Ban Exploit via Shirt

This user (link) entered my game and got mad at me because I kicked him for breaking the rules. He came back and started to accuse me of admin abuse and spamming the chat, so I muted him for 5 minutes. After the game unmuted him, he sent a private message (in-game pm system) to his friend, loserkiller1234 asking “Should I shirt him?”. His friend replied, “Yes… shirt em” and moments later the game crashed.

[spoiler]You can see loserkiller1234 saying that in the chat, the dead guy right behind me in this image is diliminecraft after resetting.

[/spoiler]

It seemed suspicious, so I tried to re-enter the server. It immediately kicked me, and they were the only two people left in the server. I grabbed diliminecraft character appearance and went through all the assets it was loading, and found this shirt (link). Somehow by wearing that shirt in-game, he crashed the server for everybody but himself and his friend. I also took a screenshot of the shirt’s asset page because I expected him to change the description, which he since has. Here’s the original:

I’ve been looking at the shirt’s source and personally can’t see what’s causing this to figure out how to reproduce it, but this is definitely an issue.

1 Like

o.o is it wrong to accuse this as witchcraft and magic?

1 Like

Just tried the shirt on a test server and the player who wore it crashed. Another player was in the test server as well, but didn’t crash even though the first player was in view.

The shirt itself is completely normal, so maybe he is using wearing the shirt as a trigger for his script to kick everyone.

But that’s a rather silly thing. How did you check the shirt btw?

What about the crashing it caused in studio?

Is there anyway you can get the original asset back? Like not roblox generated one, but the uploaded one? Probably no, so I doubt that we will be able to find this witchcraft.

I believe the trick here is the same, that was used to upload custom meshes recently. Probably modified shirt data in interesting way.

When I opened the shirt and copy/pasted the image data in an image editor, there’s a huge chunk of data in the first one that isn’t in the copied version. It’s very possible that this is the reason (first thing I thought of), but the image doesn’t seem to be corrupted.

When I opened the shirt and copy/pasted the image data in an image editor, there’s a huge chunk of data in the first one that isn’t in the copied version. It’s very possible that this is the reason (first thing I thought of), but the image doesn’t seem to be corrupted.[/quote]

Can you send that picture? I am not too familar with getting pure assets.

When I opened the shirt and copy/pasted the image data in an image editor, there’s a huge chunk of data in the first one that isn’t in the copied version. It’s very possible that this is the reason (first thing I thought of), but the image doesn’t seem to be corrupted.[/quote]

Can you send that picture? I am not too familar with getting pure assets.[/quote]

http://www.roblox.com/asset/?id=

http://www.roblox.com/asset/?id=147747375

Based on the file header, it’s a bmp file: http://puu.sh/8AW89.bmp

While trying to find out more about this mystery, I made a thumbnail generator glitch:

External Media

Basically that image contains data image itself and zip archive file data.

There is a chance the shirt is malformed PNG data, and so crashes anyone that loads it. They are probably bypassing it and using it to lock people out of servers by blacklisting the asset ID in fiddler if that’s what’s happening.

What the Hell…

local sID = "http://www.roblox.com/asset/?id=147747375"
game.Players.PlayerAdded:connect(function(plr)
	plr.CharacterAdded:connect(function(char)
		wait(2.5)
		for i,v in pairs(char:GetChildren()) do
			if v:IsA("Shirt") or v:IsA("Pants") then
				v:Destroy()
			end
		end
		repeat wait(1)
			local s = Instance.new("Shirt",char)
			s.ShirtTemplate = sID
			print(s,s.Parent,s.ShirtTemplate)
		until plr.Character:FindFirstChild("Clothing")
	end)
end)

– Please ignore the crap code, I made it in a few mins

Okay, I got crashed, put this that code in a script and run it in online mode, I got an error I never before seen, >_>.

And the error you got is…?

This sounds like it could be part of a creepypasta.

But really, this is fascinating. Eager to see what we can find out about what’s going on here.

Place that code in a script and test it in online.

For anyone who doesn’t want to test that code, the output I got was:

22:01:18.163 - StartProcessException…

I then received the “ROBLOX needs to quit!” message.