[SEVERE WARNING]Groupmanager Exploit

Well today was one hell of a day for me. Lets begin with the story of how My server got fliped upside-down by a hacker.

It was a regular day, until a user named joined and had a little fun. He had some how, probably with the use of a hack client, managed to promote himself to admin by passing permissions. I hope that this is a flaw with groupmanager as I do not want this fate for any other server owner. Long story short, this guy fucked shit up. I would switch from groupmanager to something more reliable. If you want the whole story then 'pm' me.

 

was your server in offline mode ? as if it was anyone could join with the same name as oneof the admins and have the same powers of the admin

 

There is no way to 'hack' your way past GroupManagers permissions.
You simply didn't setup your server correctly.
Namely, you left the users at default and ran in offline mode so anyone could log in under any name.

 

The same thing has happened to my ServerCraft server twice..

 

@www.elitemincraft.com

This thread is half a year old.

 

same happened to my friend server!
I warned him many times!
now we using PermissionsEX

 

Solution, as suggested by admins and scientists alike.
online-mode=true

 

I hope you realize this thread is a year old.

 

Serious necro-ing going on here

 

actuelly, there is.
i have seen more then one server (my own included) greifed or destroyed by theese hacks.
how can they be stopped is what i need to know

 

actuelly, there isn't. i have never seen one server greifed or destroyed by theese hacks when permissions have been setup correctly. If a server is running in ONLINE mode, and has properly configured permissions/plugins, there is no way someone can "hack" your server. how to configure your server properly is what you need to know

 

hmm, ok.
he probably used some bug exploit i put in permissions accidentally then.
i removed the /manuadd and /manpromote command, but good to know that its probably just configuration.