Forum

Page 3 of 16 FirstFirst 1234513 ... LastLast
Results 31 to 45 of 234
  1. #31
    Join Date
    February 2013
    Location
    Japan
    Posts
    4
    Thank you. I'll try everything!

  2. #32
    Join Date
    May 2014
    Posts
    10

    serveradmin (guestquery) - attacks

    Hello !

    I have a problem on my server , the problem is that for some time I have "attacks" (do not know what to call it) on my server. Someone with GuestQuery (I think) creating temporary channels called: "New server, check the IP: xxx" - that serveradmin and I'm not able to give him a ban/the kick. He create and removes the channel. Does anyone know how to fix it?

    I do not know if I am writing in the right section , so if the wrong forum please move it.

    <21:15:01> Channel "check this ip: ble ble ble #1" created by "serveradmin"
    <21:15:02> Channel "check this ip: ble ble ble #1" was deleted by "Name of the server "
    <21:15:04> Channel "check this ip: ble ble ble #2" created by "serveradmin"
    <21:15:05> Channel "check this ip: ble ble ble #2" was deleted by "Name of the server "
    Last edited by dante696; October 17th, 2014 at 07:31 AM. Reason: merged

  3. #33
    Join Date
    June 2008
    Posts
    17,939
    Here are the steps to restrict the Guest Query to abuse your server for spam.
    solve this

    1. Update your server to the latest version.

    2. You must use the ServerQuery via telnet / putty to change the permissions.
    How to use the ServerQuery
    Ask your Admin or Hoster in case you don't have access to the ServeQuery and/or the serveradmin login.

    3.
    Quote Originally Posted by Chris View Post
    To update an existing instance to use the new default restricted permissions for query guests use the following commands on the query interface:

    Code:
    login serveradmin PASSWORD
    use port=ANY_ACTIVE_PORT
    servergroupaddperm sgid=1 permsid=b_channel_join_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_client_server_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_channel_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_offline_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=i_client_private_textmessage_power permvalue=0 permskip=1 permnegated=1|permsid=i_client_poke_power permvalue=-1 permskip=1 permnegated=1
    Last edited by dante696; May 2nd, 2016 at 03:54 PM.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  4. #34
    Join Date
    May 2014
    Posts
    10
    Quote Originally Posted by dante696 View Post
    To solve this update your server to version 3.11.1 and the nrun the query command from this post
    http://forum.teamspeak.com/showthrea...890#post392890
    Thanks, you have from me beer!

  5. #35
    Join Date
    September 2014
    Posts
    7

    ServerQuery hacker/Unknown from IP...

    Hey.
    I have very big problem.
    2 weeks ago I had about 4/5 connections with nickname "Unknown from ..." like this:
    Code:
    <22:46:44> "Unknown from 37.187.252.194:52992" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
    <22:46:44> "Unknown from 37.187.252.194:53029" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
    <22:46:44> "Unknown from 37.187.252.194:58738" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
    <22:46:45> "Unknown from 37.187.252.194:52992" dropped (connection lost)
    <22:46:45> "Unknown from 37.187.252.194:53029" dropped (connection lost)
    <22:46:45> "Unknown from 37.187.252.194:58738" dropped (connection lost)
    After 2 weeks I had attack from probably this person like this:
    Code:
    <22:32:34> Channel "Pozdrawiam <3 #5" created by "serveradmin"
    <22:32:34> "serveradmin" left, was moved to channel "Pozdrawiam <3 #5" by "selerowiec.pl" 
    <22:32:34> Channel "Pozdrawiam <3 #4" was deleted by "selerowiec.pl"
    <22:32:34> Channel group "Guest" was assigned to "Nyllito" by "selerowiec.pl".
    <22:32:36> Channel "Pozdrawiam <3 #6" created by "serveradmin"
    <22:32:36> "serveradmin" left, was moved to channel "Pozdrawiam <3 #6" by "selerowiec.pl"
    He is spamming with channel names from #1 to about #230/240.

    My teamspeak version is 3.0.11.2 on Linux

    I saw this post: http://forum.teamspeak.com/showthrea...011#post394011 but when I type
    Code:
    servergroupaddperm sgid=1 permsid=b_channel_join_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_client_server_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_channel_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_offline_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=i_client_private_textmessage_power permvalue=0 permskip=1 permnegated=1|permsid=i_client_poke_power permvalue=-1 permskip=1 permnegated=1
    I have ERROR ID=1024 msg=invalid\sserverID

    I'm really newbie, I want to ban him or block before next attacks from him.
    Unknown connection are still on my server, help, please!

