Assuming you synced permissions data (which you should), they basically can obtain admin perms for all servers if they comprise just one server.
Just to be clear, this is not a bug with luckperms nor luckperms can do anything about it, it's your server level setup that is the issue.
bungee mode was not enabled on 1 server but was on others so it is not: 3. A bungeecord config issue cause wrong uuids to happen, steps to check thingy.