Hacked Server- Need Help

Thanks for all the help guys i will tell this to the new owner. I am quitting the server and he will take over now. He is deleting all plugins and redoing theme

Is there a plugin you have that deletes the worlds? If not then this sounds like someone is accessing your login to the server. Did you try changing your password? If you did then you may be on somebody's "hate" list if they want to do it so badly. It's actually not uncommon to have developers insert code or their own modified versions of things where if they are kicked off a team they can use it as a backdoor where they can only control it. Although this sometimes happens with big companies or some sort of development project if anything but not usually game servers, but it is indeed possible.

At one point he gave himself and some other people the * perm. i ended up tracking them all down. removing all perms they ha banning them ip banning them and we were fine. for 2 days. than somehow magically someone the * perm. but it said give by console and no one has access to console besides me. I was reading this in logs. but my friend calls me on the phone while i was asleep screaming to get online because they game back and deleted all worlds and etc. luckily i was able to get the worlds back. took me a couple minutes to fix the griefing. and they removed all mines but i rolled back globally 24h which somehow fixed all mines i created. But main thing here is that this just happens. none of them are online, none of them and bang unban unbanip ban admin deep admin remove * from admin all of that in less than 2 seconds.

Let's stop playing chase and remove or lock all permissions to the plugins so the Minecraft server can't read them. This will see if there's a plugin causing this or if he's using a "backdoor" to the server. This could be an exploit to all servers if we don't have it down to a plugin (I know a few big Minecraft exploits myself). Also if you want to get rid of them you can't rely on Minecraft's banning mechanisms, you have to go to the very bottom to where if Minecraft was at fault, they would have to get past another security measure. And if that's the case.....the server host is eating you alive as most of the time you can't control that.

He may have given himself the * permission if he had access to perms * permission basically means perms for everything

I have all plugins and .yml and config and everything needed. for some reason i can't find anything strange. well i guess thats intently so i don't find the auto op. Sorry for the later response i will be on tomorrow to continue conversation

Do you have a list of plugins installed on the server?

Well it is a mine craft server. I just got this new host quality node. I have had 25-60 players. No one is op on the server besides owners. No one has * perms besides owner. so I'm not sure what it is. I'm sorry

It is very possible it in on client side, hence hacked clients. They way to prevent something like this is to pretty much disable to OP account via plugins and have every possible thing assigned with permissions. Another questions I have, is this a basic minecraft server or a modpack? Also are command blocks enabled?

But at the same time they don't have access to console. you can't do this through console. We are speculating its a plugin the dev installed but it is hard to find. we've looked for hours and can't find it

Is there any way i can prevent this? its the third time its happened. i was luckily online and when they banned me i went on console and stopped the server

Well, based on the console readout, it was a Griefing team called Team Purge. They clearly wanted to make it known they were doing it, probably for a youtube channel or something like it. Sounds a lot like what Team AVO used to do. They had modified clients they developed themselves that took advantage of security holes in minecrafts coding.

ok, if I were you I would change they user/console password.

who is your host?

ok thank you. but yes i have ip banned. look here is a small example of what happened. this all happened in a matter of seconds and i know no one can type this fast and it says console

[17:20] [Server thread/INFO]: CONSOLE issued server command: /unban Moenimnim22
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned§c moenimnim22.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /unban masterassisin
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned§c masterassisin.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /unban _XxWhosYoMamaxX_
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned§c _XxWhosYoMamaxX_.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /unbanip Moenimnim22
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned IP: 68.61.17.175.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /unbanip masterassisin
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned IP: 99.100.154.121.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /unbanip xStayBlack
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned IP: 162.210.196.165.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /unbanip _XxWhosYoMamaxX_
[17:20] [Server thread/INFO]: §6Player§c Console §6unbanned IP: 66.226.58.184.
[17:20] [Server thread/INFO]: Group TeamPurge already exists
[17:20] [Server thread/INFO]: Permission "*" added to TeamPurge !
[17:20] [Server thread/INFO]: User masterassisin added to TeamPurge !
[17:20] [Server thread/INFO]: User Moenimnim22 added to TeamPurge !
[17:20] [Server thread/INFO]: User _XxWhosYoMamaxX_ added to TeamPurge !
[17:20] [Server thread/INFO]: CONSOLE issued server command: /broadcast §8&lTeamPurge §4&lis now online!
[17:20] [Server thread/INFO]: [Server] TeamPurge is now online!
[17:20] [Server thread/INFO]: TeamPurge's prefix = "&l[&lTeam&oPurge&l]"
[17:20] [Server thread/INFO]: CONSOLE issued server command: /banip cor_bear
[17:20] [Server thread/INFO]: §6Player§c Console §6banned IP address§c 66.87.122.115§6.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /banip RokaVon
[17:20] [Server thread/INFO]: §6Player§c Console §6banned IP address§c 66.103.11.232§6.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /banip TorPlaysMC
[17:20] [Server thread/INFO]: §6Player§c Console §6banned IP address§c 65.31.125.248§6.
[17:20] [Server thread/INFO]: CONSOLE: De-opped TorPlaysMC
[17:20] [Server thread/INFO]: CONSOLE: De-opped Cor_Bear
[17:20] [Server thread/INFO]: CONSOLE: De-opped RokaVon
[17:20] [Server thread/INFO]: User RokaVon added to A !
[17:20] [Server thread/INFO]: User cor_bear added to A !
[17:20] [Server thread/INFO]: User TorPlaysMc added to A !
[17:20] [Server thread/INFO]: User FluffyBall added to A !
[17:20] [Server thread/INFO]: User Annaschwander added to A !
[17:20] [Server thread/INFO]: Permission "*" removed!
[17:20] [Server thread/INFO]: Permission "*" removed!
[17:20] [Server thread/INFO]: Permission "*" removed!
[17:20] [Server thread/INFO]: Permission "*" removed!
[17:20] [Server thread/INFO]: CONSOLE issued server command: /ban Annaschwander
[17:20] [Server thread/INFO]: §6Player§c Console §6banned§c Annaschwander §6for The Ban Hammer has spoken!.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /ban cor_bear
[17:20] [Server thread/INFO]: §6Player§c Console §6banned§c cor_bear §6for The Ban Hammer has spoken!.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /ban RokaVon
[17:20] [Server thread/INFO]: §6Player§c Console §6banned§c RokaVon §6for The Ban Hammer has spoken!.
[17:20] [Server thread/INFO]: CONSOLE issued server command: /ban TorPlaysMC
[17:20] [Server thread/INFO]: §6Player§c Console §6banned§c TorPlaysMc §6for The Ban Hammer has spoken!.
[17:20] [Server thread/INFO]: <[Q]firedragon180> On no
[17:20] [Server thread/INFO]: masonnnnnn lost connection: Disconnected
[17:20] [Server thread/INFO]: <[R]ILikeCake[Mod]> wtf

Moved to Server Help.

#move

have you tried ip banning him?