Solved Player crashing server (1.11.2)

Discussion in 'Spigot Help' started by Jagerborn, Apr 27, 2017.

  1. Running 1.11.2

    A player claims that he is crashing the server by using a private hacked client.
    The server crashes every time the player says he will crash it.
    There are no logs of the player using commands or sending chat messages.

    I have reason to believe it is some sort of exploit but unsure what exactly.

    Crash log: https://hastebin.com/hukupibofi.sql


    Notable plugins that are listed in the crash log dump:

    - Factions/MassiveCore
    - NuVotifier
    - LWC

    I doubt any of those plugins are related to the crash.

    I think the first part of the dump is suspicious. The part contains “CraftItemStack”, “CraftMetaBook”, “CraftChatMessage” and “regex”

    Could this be related to an item, a book, a message or some regex patterns glitching on 1.11.2?

    The player had no book in their inventory while performing this so I don’t think it is related.

    Not sure what the first part of the dump means but any help is very appreciated.


    Thank you for your time.
     
  2. Exactly the same thing was happening to my server, we also think it's an exploit, but running a server with a 150+ daily bungeecord playerbase and custom plugins is very hard to locate the problem, this started 2 days ago and we have had two attacks. If anyone has any input it would really help, thankyou.
     
  3. #3 connection_lost, Apr 27, 2017
    Last edited: Apr 27, 2017
  4. I am now pretty sure sending a huge amount of "\n" in book edits will crash the server according to my code research. It is fixed right now.
     
  5. Just ban his account and IP? Though this is quite interesting. Wish he had somthing better to do though.
     
  6. Splazeing

    Supporter

    Make sure the command //Calc is blocked. It's from worldedit and normally default users have access to it, meaning they can calculate a looping thing which will end up crashing the server.
     
  7. Make sure you're on the very latest spigot build. I think it may have already been patched.