Query creates channels, send messages or pokes users

[k725_raser]

Thank you. I'll try everything!

[Frohser]

Hello !

I have a problem on my server , the problem is that for some time I have "attacks" (do not know what to call it) on my server. Someone with GuestQuery (I think) creating temporary channels called: "New server, check the IP: xxx" - that serveradmin and I'm not able to give him a ban/the kick. He create and removes the channel. Does anyone know how to fix it?

I do not know if I am writing in the right section , so if the wrong forum please move it.

<21:15:01> Channel "check this ip: ble ble ble #1" created by "serveradmin"
<21:15:02> Channel "check this ip: ble ble ble #1" was deleted by "Name of the server "
<21:15:04> Channel "check this ip: ble ble ble #2" created by "serveradmin"
<21:15:05> Channel "check this ip: ble ble ble #2" was deleted by "Name of the server "

[dante696]

Here are the steps to restrict the Guest Query to abuse your server for spam.
solve this

1. Update your server to the latest version.

2. You must use the ServerQuery via telnet / putty to change the permissions.
How to use the ServerQuery
Ask your Admin or Hoster in case you don't have access to the ServeQuery and/or the serveradmin login.

3.

To update an existing instance to use the new default restricted permissions for query guests use the following commands on the query interface:

login serveradmin PASSWORD
use port=ANY_ACTIVE_PORT
servergroupaddperm sgid=1 permsid=b_channel_join_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_client_server_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_channel_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_offline_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=i_client_private_textmessage_power permvalue=0 permskip=1 permnegated=1|permsid=i_client_poke_power permvalue=-1 permskip=1 permnegated=1

[Frohser]

To solve this update your server to version 3.11.1 and the nrun the query command from this post
http://forum.teamspeak.com/showthrea...890#post392890

Thanks, you have from me beer!

[seler]

Hey.
I have very big problem.
2 weeks ago I had about 4/5 connections with nickname "Unknown from ..." like this:

<22:46:44> "Unknown from 37.187.252.194:52992" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
<22:46:44> "Unknown from 37.187.252.194:53029" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
<22:46:44> "Unknown from 37.187.252.194:58738" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
<22:46:45> "Unknown from 37.187.252.194:52992" dropped (connection lost)
<22:46:45> "Unknown from 37.187.252.194:53029" dropped (connection lost)
<22:46:45> "Unknown from 37.187.252.194:58738" dropped (connection lost)

After 2 weeks I had attack from probably this person like this:

<22:32:34> Channel "Pozdrawiam <3 #5" created by "serveradmin"
<22:32:34> "serveradmin" left, was moved to channel "Pozdrawiam <3 #5" by "selerowiec.pl" 
<22:32:34> Channel "Pozdrawiam <3 #4" was deleted by "selerowiec.pl"
<22:32:34> Channel group "Guest" was assigned to "Nyllito" by "selerowiec.pl".
<22:32:36> Channel "Pozdrawiam <3 #6" created by "serveradmin"
<22:32:36> "serveradmin" left, was moved to channel "Pozdrawiam <3 #6" by "selerowiec.pl"

He is spamming with channel names from #1 to about #230/240.

My teamspeak version is 3.0.11.2 on Linux

I saw this post: http://forum.teamspeak.com/showthrea...011#post394011 but when I type

servergroupaddperm sgid=1 permsid=b_channel_join_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_client_server_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_channel_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_offline_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=i_client_private_textmessage_power permvalue=0 permskip=1 permnegated=1|permsid=i_client_poke_power permvalue=-1 permskip=1 permnegated=1

I have ERROR ID=1024 msg=invalid\sserverID

I'm really newbie, I want to ban him or block before next attacks from him.
Unknown connection are still on my server, help, please!

[dante696]

You saw the post and dit not read it carefully.

1. login serveradmin yourpassword
2. use port=ANY_ACTIVE_PORT
3. servergroupaddperm sgid=1 permsid=xxxxxxxxxx

[seler]

You saw the post and dit not read it carefully.

1. login serveradmin yourpassword
2. use port=ANY_ACTIVE_PORT
3. servergroupaddperm sgid=1 permsid=xxxxxxxxxx

any_active_port? For example?

When I Type use=port9987 I have msg=ok, when next copy the servergroupaddperm... have error

error id=2568 msg=insufficient\sclient\spermissions failed_permid=161

I don't have full perms? How to fix it? How to get full serveradmin perms/password? I forgot this. Please, help me because unknown connection are still connecting.

Type this: help use

I've connected, on server I see "nickname from IP:49622" but I don't have full permissions.

error id=2568 msg=insufficient\sclient\spermissions failed_permid=161

What now, how to get password/login for full permission?

[dante696]

Type this: help use

Edit after post above was edited:
permid=161 permname=i_group_modify_power

You must login as serveradmin not with your own login.

