RCON hacking (again)

Soooo, earlier on, we had the console spamming this:




L 03/20/2014 - 20:20:34: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:34: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:34: Garry Remmington (STEAM_0:0:23692836) Attempted to use tool material
L 03/20/2014 - 20:20:34: Garry Remmington (STEAM_0:0:23692836) Attempted to use tool material
L 03/20/2014 - 20:20:38: Davith Thomas (STEAM_0:1:42865137) Attempted to use tool hydraulic
L 03/20/2014 - 20:20:40: Davith Thomas (STEAM_0:1:42865137) Attempted to use tool adv_duplicator
L 03/20/2014 - 20:20:40: Davith Thomas (STEAM_0:1:42865137) Attempted to use tool adv_duplicator
L 03/20/2014 - 20:20:42: prop_physics(models/hunter/blocks/cube025x025x025.mdl) Got removed
L 03/20/2014 - 20:20:43: Davith Thomas (STEAM_0:1:42865137) Attempted to pick up a weapon_real_cs_pumpshotgun
L 03/20/2014 - 20:20:44: "John Zoidberg<76><STEAM_0:0:15004878><Gangster>" say ">starts singing that song"

L 03/20/2014 - 20:20:48: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:48: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:48: Garry Remmington (STEAM_0:0:23692836) Attempted to use tool fading_door
L 03/20/2014 - 20:20:49: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:49: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:49: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:49: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:49: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:49: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:49: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:49: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:49: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:49: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:49: Garry Remmington (STEAM_0:0:23692836) Attempted to use tool fading_door
L 03/20/2014 - 20:20:49: "Hermiony Drenas<124><STEAM_0:1:41003086><Citizen>" say "/pm nic ga naar verkoop ruimtete"

L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""
L 03/20/2014 - 20:20:50: "Console<0><Console><Console>" say ""Because i'am hapy""
L 03/20/2014 - 20:20:50: rcon from "180.13.125.215:38248": command "say "Because i'am hapy""


Before hand, he tried to unban a user who hacked the server around a month and a half ago



L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"


He spammed it in the console for some reason:



L 03/20/2014 - 20:19:46: prop_physics(models/props_junk/shoe001a.mdl) Got removed
L 03/20/2014 - 20:19:48: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:48: Garry Remmington (STEAM_0:0:23692836) Attempted to use tool stacker
L 03/20/2014 - 20:19:48: prop_physics(models/props_junk/shoe001a.mdl) Got removed
L 03/20/2014 - 20:19:49: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:49: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:50: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:50: Hermiony Drenas (STEAM_0:1:41003086) Attempted to use tool precision
L 03/20/2014 - 20:19:51: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:51: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:51: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:51: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:51: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:51: Hermiony Drenas (STEAM_0:1:41003086) Attempted to use tool precision
L 03/20/2014 - 20:19:52: prop_physics(models/props_junk/shoe001a.mdl) Got removed
L 03/20/2014 - 20:19:54: Garry Remmington (STEAM_0:0:23692836) Spawned a models/props_c17/gate_door01a.mdl
L 03/20/2014 - 20:19:54: [ULX] Garry Remmington<STEAM_0:0:23692836> spawned model models/props_c17/gate_door01a.mdl
L 03/20/2014 - 20:19:54: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:54: prop_physics(models/props_junk/shoe001a.mdl) Got removed
L 03/20/2014 - 20:19:54: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:55: prop_physics(models/props_c17/gate_door01a.mdl) Got removed
L 03/20/2014 - 20:19:55: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:56: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:56: Garry Remmington (STEAM_0:0:23692836) Spawned a models/props_interiors/ElevatorShaft_Door01a.mdl
L 03/20/2014 - 20:19:56: [ULX] Garry Remmington<STEAM_0:0:23692836> spawned model models/props_interiors/elevatorshaft_door01a.mdl
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) is Authed
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Spawned for the first time
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Spawned
L 03/20/2014 - 20:19:57: "hypra<132><STEAM_0:1:43248329><>" entered the game
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Attempted to pick up a keys
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Attempted to pick up a weapon_physcannon
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Attempted to pick up a gmod_camera
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Attempted to pick up a gmod_tool
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Attempted to pick up a pocket
L 03/20/2014 - 20:19:57: hypra (STEAM_0:1:43248329) Attempted to pick up a weapon_physgun
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:57: "Davith Thomas<105><STEAM_0:1:42865137><Theif>" say "/drop"