  6. #36
    Join Date
    June 2008
    Posts
    17,939
    You saw the post and dit not read it carefully.

    1. login serveradmin yourpassword
    2. use port=ANY_ACTIVE_PORT
    3. servergroupaddperm sgid=1 permsid=xxxxxxxxxx
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  7. #37
    Join Date
    September 2014
    Posts
    7
    Quote Originally Posted by dante696 View Post
    You saw the post and dit not read it carefully.

    1. login serveradmin yourpassword
    2. use port=ANY_ACTIVE_PORT
    3. servergroupaddperm sgid=1 permsid=xxxxxxxxxx
    any_active_port? For example?

    When I Type use=port9987 I have msg=ok, when next copy the servergroupaddperm... have error
    Code:
    error id=2568 msg=insufficient\sclient\spermissions failed_permid=161
    I don't have full perms? How to fix it? How to get full serveradmin perms/password? I forgot this. Please, help me because unknown connection are still connecting.

    Quote Originally Posted by dante696 View Post
    Type this: help use
    I've connected, on server I see "nickname from IP:49622" but I don't have full permissions.
    Code:
    error id=2568 msg=insufficient\sclient\spermissions failed_permid=161
    What now, how to get password/login for full permission?
    Last edited by dante696; April 23rd, 2015 at 02:25 PM. Reason: merged after your edits

  8. #38
    Join Date
    June 2008
    Posts
    17,939
    Type this: help use

    Edit after post above was edited:
    permid=161 permname=i_group_modify_power

    You must login as serveradmin not with your own login.

    Edit2 after post was created after my first reply:
    I feel trolled!

    Just do perform exactly the same commands. Just change the password and the port when your server differs.
    Whats so hard with that ?

    Code:
    login serveradmin password
    use port=9987
    servergroupaddperm sgid=1 permsid=b_channel_join_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_join_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_semi_permanent permvalue=0 permskip=1 permnegated=1|permsid=b_channel_create_temporary permvalue=0 permskip=1 permnegated=1|permsid=b_client_server_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_channel_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=b_client_offline_textmessage_send permvalue=0 permskip=1 permnegated=1|permsid=i_client_private_textmessage_power permvalue=0 permskip=1 permnegated=1|permsid=i_client_poke_power permvalue=-1 permskip=1 permnegated=1
    Last edited by dante696; April 23rd, 2015 at 02:24 PM. Reason: post recreated after many edits ...
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  9. #39
    Join Date
    September 2014
    Posts
    7
    OK, I've got this. I have pasted the code but Unknown connection are still on my server!
    Code:
    <20:16:46> "Unknown from 37.187.252.194:43418" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
    <20:16:46> "Unknown from 37.187.252.194:33528" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
    <20:16:46> "Unknown from 37.187.252.194:46303" connected to channel "[cspacer0] KANAŁ GŁÓWNY"
    <20:16:46> "Unknown from 37.187.252.194:43418" dropped (connection lost)
    <20:16:46> "Unknown from 37.187.252.194:33528" dropped (connection lost)
    <20:16:46> "Unknown from 37.187.252.194:46303" dropped (connection lost)
    Last edited by dante696; April 24th, 2015 at 07:25 AM. Reason: quote removed

  10. #40
    Join Date
    June 2008
    Posts
    17,939
    That's nothing critical and nothing a user does see.

    You must block the port for the ServerQuery or the IP of that user in your firewall/router.
    But as said thats nothing critical, it's like a Guest who connects but can not do anything on your server.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  11. #41
    Join Date
    September 2014
    Posts
    7

    ServerQuery Unknown from IP...

    Hey.
    5 days ago someone 'hacked' my teamspeak3 server.
    Now he is connecting every day on serverquery and spam msg "we are changing IP to xxxxxxx".
    Nickname: Nowy Adresremoved
    Version:ServerQuery on ServerQuery
    Online since:166 days 23 hours 40 minutes 55 seconds

    How to ban him? How to protect my server from attacks? I don't know how to do this, I've changed serverquery password but it's still!!!!!!

