Discover gists

Write-up

A warning to Roblox developers about a powerful exploit primitive. In this, I will detail the research I’ve conducted into this attack vector and walk you through how you as a developer, can protect against exploits with primitives like this.

DataStoreService lets you store data that needs to persist between sessions, such as items in a player’s inventory or skill points. Data stores are consistent per experience, so any place in an experience can access and change the same data, including places on different servers.

By default, experiences tested in Studio cannot access data stores, so you must first enable API services. You will need to do this to test the vulnerabilities.

The idea I wanted to explore when pondering the above question was; can we exploit remotes to prevent data from saving? It is easy to blame the developer for not protecting themselves against such a simple exploit but it ends up being more complicated than that. I found plenty of examples of these vulnerabilities occurring

scph5500.bin 26-Aug-2018 20:47 512.0K

scph5501.bin 26-Aug-2018 20:47 512.0K

scph5502.bin 26-Aug-2018 20:47 512.0K

	<?php

	// 1° EXEMPLO:
	// DEFINE NO CONSTRUCT A VALIDAÇÃO DO CPF E É VALIDADO NO onSAVE
	$cpf->addValidation('CPF', new TCPFValidator();

	// 2° EXEMPLO:
	// NO EVENTO ONCHANGE "SAÍDA" DO CAMPO
	(new TCPFValidator)->validate('CPF', $param['cpf']);

	<?php

	// 1° EXEMPLO:
	// DEFINE NO CONSTRUCT A VALIDAÇÃO DO E-MAIL E É VALIDADO NO onSAVE
	$cpf->addValidation('E-MAIL', new TEmailValidator();

	// 2° EXEMPLO:
	// NO EVENTO ONCHANGE "SAÍDA" DO CAMPO
	(new TEmailValidator)->validate('E-MAIL', $param['email']);

	#!/bin/bash
	# https://guifreelife.com/blog/2021/08/13/RHACM-Recover-Created-Cluster-Credentials-and-Kubeconfig/
	#
	# If an OpenShift cluster was created by RHACM this script will extract the
	# kubeconfig and the default kubeadmin credentials.
	#
	# Prereqs:
	# - Authenticated to hub cluster
	# - Managed cluster name is the sames as the hosting namespace on hub cluster

	<?php

	/* NA PROPRIEDADES DO DIAGRAMA.. CRIE UM CAMPO
	DO TIPO DATETIME E EM VALOR PADRÃO COLOQUE:

	CURRENT_TIMESTAMP

	*/

	<?php

	// DEFINA O RÓTULO DESEJADA PRA O LABEL.. EXEMPLO: CPF_CNPJ

	// MUDA DINAMICAMENTE O TEXTO DA LABEL DE ACORDO COM A CONDIÇÃO
	if ($tipo_pessoa == 'FÍSICA') {
	TScript::create("$('label:contains(\"CPF_CNPJ\")').html('CPF')");
	} else {
	TScript::create("$('label:contains(\"CPF_CNPJ\")').html('CNPJ')");
	}

	<?php

	// REALIZA A VALIDAÇÃO DO CAMPO NUMÉRICO
	$preco->addValidation('PREÇO R$', new TNumericValidator);

	<?php

	$tr->setFooterCallback(
	function($tr)
	{
	$pdf = $tr->getNativeWriter();

	$pdf->SetY(-40);

	$pdf->SetFont('Courier', '', 12);

	<?php

	$ano_atual = date('Y'); // ANO ATUAL

	// TOTALIZAÇÃO DA MOVIMENTAÇÃO FINANCEIRA POR MÊS
	$total_janeiro = (double) Movimentacao::where('MONTH(data_mov)', '=', '1')->where("YEAR(data_mov)", '=', $ano_atual)->sumBy('entrada-saida');
	$total_fevereiro = (double) Movimentacao::where('MONTH(data_mov)', '=', '2')->where("YEAR(data_mov)", '=', $ano_atual)->sumBy('entrada-saida');
	$total_marco = (double) Movimentacao::where('MONTH(data_mov)', '=', '3')->where("YEAR(data_mov)", '=', $ano_atual)->sumBy('entrada-saida');
	$total_abril = (double) Movimentacao::where('MONTH(data_mov)', '=', '4')->where("YEAR(data_mov)", '=', $ano_atual)->sumBy('entrada-saida');
	$total_maio = (double) Movimentacao::where('MONTH(data_mov)', '=', '5')->where("YEAR(data_mov)", '=', $ano_atual)->sumBy('entrada-saida');