[Winit]

If he did exploit, you need to patch your server or wait until they release a fixed daemon. I'm guessing it's a permission issue...

[Bryce@ens-ltd]

abuse@ovh.net - send an abuse report there and make sure your TS server is up to date. You can try banning the IP of the server and see if that helps.

If he was on regular ip he wouldnt have internet to hack my ts on anymore...

[Bryce@ens-ltd]

what method did he use to exploit your server?
is it a weak password?

Exploit

[Myatu]

Have a look: http://forum.teamspeak.com/showthread.php?t=58673.

[Rilly]

Even if OVH does something about the server he's accessing from, he'll still hack you again from a different location. You need to find out how he is doing it and plug up the hole

[Andy]

abuse@ovh.net - send an abuse report there and make sure your TS server is up to date. You can try banning the IP of the server and see if that helps.

[Winit]

Vulnerability in TS?
Weak PW?

[yonatan]

what method did he use to exploit your server?
is it a weak password?

[Bryce@ens-ltd]

Hello,
I finally found out who the twa* was that was hacking our teamspeak adn deleting all the channels and banning everyone. Turns out he is using an OVH server.

#
I will quote the log,
#
 
#
2010-11-28 00:15:58.251703|INFO    |VirtualServer |  1| client connected 'sleek'(id:493) from 91.121.112.97:39073
#
2010-11-28 00:16:05.198968|INFO    |VirtualServer |  1| client (id:493) was added to servergroup 'WebsiteDesigner'(id:20) by client 'sleek'(id:493)
#
2010-11-28 00:16:06.211664|INFO    |VirtualServer |  1| client (id:493) was added to servergroup 'Donator'(id:22) by client 'sleek'(id:493)
#
2010-11-28 00:16:07.387445|INFO    |VirtualServer |  1| client (id:493) was added to servergroup 'Awesomesauce'(id:23) by client 'sleek'(id:493)
#
2010-11-28 00:16:09.428460|INFO    |VirtualServer |  1| client (id:493) was added to servergroup 'It's My Birthday!'(id:14) by client 'sleek'(id:493)
#
2010-11-28 00:16:10.226312|INFO    |VirtualServer |  1| client (id:493) was added to servergroup 'Minecraft Mod'(id:10) by client 'sleek'(id:493)
#
2010-11-28 00:16:38.512445|INFO    |VirtualServer |  1| client disconnected 'sleek'(id:493) reason 'reasonmsg=soit pas deg !!!'
#
2010-11-28 00:16:52.594476|INFO    |VirtualServer |  1| client connected 'sleek'(id:493) from 91.121.112.97:56535
#
2010-11-28 00:16:56.122796|INFO    |VirtualServer |  1| client disconnected 'sleek'(id:493) reason 'reasonmsg=soit pas deg !!!'

#
<19:15:43> "sleek" connected
#
<19:15:50> "sleek" was added to server group "WebsiteDesigner (20)" by "sleek".
#
<19:15:51> "sleek" was added to server group "Donator (22)" by "sleek".
#
<19:15:52> "sleek" was added to server group "Awesomesauce (23)" by "sleek".
#
<19:15:54> "sleek" was added to server group "It's My Birthday! (14)" by "sleek".
#
<19:15:55> "sleek" was added to server group "Minecraft Mod (10)" by "sleek".
#
<19:16:14> Channel "MineTeam Awesome People Only." was deleted by "sleek"
#
<19:16:15> Channel "AFK2" was deleted by "sleek"
#
<19:16:15> Channel "Lobby" was deleted by "sleek"
#
<19:16:15> Channel "Fear Vault (-Fv-)" was deleted by "sleek"
#
<19:16:18> "Zedarion" was kicked from channel "The Best Channel" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:18> Channel group "Guest (8)" was assigned to "Zedarion" by PlugPayPlay's Public Minecraft Community.
#
<19:16:18> Channel "Mod Channel" was deleted by "sleek"
#
<19:16:18> Channel "The Best Channel" was deleted by "sleek"
#
<19:16:18> Channel "Minecraft" was deleted by "sleek"
#
<19:16:19> "Bullsokk" was kicked from channel "Help Channel" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:19> Channel group "Guest (8)" was assigned to "Bullsokk" by PlugPayPlay's Public Minecraft Community.
#
<19:16:19> Channel "Help Channel" was deleted by "sleek"
#
<19:16:19> "Jebemtimater" was kicked from channel "Croatian Movies" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:19> "Pajser" was kicked from channel "Croatian Movies" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:19> "Necrod" was kicked from channel "Croatian Movies" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:19> Channel group "Guest (8)" was assigned to "Jebemtimater" by PlugPayPlay's Public Minecraft Community.
#
<19:16:19> Channel group "Guest (8)" was assigned to "Pajser" by PlugPayPlay's Public Minecraft Community.
#
<19:16:19> Channel group "Guest (8)" was assigned to "Necrod" by PlugPayPlay's Public Minecraft Community.
#
<19:16:19> Channel "Croatian Movies" was deleted by "sleek"
#
<19:16:19> Channel "Movie Channel" was deleted by "sleek"
#
<19:16:20> Channel "Call of Generic Reason" was deleted by "sleek"
#
<19:16:20> Channel "Music and singing" was deleted by "sleek"
#
<19:16:20> Channel "PlugPayPlay SMP Support" was deleted by "sleek"
#
<19:16:21> You were kicked from channel "Admins" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:21> "bdmn" was kicked from channel "Admins" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:21> "MisterGreen" was kicked from channel "Admins" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:21> "Arkangel017" was kicked from channel "Admins" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:21> "Cerqua" was kicked from channel "Admins" by PlugPayPlay's Public Minecraft Community (channel deleted)
#
<19:16:21> Channel group "Guest (8)" was assigned to "Bryce@PlugPayPlay" by PlugPayPlay's Public Minecraft Community.
#
<19:16:21> Channel group "Guest (8)" was assigned to "bdmn" by PlugPayPlay's Public Minecraft Community.
#
<19:16:21> Channel group "Guest (8)" was assigned to "MisterGreen" by PlugPayPlay's Public Minecraft Community.
#
<19:16:21> Channel group "Guest (8)" was assigned to "Arkangel017" by PlugPayPlay's Public Minecraft Community.
#
<19:16:21> Channel group "Guest (8)" was assigned to "Cerqua" by PlugPayPlay's Public Minecraft Community.
#
<19:16:21> Channel "emergency contact in topic" was deleted by "sleek"
#
<19:16:21> Channel "DEFCON1" was deleted by "sleek"
#
<19:16:21> Channel "Admins" was deleted by "sleek"
#
<19:16:21> Channel "AFK" was deleted by "sleek"
#
<19:16:22> Channel "Knights Round Table" was deleted by "sleek"
#
<19:16:23> "sleek" disconnected (soit pas deg !!!)
#
<19:16:37> "sleek" connected
#
<19:16:41> "sleek" disconnected (soit pas deg !!!)

Our teamspeak server is hosted on an OVH server that I rent, and being a customer that is being attacked from the confines inside ovh I hope that some justice can be done. Because this little ***** has not done this only once but at least 20 times. And each time I have to start the teamspeak server from a clean slate and re add all the channels and permissions...

-Bryce