Xjyuk

How to tell someone I'd like to become friends without letting them think I'm romantically interested in them?

Should disabled buttons give feedback when clicked?

Why isn't pressure filtration popular compared to vacuum filtration?

What is the measurable difference between dry basil and fresh?

LED glows slightly during soldering

Is a request to book a business flight ticket for a graduate student an unreasonable one?

What to do with a rabbit in a survival situation?

Is it possible to create a craft with specific bones, like the bones of a forgotten beast?

Why was hardware diversification an asset for the IBM PC ecosystem?

Print the last, middle and first character of your code

Was I subtly told to resign?

RPI3B+: What are the four components below the HDMI connector called?

Why didn't Thanos kill all the Dwarves on Nidavellir?

Why weren't bootable game disks ever common on the IBM PC?

Integer Lists of Noah

Is "De qui parles-tu" (for example) as formal as it is in English, or is it normal for the French to casually say that

Swapping "Good" and "Bad"

Power/Loss diagram

When I press the space bar it deletes the letters after it

What specific instant in time in the MCU has been depicted the most times?

Is English unusual in having no second person plural form?

Salt, pepper, herbs and spices

What is this little owl-like bird?

Why do we need common sense in AI?

Minecraft Server Hacked

Stuck after spawning in MinecraftI'm stuck in Creative and God mode and lost in the Nether. How can I get out?How do I disable commands for only 1 or 2 opped players (like worldedit and vanish)404 Not found Unable to connect to hostWhitelist usernames in offline modeMoving player before actually loading the map? (not being admin of the server)What causes the Badly Compressed Packet server error and how to avoid it?How to prevent server crash while flying with Elytra?Inventory Dissappeared without warning(Minecraft) Can you add attributes to name/enchanted armor?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

4

I am the admin on a server, and a new person came on the server for the first time. He asked for a book to "write a story". We gave him the book and he gave it to the owner. The owner opened up the book and it De-Opped him and op-ped the player. The player then went around and World-Edited removing many things. Does anyone know how to prevent this, or what actually happened?

PS: The owner, in his anger deleted the book before actually looking at what the book did...

minecraft minecraft-server cheats

share|improve this question

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Do you have a recent backup of the server? Easiest thing would be to just go back to it - and if you don't...well, now you know why you should
  
  – JonK
  Apr 18 '15 at 19:51
  
  

  
  
  
  

add a comment | 

4

I am the admin on a server, and a new person came on the server for the first time. He asked for a book to "write a story". We gave him the book and he gave it to the owner. The owner opened up the book and it De-Opped him and op-ped the player. The player then went around and World-Edited removing many things. Does anyone know how to prevent this, or what actually happened?

PS: The owner, in his anger deleted the book before actually looking at what the book did...

minecraft minecraft-server cheats

share|improve this question

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Do you have a recent backup of the server? Easiest thing would be to just go back to it - and if you don't...well, now you know why you should
  
  – JonK
  Apr 18 '15 at 19:51
  
  

  
  
  
  

add a comment | 

I am the admin on a server, and a new person came on the server for the first time. He asked for a book to "write a story". We gave him the book and he gave it to the owner. The owner opened up the book and it De-Opped him and op-ped the player. The player then went around and World-Edited removing many things. Does anyone know how to prevent this, or what actually happened?

PS: The owner, in his anger deleted the book before actually looking at what the book did...

minecraft minecraft-server cheats

share|improve this question

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

share|improve this question

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

share|improve this question

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

edited 27 mins ago

pppery

72855 silver badges1616 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

asked Apr 18 '15 at 19:29

Jordan.McBrideJordan.McBride

7199 bronze badges

1 Answer
1

active

oldest

votes

17

Up until very recently, there's been a bug in Minecraft that allows any client to change the NBT data of an item in its inventory. A player by the name of Ammar discovered this 2 years ago and reported it to Mojang confidentially. After repeatedly contacting them about it and getting little response, Ammar recently decided to release details of the exploit publicly. This finally forced Mojang to fix it and release an emergency 1.8.4, but older servers are still vulnerable.