Edit2 after post was created after my first reply:
I feel trolled!

Just do perform exactly the same commands. Just change the password and the port when your server differs.
Whats so hard with that ?

login serveradmin password
use port=9987
servergroupaddperm sgid=1 permsid=b_channel_join_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_client_server_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_channel_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_offline_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=i_client_private_textmessage_power permvalue=0 permskip=1 permnegated=1|permsid=i_client_poke_power permvalue=-1 permskip=1 permnegated=1

[seler]

OK, I've got this. I have pasted the code but Unknown connection are still on my server!

<20:16:46> "Unknown from 37.187.252.194:43418" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
<20:16:46> "Unknown from 37.187.252.194:33528" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
<20:16:46> "Unknown from 37.187.252.194:46303" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
<20:16:46> "Unknown from 37.187.252.194:43418" dropped (connection lost)
<20:16:46> "Unknown from 37.187.252.194:33528" dropped (connection lost)
<20:16:46> "Unknown from 37.187.252.194:46303" dropped (connection lost)

[dante696]

That's nothing critical and nothing a user does see.

You must block the port for the ServerQuery or the IP of that user in your firewall/router.
But as said thats nothing critical, it's like a Guest who connects but can not do anything on your server.

[seler]

Hey.
5 days ago someone 'hacked' my teamspeak3 server.
Now he is connecting every day on serverquery and spam msg "we are changing IP to xxxxxxx".
Nickname: Nowy Adresremoved
Version:ServerQuery on ServerQuery
Online since:166 days 23 hours 40 minutes 55 seconds

How to ban him? How to protect my server from attacks? I don't know how to do this, I've changed serverquery password but it's still!!!!!!

After this, in about 5min he is DDoSing my server and it shutdown!

[Ezmana]

Hello,

Today an individual is connected to my TS server with ServerQuery and managed to create a temporary channel and poke me. What I do not understand is that the creation of ServerQuery accounts is blocked on my server ...
But the limit is not very serious, because he had the permissions of a Guest user.

What bothers me most is that its Unique ID is "ServerQuery".

Do you have any idea what it could be?

[dante696]

It's the normal Guest Query and everbody can use this as a Guest till you fix the permissions.

We solved this. Please read post #33

[PhonicStudios]

Hi,

I'm a bit worried. I just got poked by some random thing that isn't on my server.
I tried to ban it and I got missing required parameter. I was able to remove it from contacts though (don't know how it got there though).

I am running the following plugins:

TS3MassMover
ACRE2
Chatlog Viewer
Lua Plugin (which, after I went to settings has 'testmodule'(idk this, related?) and 'z05pmwatch'(I installed this <1 month ago)

Chatlog viewer reports the following:

<19:47:58> "Scan [xxxxx][144]" pokes you: Test
<19:48:43> missing required parameter
<20:04:39> missing required parameter

How is it possible that someone outside ts3 pokes me?
I must add that there two other people on my TS3 server at the time, they did not receive a poke.

I did some online research and found this sketchy site: removed
Apparently this Russian removed dude is checking worldwide for vulnerabilities?

I closed down all my ports and disabled the Lua plugin entirely.

Any advice? Anyone know about this? Is someone trying to breach computers via TeamSpeak?

Kind regards,
Sanchez

[Radon]

So, this just happened.

A query client named [GameTracker][831] connected to my teamspeak server and created a "Test" channel and then disconnected again. Some log excerpts:

2015-10-10 17:11:10.595372	INFO	VirtualServerBase	1	channel 'Test'(id:260) deleted by 'server'(id:0)
2015-10-10 17:11:10.593144	INFO	VirtualServerBase	1	query client disconnected '[GameTracker][831]'(id:3351) reason 'reasonmsg=deselected virtualserver'
2015-10-10 17:11:03.417643	INFO	VirtualServerBase	1	channel 'Test'(id:260) created by '[GameTracker][831]'(id:3351)
2015-10-10 17:11:03.225986	INFO	VirtualServer	1	query client connected 'Unknown from 51.254.117.105:47569'(id:3351)
2015-10-10 17:10:53.523592	INFO	VirtualServerBase	1	query client disconnected '[Scan][GameTracker][667]'(id:3351) reason 'reasonmsg=deselected virtualserver'
2015-10-10 17:10:53.078663	INFO	VirtualServer	1	query client connected 'Unknown from 51.254.117.105:47549'(id:3351)

Then the query user poked one of my admins with the message "Test":

<19:11:01> Channel "Test" wurde von "[GameTracker][831]" erstellt
<19:11:06> "[GameTracker][831]" stupst Sie an: Test
<19:11:09> Channel "Test" wurde von "MyTeamspeakServer" gelöscht

Here is what my ts3 webinterface has to say about rights for query guest users:

https://i.imgur.com/FACqb9X.png

So, the question is: Why is he able to do this and what can I do to stop this?