Using :MoveTo(Vector3.new(math.huge,math.huge,math.huge) on a character model kills the character!

Basically CharacterModel:MoveTo(Vector3.new(math.huge,math.huge,math.huge) will kill that player FE or not when the client executes.

Please fix this as my game is having rapid amounts of everyone in the server getting killed over and over again and causing them to leave.

Anyone executing that with a lvl 7 can kill anyone.

Edit(Here’s how you can use it to kill everyone)

function killAll()
	for i,v in pairs(game.Players:GetPlayers()) do
		if v.Character and v.Name ~= Player.Name then
			v.Character:MoveTo(Vector3.new(math.huge,math.huge,math.huge))
		end
	end
end
2 Likes

Not sure I’d label it as a “bug” considering it makes sense that the character would die in this scenario. However, that is quite an annoying thing for people to be doing.

Are there still rampant level-7 exploits?

1 Like

Yes. From place stealing to complete code access.

They’re all over the place it’s not even rare imo.

It should not still be possible to access code on the server, or anything else that does not ever replicate to the client.

It’s not. I think roblox might still have the 1 million (iirc) robux bounty on that, actually.

Just tested in Studio and :MoveTo(Vector3.new(math.huge,math.huge,math.huge)) doesn’t do anything on the server/the victim’s viewpoint in FE games.

1 Like

With FE, you can also delete the heads of other players and they seem to die (for you), but on the other clients (and server) they’re just fine. It’s only annoying for you, as you won’t know its health and the welds between limbs are broken, so you don’t know where those are.

Yeah, it’s happening at my game also.
It doesn’t seem like it should work really, but it does.

It’s pretty devastating for smaller games with high server player count.

Can confirm this does NOT work with Filtering by itself, if executed locally. Either
A) They are executing this server side somehow (Unlikely)
B) People are exploiting one of your remotes to do this. (More likely)
Check here: The Game - Roblox

repeat wait() until game.Players.LocalPlayer
local Player = game.Players.LocalPlayer
function killAll()
	for i,v in pairs(game.Players:GetPlayers()) do
		if v.Character and v.Name ~= Player.Name then
			v.Character:MoveTo(Vector3.new(math.huge,math.huge,math.huge))
		end
	end
end
script.Parent.TextButton.MouseButton1Click:connect(killAll)

I got reports of this same thing about 2 weeks ago, I think it used to work and is now patched. There was also a fun exploit where you could control other player’s movements

1 Like

I’ve heard that Arcane Adventures has a RemoteEvent SetNetworkOwner that you can fire with any part to have its network owner set. Kind of a “good” example of what you shouln’t do. but the game isn’t FE and there are a lot of bigger vulnerabilities, e.g. ability to literally set your xp/level/stats/money to whatever you want, give yourself (almost) any item (including admin ones), …

https://pastebin.com/MuS8y4iB - This is a gui with the code above. Anybody with a context of 7 can run it, and many exploits do give this ability. You can find this posted all over websites like v3rmillion and other exploit websites abusing the same thing.

I do believe context 7 is above what studio offers, or even the command console in-game for the owner, but I might be wrong, and some of the terminology I used might be wrong too.

Context 7 is the COM backend server. It’s only supposed to be used by the game launching protocols. It has access to everything, even some stuff CoreScripts can’t access.

I have a list of APIs that only CoreScripts and above can use:

1 Like

Thanks for a better explanation on level 7, I found this wikipagepage also to be helpful- Documentation - Roblox Creator Hub

Some people don’t understand that if you try to use scripts meant for exploiting inside of studio, they’re not going to work because a level 7 context has access to more things than studio does.

If a client can tell the server it’s doing something at level 7 and the server just accepts that and disregards filtering something is very wrong.

1 Like

Also using :Move(Vector3.new(math.huge,math.huge,math.huge)) on a Player or Humanoid will also kill you. Just look at the code for any kill/killall fe scripts on v3rm. They all use this method.

Thank you for submitting this report. We are currently reviewing all bug reports to ensure we have not overlooked any ongoing issues. Since this issue was reported over two years ago, can you please confirm you are still experiencing the problem? If so, please respond to this thread, and we will investigate. If we do not receive any response within 30 days, we will consider this matter resolved. Thank you.