What is this exploit being used for?
As of the time of this post, exploiters are using this exploit to abuse Roblox’s traditional tools- allowing them to re-parent their own tools to the StarterPack, StarterCharacterScripts, and their own StarterGear. As of last night, they released to the public an exploit that allows them to manipulate their own tools and then re-parent it to another character, allowing them to do some wild hacks that makes other people skydive, “fastbring”, and even being able to crash the server by essentially re-parenting tools into the StarterPack/StarterCharacterScripts until the game slows and inevitably crashes.
What can I do about it?
There is two ways you can go about this:
- All of these exploits abuse traditional Roblox tools- so games that use custom tool systems are seemingly immune to this. If you do not already use a custom tool system for your game, this may seem like an extreme option. Thankfully, there’s another way.
- You can attempt to track these changes on the server- and because they replicate, the server actually can detect these exploits fairly easily. I have created a script that can detect and stop this exploit in it’s tracks. You can grab it here- I just recommend reading the comments inside the script before adding it to your game.
Sources:
When it first started occurring in my game, I didn’t believe it. I thought it was an admin screwing around or maybe an unsecured RemoteEvent. So to confirm my suspicions, I created a baseplate with only one thing: a tool giver. You can find the place I used as a control here, it is uncopylocked. Exploiters who were more than willing to show off showed me how it worked and allowed me to test on them.
You can find the exploit yourself on v3rmillion (along with examples of its use), just search “Free Roblox Script Graphene Admin | universal tool dupe | control and kill players” or use the thread id 1183947. I would post the link, but I’m not sure I’m allowed to post links to v3rm on here.
So how did you patch it?
Link to Model: Anti-Tool-Dupe - Roblox
Souce Code:
local SCS = game:GetService('StarterPlayer'):WaitForChild('StarterCharacterScripts')
local SP = game:GetService('StarterPack')
local Players = game:GetService('Players')
local Bans = {}
function EnsureDestroy(Child)
pcall(function()
repeat Child:Destroy() wait() until not Child.Parent -- This is really crude and probably could be better but it gets the job done
end)
end
SCS.ChildAdded:Connect(function(Child)
-- This will detect whenever anything NEW is added, if for whatever reason you actually insert stuff here
-- later in the game you should add an if statement to check if its allowed
EnsureDestroy(Child)
end)
SP.ChildAdded:Connect(function(Child)
-- This will detect whenever anything NEW is added, if for whatever reason you actually insert stuff here
-- you should add an if statement to check if its allowed
EnsureDestroy(Child)
end)
function CharacterHookup(Player, Character)
Character.ChildRemoved:Connect(function(Child)
if Child:IsA('Tool') and not Child.CanBeDropped then -- If the tool can be dropped, it's not protected by this patch :(
-- You should also make sure that you don't parent the same tool from someone else into another players backpack
-- (CLONE IT INSTEAD)
repeat wait() until not Child.Parent or Child.Parent == Player.Backpack or Child.Parent:FindFirstChild('Humanoid')
if not Child.Parent then
EnsureDestroy(Child)
else
if Child.Parent:FindFirstChild('Humanoid') then
local NewPlayer = Players:GetPlayerFromCharacter(Child.Parent)
if NewPlayer ~= Player then
EnsureDestroy(Child)
Bans[Player.UserId] = true -- You can remove these lines if you don't want to ban them
Player:Kick('Banned by Anti-Cheat') -- You can remove these lines if you don't want to ban them
end
end
end
end
end)
end
Players.PlayerAdded:Connect(function(Player)
if Bans[Player.UserId] then
Player:Kick('Banned by Anti-Cheat')
end
local SG = Player:WaitForChild('StarterGear')
SG.ChildAdded:Connect(function(Child)
-- This will detect whenever anything NEW is added, if for whatever reason you actually insert stuff here
-- later in the game you should add an if statement to check if its allowed
EnsureDestroy(Child)
end)
if Player.Character then
CharacterHookup(Player, Player.Character)
end
Player.CharacterAdded:Connect(function(Character)
CharacterHookup(Player, Character)
end)
end)
In this script, I made it detect whenever a new child is added to StarterPack, StarterCharacterScripts, and your own StarterGear folder and delete anything that’s added to it. If for whatever reason you actually add stuff here in your game, just add a whitelist.
The above effectively stops people from duplicating tools to the server and prevents people from crashing your game. To patch the remaining exploits such as skydive and fastbring, I detected whenever a tool is removed from the character and listened for a new parent. If the new parent is not the backpack or the character of the person it originates from, it immediately destroys the tool and server-bans the player (You can easily modify this if you don’t want to ban people).
An important note: Because of the way this works, please disable tool dropping in your game as tool dropping will render the second part of the script useless. If you have to give a tool from one player to another, it is important to clone the tool (and destroy the original, if you want) and give it to the new player instead of re-parenting it- as this will trip the anti-cheat.
I hope this helps. 
let’s be honest this prob won’t even get patched for a long time and I HIGHLY doubt they would put in effort to ban users over this.