L 03/20/2014 - 20:19:57: prop_physics(models/props_junk/shoe001a.mdl) Got removed
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:57: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:27121555"
L 03/20/2014 - 20:19:58: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:19:58: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:19:59: prop_physics(models/props_junk/shoe001a.mdl) Got removed


The steam ID was actually in the ULX ban list and not the vanilla one, so that didnt work :v: . The guy he was trying to unban was hacking through RCON around a month and a half ago. Weird thing is, RCON is COMPLETELY disabled and there is no LUA code in any of the addons with RunString, so I have no idea how hes doing it. Any ideas?
PS:
Looking back at the beggining of the log file Im getting this:



L 03/20/2014 - 20:17:31: rcon from "180.13.125.215:38248": command "echo HLSW: Test"
L 03/20/2014 - 20:17:34: rcon from "180.13.125.215:38248": command "listid"
L 03/20/2014 - 20:17:35: rcon from "180.13.125.215:38248": command "listip"
L 03/20/2014 - 20:17:35: Jorge Romero (STEAM_0:0:59049741) Attempted to use tool keypad_willox
L 03/20/2014 - 20:17:38: Jorge Romero (STEAM_0:0:59049741) Attempted to use tool keypad_willox
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:67615954"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:66700497"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:65153393"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:64080083"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:60995492"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:60558735"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:59522699"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:58573810"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:57679854"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:57628366"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:57137470"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:55856113"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:54218740"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:54033298"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:54018403"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:53726117"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:53551782"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:51552568"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:50870044"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:50385408"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:49399297"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:48888141"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:48862106"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:48184962"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:47730461"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:43704316"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:43583438"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:43301495"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:42928945"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:42496715"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:41151805"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:40952666"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:37818989"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:37805934"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:37600619"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:35780041"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:33962659"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:32653094"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:31223466"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:30875476"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:30384245"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:30364173"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:30164945"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:28760210"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:28260671"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:28099894"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:27602740"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:26160549"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:25631890"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:25105763"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:24991693"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:24288360"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:22205332"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:19289828"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:17664077"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:14787686"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:10648517"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:1:8690595"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:69912703"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:69348930"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:69052521"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:68645321"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:64788144"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:60229274"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:59571163"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:59330693"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:58835524"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:56402529"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:55617052"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:55284507"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:53263526"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:52145980"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:51890894"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:51882365"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:49967355"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:47987757"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:47976117"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:47668895"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:47385818"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:47337533"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:47274614"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:45166005"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:44704358"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:43814573"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:43307737"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:43164889"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:43162755"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:42940999"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:42763259"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:42181194"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:41892932"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:40942351"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:40857487"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:39999336"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:39595616"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:39556628"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:36605145"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:35365808"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:33101890"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:32921190"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:32631347"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:30783169"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:30040897"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:28449375"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:23206763"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:22528887"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:22313374"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:20744398"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:20617162"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:19739477"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:19511230"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:19214158"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:18938001"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:18669666"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:15962348"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:13528709"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:10965780"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:6790630"
L 03/20/2014 - 20:17:39: rcon from "180.13.125.215:38248": command "removeid STEAM_0:0:4923035"
L 03/20/2014 - 20:17:40: rcon from "180.13.125.215:38248": command "listid"


Did a whois on his IP and it appears to be a Japanese VPN or something? Or it might be a Japaneese player :v:

I don’t know if you have access to the firewall or not but if you can, try blocking all incoming TCP ports (leave UDP as it is).

Unfortunately nope, Im running a game server with Vilayer so Im limited in that respect :c

Wait, so you have these parameters in server.cfg, but still he’s able to run RCON commands?



rcon_password ""
sv_allowupload 0


yup.

Are you running any workshop addons on your server? If so post the collection here.

I extracted most of them a while back and none of them had backdoors, il get the list.

Keep in mind, as posted in another thread. Vilayer (possibly) currently has an exploit that lets you plant files into said client’s FTP

Any ideas on how this mighht be performed if its still possible? I have contacted somone at Vilayer whom is listening to me and might be able to do something about it.