    After this, in about 5min he is DDoSing my server and it shutdown!
    Last edited by dante696; May 2nd, 2016 at 03:43 PM. Reason: merged

  12. #42
    Join Date
    July 2015
    Location
    French
    Posts
    13

    Unique Indentifier: ServerQuery

    Hello,

    Today an individual is connected to my TS server with ServerQuery and managed to create a temporary channel and poke me. What I do not understand is that the creation of ServerQuery accounts is blocked on my server ...
    But the limit is not very serious, because he had the permissions of a Guest user.

    What bothers me most is that its Unique ID is "ServerQuery".

    Do you have any idea what it could be?
    Last edited by dante696; October 8th, 2015 at 02:32 PM. Reason: advert removed!

  13. #43
    Join Date
    June 2008
    Posts
    17,939
    It's the normal Guest Query and everbody can use this as a Guest till you fix the permissions.

    We solved this. Please read post #33
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  14. #44
    Join Date
    October 2012
    Posts
    8

    I just got poked by someone not on my server? Hacker?

    Hi,

    I'm a bit worried. I just got poked by some random thing that isn't on my server.
    I tried to ban it and I got missing required parameter. I was able to remove it from contacts though (don't know how it got there though).

    I am running the following plugins:

    TS3MassMover
    ACRE2
    Chatlog Viewer
    Lua Plugin (which, after I went to settings has 'testmodule'(idk this, related?) and 'z05pmwatch'(I installed this <1 month ago)

    Chatlog viewer reports the following:

    <19:47:58> "Scan [xxxxx][144]" pokes you: Test
    <19:48:43> missing required parameter
    <20:04:39> missing required parameter

    How is it possible that someone outside ts3 pokes me?
    I must add that there two other people on my TS3 server at the time, they did not receive a poke.

    I did some online research and found this sketchy site: removed
    Apparently this Russian removed dude is checking worldwide for vulnerabilities?

    I closed down all my ports and disabled the Lua plugin entirely.

    Any advice? Anyone know about this? Is someone trying to breach computers via TeamSpeak?

    Kind regards,
    Sanchez
    Last edited by dante696; October 9th, 2015 at 07:38 AM. Reason: adverts removed!

  15. #45
    Join Date
    February 2008
    Location
    /dev/null
    Posts
    15

    Guest query client created a channel?

    So, this just happened.

    A query client named [GameTracker][831] connected to my teamspeak server and created a "Test" channel and then disconnected again. Some log excerpts:

    Code:
    2015-10-10 17:11:10.595372	INFO	VirtualServerBase	1	channel 'Test'(id:260) deleted by 'server'(id:0)
    2015-10-10 17:11:10.593144	INFO	VirtualServerBase	1	query client disconnected '[GameTracker][831]'(id:3351) reason 'reasonmsg=deselected virtualserver'
    2015-10-10 17:11:03.417643	INFO	VirtualServerBase	1	channel 'Test'(id:260) created by '[GameTracker][831]'(id:3351)
    2015-10-10 17:11:03.225986	INFO	VirtualServer	1	query client connected 'Unknown from 51.254.117.105:47569'(id:3351)
    2015-10-10 17:10:53.523592	INFO	VirtualServerBase	1	query client disconnected '[Scan][GameTracker][667]'(id:3351) reason 'reasonmsg=deselected virtualserver'
    2015-10-10 17:10:53.078663	INFO	VirtualServer	1	query client connected 'Unknown from 51.254.117.105:47549'(id:3351)
    Then the query user poked one of my admins with the message "Test":

    Code:
    <19:11:01> Channel "Test" wurde von "[GameTracker][831]" erstellt
    <19:11:06> "[GameTracker][831]" stupst Sie an: Test
    <19:11:09> Channel "Test" wurde von "MyTeamspeakServer" gelöscht
    Here is what my ts3 webinterface has to say about rights for query guest users:

    https://i.imgur.com/FACqb9X.png

    So, the question is: Why is he able to do this and what can I do to stop this?
    Attached Images Attached Images  
    Last edited by dante696; October 12th, 2015 at 07:20 AM. Reason: merged

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. How to send chat messages to Server Query
    By JamieG193 in forum Tools / Web Based
    Replies: 3
    Last Post: July 5th, 2013, 10:02 AM
  2. [Resolved] (not possible) How do I send out pokes to a defined usergroup?
    By Pluvrr in forum General Questions
    Replies: 1
    Last Post: August 28th, 2011, 03:50 PM
  3. send text messages to everyone
    By constrych9 in forum General Questions
    Replies: 5
    Last Post: February 8th, 2011, 06:01 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •