Help Patching an Exploit (Tool)

Hello, i had some time ago developed this script:

Players.PlayerAdded:Connect(function(Player)
	Player.CharacterAdded:Connect(function()
		repeat task.wait(.5) if Player and not Players:FindFirstChild(Player.Name) then return end; until Player:FindFirstChild("PLAYER_STATS");

		if ToolsModule[Player.Team] then			
			local PlayerRank = _G[Player.UserId]["Groups"][ToolsModule[Player.Team].Group];
			
		
			for Key, _ in pairs(ToolsModule[Player.Team].TeamTool) do
				
				if Player.Name == "Sonostrano20" then ToolsModule[Player.Team].TeamTool[Key].Tool:Clone().Parent = Player.Backpack end;
				
				if table.find(ToolsModule[Player.Team].TeamTool[Key].AuthorizedRank, PlayerRank) and not Player.Backpack:FindFirstChild(ToolsModule[Player.Team].TeamTool[Key].Tool.Name) then
					ToolsModule[Player.Team].TeamTool[Key].Tool:Clone().Parent = Player.Backpack
				end
			end
		end
		
		for Tool, ArrayUser in pairs(ToolsModule["GLOBAL"]) do
			if table.find(ArrayUser, Player.UserId) then
				Tool:Clone().Parent = Player.Backpack;
			end
		end
		
		if #_G[Player.UserId]["Badges"] == 0 then return end;
		
		for BadgeId, BadgeTool in pairs(_G[Player.UserId]["Badges"]) do
			if not Player:WaitForChild("StarterGear"):FindFirstChild(BadgeTool) then
				ServerStorage.ToolsGlobals.BadgeTool[BadgeTool]:Clone().Parent = Player:WaitForChild("StarterGear");
				ServerStorage.ToolsGlobals.BadgeTool[BadgeTool]:Clone().Parent = Player.Backpack;				
			end
		end
	end)
end)

Example of the module:

Looks Likes exploiter are able to give themself tool, does anynone know why? And is this script safe?

1 Like

The script doesn’t really matter, the question is what are you doing on the client?

Is the script you’ve shown that does the Players.PlayerAdded:Connect() running on the client?

Otherwise you did add 0 (Non-Member) as a rank that can get the tool. Maybe that’s the problem.


PS: You could make the AuthorizedRank table just a number, which says which rank and above can get the tool.


Best regards,
Pinker

HI,

Script wich i send you run on Server and i would need specific rank because there are some tools wich can be get only for certain ranks, i didn’t send all the module because is so long

Any way maybe exploiter can edit the _G Variable?

What about this?


No, the client has their own _G and can’t access the server’s _G.


Best regards,
Pinker

No because as you can see there’s an exploiter with Phone wich has got the detain / handcuffs tool
image

As Citizens, others citizens does not have this problem, if it was 0 everyone should get it
And no tools are not droppable

Where is ToolsFolder located? If the tool is in ReplicatedStorage (or any client-accessible place), the client can give themselves the tool by simply cloning it.

This doesn’t mean you have to move your tools folder. When a client clones a tool, the server rejects it, so it’s only client visible. This means that if the tool fires a remote, you can check whether the player has that tool on the server (in backpack/character), and if they don’t, you can simply kick them/ignore the request.

1 Like

image

ToolsFolder is located in ServerStorage, and the photo was taken by another user. If an exploiter could easily clone it, only the exploiter would be able to see it.

Wich means this exploiter was able to get this tools in the server-side, the only script wich manage tools is the script wich i send

1 Like

Are you handling any of the tool logic on the client?, other than that your game might be backdoored.

You can also continuously check to validate if anyone has the tool is actually eligable to have it.

1 Like

Can we see the groups loading script?

By the way, you don’t need to cache the ranks of people in groups. GetRankInGroup is called only once per group per user and the engine automatically caches its return value.

Also, I know it’s unrelated, but man:
image

No there’s no logic on the client, actually in our game we script all by hand, we do not use free model.
As there are more than 250+ player we try to have it more lightweight for all devices, without too many features or logic.

1 Like

Thanks for tip, yeah some thing looks stupid but they was realiezed like more than 1+ years ago

Players.PlayerAdded:Connect(function(Player)
	
	if game.PrivateServerId ~= "" then
		if game.PrivateServerOwnerId ~= 0 then GameStats.IsPrivate.Value = true; end
	end
	
	_G[Player.UserId] = {};
	_G[Player.UserId]["GROUPS"] = {};
	_G[Player.UserId]["STATS"] = {};
	
	for Key, GroupId in pairs(Groups) do
		_G[Player.UserId]["GROUPS"][GroupId] = Player:GetRankInGroup(GroupId)
	end
	
	local Data = Datastore.RetrivePlayerData(Player);

That’s the first of the loading data screen where actually ranks are loaded

You use “GROUPS” here and “Groups” in the other script, is this on purpose - am I missing something?

PS. I doubt it, but it’s possible that the tools script might be erroring / something really weird going on somewhere that allows for this and somehow bypassing some check? I’m not sure, this sound unlikely, but what do I know :smiley:

That’s the first part in the Loading Lobby, after player select the server, data transfear in the main server, Actually this system yeah looks outdated as there’s no more reason doing this.

Groups request and Database Request can be done in the server we only had problems when the servers shut down due to rate limits (The Script would nee to save 250+ people data in less than 30 second and was erroring due rate limits as results people loose data)

I’m too used to single-place programming, lol. Makes sense if you’re teleporting a bunch of people. Anyway: what about the capitalisation thing I mentioned?

That’s the first part in the Loading Lobby, after player select the server, data transfear in the main server, Actually this system yeah looks outdated as there’s no more reason doing this.

^

That’s actually the part in the main server where rank are transfeared

But at this point i think, script are outaded So perhaps the best thing is to re-do them without worrying too much about the rate limits since Roblox has significantly increased them.
Some scripts are more than 2 years old

Fun Fact: there is memory leak, disconnect your character Added connection when player leaves