CAll your support and get a list of every single lua file that has been changed since x time to check if you changed it or not

Maybe invest in an anti cheat too, they actually aren’t that bad. Just yesterday it caught someone with a file called “tdetector.lua”

I do not think an anticheat would stop sending net messages if they’re smart enough to plant a lua file.

Who ever it is they are DDOSing right now. Its pretty creepy how obsessed this guy is with our community. Sounds like hel stop at nothing until he has us taken down :v: . After a little bit of research, this dispute dates back to around September time last year when some idiot came on and said hed sue me for using the name “Plex RP” :v: .

I don’t know if this will help, but when they are trying to hack your rcon password through a auto typer, which just tries super fast, what password could work like
rcon_password 1
rcon_password 2…
Then you should probably use a high secure password with 30 letters+.
I recommend this site: http://passwordsgenerator.net/
I use it for some years now and I never got hacked in any of my accounts/emails or anything like that

I have a 32 character password for the back end and hes on again



Gibmod Min: 7 Is Too Small Recreating
New amount:	3
ServerLog: D3M0NI4QU3 (STEAM_0:0:81884698) Attempted to switch noclip
ServerLog: Malboro (STEAM_0:0:27121555) Spawned a models/props_c17/furnitureStove001a.mdl
ServerLog: [ULX] Malboro<STEAM_0:0:27121555> spawned model models/props_c17/furniturestove001a.mdl
Malboro<STEAM_0:0:27121555> spawned model models/props_c17/furniturestove001a.mdl
tony arson banned D3M0NI4QU3 permanently
ServerLog: [ULX] tony arson banned D3M0NI4QU3 permanently
Console: BAN FUCKED
ServerLog: Anders Blacklist (STEAM_0:1:58884472) Attempted to use tool wire_textscreen
Gibmod Min: 7 Is Too Small Recreatin


[editline]21st March 2014[/editline]

Now Im getting RCON from Korea:



L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:80659775"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:80198805"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:79586529"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:78529444"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:78255883"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:68061005"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:66434963"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:66025330"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:63502987"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:62743180"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:61994320"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:61906321"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:61853471"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:60861888"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:59916199"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:59601079"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:58834495"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:58515484"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:57964209"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:55625275"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:53649109"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:53413045"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:53271266"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:52830438"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:52682801"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:52650123"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:52620328"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:52101884"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:51633750"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:51600178"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:51504209"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:50441892"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:50418870"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:49885332"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:47041285"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:46043290"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:42908410"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:42815600"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:40914246"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:40894773"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:40876696"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:40658713"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:40135900"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:39329367"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:39092034"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:39050204"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:38154664"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:37657549"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:37608004"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:35398673"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:35322663"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:29119837"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "removeid STEAM_0:1:28650092"
L 03/21/2014 - 17:44:39: rcon from "59.30.169.123:15896": command "


Are you sure its not this moron

Found it!
/178.33.135.115_27065/garrysmod/lua/autorun/server/admin_functions.lua was edited yesterday when my troubles started. So its all Vilayers fault. I told them to fix their shit a few months ago when we had similar issues a month or so back and they said their systems were 100% secure. I cant see how, theres an unauthorised sub user on my CPanel and a file I have NEVER touched has been edited. Still might not be Vilayer, but holy hell! I cant see how it cant be. Id also like to note that I have a 24+ character password to everything to do with the server, all unique.

[editline]21st March 2014[/editline]

Could be something to do with us, not sure.

I recommend you back up your files and find a new host. You shouldn’t have to worry about your server being hacked because of exploits in the cp.

Yeah. My advice, never ever go with Vilayer. They are possibly the worst hosting company I have ever been with. Their support is good, but when something like this arrises, I was told it was all my fault and a “la la la la la” attitude. I have a spare VPS in New York, just a little worried about performance, but it seems to be pretty snappy as I have ran a Starbound server and Minecraft server on the other 2 I have there, so with any luck itl be ok.

Actually, just been thinking back to when I was talking to one of their support technicians on Teamspeak, the one guy was that confident that their systems were SO secure, I could have his WHOLE YEARS wages if I could prove otherwise!!! I wonder how I claim it… Any ideas? I dont suppose he wasnt being serious, right?