Books, using the JSON format, can have "ClickEvents" and "HoverEvents" on certain pieces of text that cause it to run a command. This can usually not be created by a normal player. Also, due to another bug, these commands bypass the restrictions placed on command blocks such as not being able to use /op.

What's likely happened here is that the player has asked for a book, and then changed it's NBT data to give it hover event commands that give the player OP.

You should be able to protect against this exploit by upgrading your server to 1.8.4.

share|improve this answer

edited Apr 18 '15 at 21:25

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Nice and informative answer
  
  – JonK
  Apr 18 '15 at 21:28
  

  
  
  
  

add a comment | 

protected by Community♦ Apr 23 '15 at 15:33

Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



Would you like to answer one of these unanswered questions instead?

17

Up until very recently, there's been a bug in Minecraft that allows any client to change the NBT data of an item in its inventory. A player by the name of Ammar discovered this 2 years ago and reported it to Mojang confidentially. After repeatedly contacting them about it and getting little response, Ammar recently decided to release details of the exploit publicly. This finally forced Mojang to fix it and release an emergency 1.8.4, but older servers are still vulnerable.

Books, using the JSON format, can have "ClickEvents" and "HoverEvents" on certain pieces of text that cause it to run a command. This can usually not be created by a normal player. Also, due to another bug, these commands bypass the restrictions placed on command blocks such as not being able to use /op.

What's likely happened here is that the player has asked for a book, and then changed it's NBT data to give it hover event commands that give the player OP.

You should be able to protect against this exploit by upgrading your server to 1.8.4.

share|improve this answer

edited Apr 18 '15 at 21:25

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Nice and informative answer
  
  – JonK
  Apr 18 '15 at 21:28
  

  
  
  
  

add a comment | 

17

Up until very recently, there's been a bug in Minecraft that allows any client to change the NBT data of an item in its inventory. A player by the name of Ammar discovered this 2 years ago and reported it to Mojang confidentially. After repeatedly contacting them about it and getting little response, Ammar recently decided to release details of the exploit publicly. This finally forced Mojang to fix it and release an emergency 1.8.4, but older servers are still vulnerable.

Books, using the JSON format, can have "ClickEvents" and "HoverEvents" on certain pieces of text that cause it to run a command. This can usually not be created by a normal player. Also, due to another bug, these commands bypass the restrictions placed on command blocks such as not being able to use /op.

What's likely happened here is that the player has asked for a book, and then changed it's NBT data to give it hover event commands that give the player OP.

You should be able to protect against this exploit by upgrading your server to 1.8.4.

share|improve this answer

edited Apr 18 '15 at 21:25

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Nice and informative answer
  
  – JonK
  Apr 18 '15 at 21:28
  

  
  
  
  

add a comment | 

Up until very recently, there's been a bug in Minecraft that allows any client to change the NBT data of an item in its inventory. A player by the name of Ammar discovered this 2 years ago and reported it to Mojang confidentially. After repeatedly contacting them about it and getting little response, Ammar recently decided to release details of the exploit publicly. This finally forced Mojang to fix it and release an emergency 1.8.4, but older servers are still vulnerable.

Books, using the JSON format, can have "ClickEvents" and "HoverEvents" on certain pieces of text that cause it to run a command. This can usually not be created by a normal player. Also, due to another bug, these commands bypass the restrictions placed on command blocks such as not being able to use /op.

What's likely happened here is that the player has asked for a book, and then changed it's NBT data to give it hover event commands that give the player OP.

You should be able to protect against this exploit by upgrading your server to 1.8.4.

share|improve this answer

edited Apr 18 '15 at 21:25

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges

share|improve this answer

edited Apr 18 '15 at 21:25

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges

answered Apr 18 '15 at 20:20

SirBenetSirBenet

25.5k33 gold badges5151 silver badges8181 bronze badges