Exploits staying in game

Hello! I have a question regarding exploiters. If an exploiter exploits your game, can that exploit that was executed in to your game stay? My game was exploited earlier today and the exploit stays in the game.

I shut down all the servers and the exploit is still there. I also joined a server with nobody in it and the exploit was still there.

If any developer has some sort of knowledge in regards to exploits and what happens with them, please reply to this message or DM me. Thanks!

If this is the wrong category, please let me know.

2 Likes

What exploit are you noticing? It’s impossible for an exploiter to “hack” into your game to change the internal source code…otherwise that’d be a huge firewall security problem on Roblox’ side of things.

I would guess a plugin could be the culprit here; they have direct access to the code being executed in your game. Perhaps you could try disabling them and seeing if the problem persists.

3 Likes

Hello Dylan!

Sadly, I have seen this nearly twice today. This is most likely a new way exploiters have found to do this. To solve this, we ask the question, how does exploiting work?

Exploits work when they are injected into the game. Those scripts can hack into your internal source code. This means it is highly likely that the exploit is in your game.

From the past case I saw today from a very popular group, their developers plugin was also infected after the incident. I highly suggest looking over every script, every model, every area possible in the game.

2 Likes

The exploit looks like this. The “verify” button doesn’t work either.

3 Likes

I’ve looked over almost every model and script and I didn’t find anything that was suspicious or alarming.

2 Likes

You or one of your team mates has a malicious plugin that is inserting code into your game. Make sure all your plugins are from reputable sources and look through all scripts in the game to make sure they weren’t edited or any new ones were added.

13 Likes

Then this is highly likely from a plugin. I only suggest using plugins essential for development and those that are highly trusted and used. Look over everything.

1 Like

That is 100% requiring a module. Look over scripts with the getfenv() line or the require() statement. In other words, anything of this sort.

1 Like

I would assume that the verify button is connected to some sort of webhook, could be a discord webhook thats sending player information into one of their channels. It’s unlikely that it’s getting passwords but it is possible that it’s getting HWID’s,usernames,userId’s,etc

1 Like

Yeah. Considering when I clicked it earlier it stole nearly 3k robux from me…

It’s possible that it’s somehow sending you a product/asset to buy in-game and you’re not seeing it but you’re buying it somehow.

2 Likes

Yes, this is actually possible. All because of the while loop. I was an exploiter in Roblox and then I quit because I don’t wanna be banned. But however, the exploit ONLY stops if that server is closed, meaning the last player left.

The verify button could literally prompt gamepasspurchase.

1 Like

The loop should be removed when the client/exploiter leaves the game.

Oh? Is that real? I see. I was an exploiter and the whole loop kept running forever. I didn’t know it stops after I left the game. I’m no longer an exploiter anymore.

1 Like

The exploit injects code into the server. Therefore, it stays for the duration of the server.

It looks like this exploition is getting famous… I’ve seen games having this terrible exploit. Ive heard someone said they lost all their robux after clicking that button.

2 Likes

Exploits can not run code on the server. OP has a backdoor, probably from a malicious plugin.

5 Likes

See, the thing is it is stuck in the game. When I go to tets mode in Roblox Studio everything is fine. When I go to play the game via Roblox, the exploit starts to occur.

Well it depends what type of script it is. If its just like a simple

 while wait() do
 game.ReplicatedStorage.Kill:FireServer(game.Players.player) 
end)

then you would be able to rejoin and the loop would be gone. But if the exploiter created a loopcheck that checked if you were there, then you would be doomed.

1 Like