The Exploit Roblox Couldn’t Fix

Comments · 412

• AL

  @Aloverforlife · 13 days ago

  A Billion Dollar Company Vs A Few People Who Only Needs It Right.

  2

• YO

  @YourLocalShortsWatcher04 · 1 month ago

  chris hansen got banned instantly, and what youve said this exploit has existed for years and had only been patched today is crazy

  19

• XX

  @XxTuffMonkeyxX · 1 month ago

  I noticed that this fix has been done to rivals , like not allowing delta users to join but they removed it for some reason. If they couldve done that why didnt they just do the same to mm2 or any GAME..

  16

• PU

  @Purest-i1o · 1 month ago (edited)

  Hi, it’s me, CamsCorpse/Purest. First off, great video! Very well put together, 10/10, genuinely enjoyed watching.<br><br>It seems like you don’t fully understand how it worked though, so I figured I’d explain.<br><br>This time, there were only 4 people involved. 3 were the main group responsible for finding the vulnerability, and I was basically #4 — the random who ended up getting access.<br><br>The older clips used a similar method. One of the people in this group was also responsible for the other similar method years ago with Harkinian, and I was slightly involved in that as well.<br><br>Here’s how it worked:<br><br>It was a platform bug in the UGC/Avatar Item system. We uploaded a bundle called “Robot Test” to my account, with the right leg being the specific part that was bypassed.<br><br>When you joined a game while wearing the bundle, a RemoteFunction would be placed into ReplicatedStorage — even in regular Studio, not just Play mode. Simply inserting the bundle would automatically put it there.<br><br>The important part is that it only worked in R6/R15 games using default avatars, and you had to actually be wearing the bundle. If the game changed your avatar/UGC upon joining, it wouldn’t work. It also worked even with LoadString disabled.<br><br>The team honestly didn’t think the bundle would actually get accepted, so they were pretty surprised when it did lol.<br><br>I don’t fully understand all the technical details, but I understand enough to know why it worked. That’s how the team was able to edit DataStores, run SS panels, and decompile server code. Roblox has since patched the loading path, although obviously Roblox still has plenty of vulnerabilities.<br><br>How I got access: I’d known the main person behind it since 2014, so I already had a connection to the group. They specifically needed an old, ID-verified account with an unverified email to upload the UGC bundle, so I offered mine. They didn’t think I’d be able to figure out how their exploit worked 😂<br><br>I noticed they only uploaded the bundle to my account, always wore it when joining the games they trolled, and those games were all using default avatars. That made me realize the bundle itself had to be the entry point.<br><br>I then checked an old baseplate on my account and found two scripts in ReplicatedStorage. One was some kind of spoofing script, and the other was heavily obfuscated Lua bytecode. I tested them together, the game lagged like crazy, and then the SS panel popped up.<br><br>Basically, I accidentally reverse-engineered their exploit by following the breadcrumbs they left on my own account 💀<br><br>Eventually the bundle got detected. Roblox has some seriously good detection/logging, and one of the team members did some skid shit that ended up getting detected 😂<br><br>And yeah… that’s basically the whole story. Once Roblox patched the loading path, I uploaded my video.

  3

• PR

  @prohax1 · 1 month ago

  they literally did fix it and it was the easiest method ever

  94

• DI

  @directedbyducky · 1 month ago (edited)

  ill be adding updates/corrections here (edited):<br><br>roblox have patched the exploit (technically), they have filtering enabled which stops a client from accessing server side, however this can still be breached like we saw with the clips in the video<br><br>join the discord to support in the meantime :)<br><a href="https://discord.com/ZAJDGgcPgU">https://discord.com/ZAJDGgcPgU</a>

  18

• MX

  @mxsynry · 1 month ago (edited)

  why are we larping as exploiter experts ong<br><br>edit. ‘LARPing as’ is commonly used online to mean pretending/acting like you’re something, so ‘larping as exploiter experts’ is completely understandable. I obviously wasn’t saying anyone was literally doing live-action roleplay. And ‘ong’ means ‘on God,’ not ‘OMG.’ Half this thread is arguing with slang they just don’t know bro.

  96

• HE

  @heelflipv2 · 1 month ago

  i used to use rc7 in 2016 its crazy looking at those videos its like a time machine

  11

• 7X

  @7XZEM · 6 days ago

  <a href="https://www.youtube.com/watch?v=0UGVGXrET28&amp;t=766">12:46</a> the dude that did this had the opportunity to teach pinewood a lesson on their disgusting actions

  1

• ZE

  @zevidoesthings · 1 month ago

  Peak video 🔥

  2

• HA

  @HarrisonsFragchannel · 1 month ago

  W editing also HOW DOES THIS VID ONLY HAVE 1K

  1

• KR

  @Kricke01 · 1 month ago

  This is another reason why I started to stop playing Roblox and leave my games behind so another creator could take the owner place (English is my 3rd language).