The Powerful Minecraft EXPLOIT Mojang Didn't Want to Fix...
Vložit
- čas přidán 6. 06. 2024
- Almost 10 years ago now, a one of a kind minecraft feature would be introduced into the game. Beloved by mapmakers and players alike, that contained a powerful hidden exploit...
--------------------------------------------------------------------
Want to run your own minecraft server with friends or a community?
Get a 25% discount on hosting with code "Epic"!
shockbyte.com/partner/themist...
--------------------------------------------------------------------
Thanks for watching! Subscribe and Join My Discord!
Discord - / discord
Twitter - / themisterepicyt
Twitch - / themisterepicyt
Join my OG Minecraft Server, The OG Network! (1.8-1.20): og-network.net
- Website: og-network.net
- Discord: / discord
Team Doot - • [Release] TeamDOOT For...
• teamDOOT: Force OP Gri...
The Duper Trooper - • *NEW* Minecraft Force-...
0:00 - Intro
0:52 - Command Block Dispensing
2:49 - Sign ForceOP Exploit
5:45 - Command Block Exploits
8:00 - A Massive Unfortunate Oversight
Music Used:
1. Scott Buckley - Dragons Lullaby 2023
2. Scott Buckley - Sanctuary
3. Scott Buckley - Catalyst
4. DBadge - Artica ( • DBadge - Artica )
5. Feels - Patrick Patrikios
If there is any content in this video which you own and would like removed, than please contact me and I will be happy to oblige.
#minecraft #minecraftexploit #minecraftbugs - Hry
Make sure to subscribe!
Join my discord - discord.com/invite/WGc9UNM
Kings
i love this Minecraft Iceberg only missing is Fallendown song or Lavender sometimes lmao
i sucribe
Hi I love how you are aggenst p2w
signs that give you op
A gamerule that is set to false by default to allow dispensers to place them would have been a better fix. have a note saying that it can be a security risks when enabling would have also been good.
You could even put it in the server-properties for servers for a greater security and only people with console can change it.
@@kingyonatan2223 That would probably be the better option, if an exploit to change gamerules every comes around
Right now we need to pray that Mojang hears us
a gamerule is probly more likl;y now then it was back then now with every new update haveing some new game rule added so idk 1.21 is ment to be a tinker themed update who knows what will happen
I have to imagine they thought of that and couldn't implement it for whatever reason. I know nothing about the topic but a solution so simple would seem to have been considered before removing it completely, as they said there was no other solution.
Maybe the trigger wasn't able to be switched on and off so easily but what do I know, just trying to okay devil's advocate.
This defitely played a part in the decline of custom maps along side less CZcamsrs covering custom maps. It wasn't totally fatal and the Bedrock marketplace would eventually have an even worse impact on high quality maps becoming less common for java edition imo, which sucks for me as I only play java.
qmagnet moved to the Bedrock, which is a shame, but at least he gets paid for what he's doing
So that’s what happened to them
this is genuinely the first time im hearing any youtuber bring up plot worlds in any context, i practically grew up on these types of servers. shame they fell out of fashion for the most part
same, i loved them and remembered making a ton of fun builds like hotels and schools that people would rp in (though, looking back now, they all probably looked like ass lmao)
I mean, does RTGame's plot servers not count? He has made many videos on this, do the CZcamsrs have to build as well?
Creative plot worlds are extremely hard to maintain as paper and spigot don't protect against all creative exploits. Crashing a server with creative is 10 times easier than with survival.
@@bbittercoffee ah fair point, guess "any context" is a stretch, but RT's creative plots tend to be more collaborative, following specific themes, and having unique formats (like the mall one for example). im not saying youtubers have to be the ones building, i'm just saying ive never seen anyone so much as mention them outside of the way RTGame does them. And yeah if its not being done the way RT does it, I suppose it'd be hard to squeeze content out of it lmao
@@1.0 i guess this is the reason why hypixel own plot minigame called Housing still use survival gamemode with fly on
0:10 It can place carved pumpkins and Wither Skulls too.
Im not a java developer, but I don’t think that it would’ve been too difficult to make the dispenser place command blocks a setting that can be toggled. It would be on by default in single player but it multiplayer, it would be opt-in.
or, you know, add server validation to adding nbt data to command blocks and signs, as many things like chat commands are already server validated. Its a very basic and common practice in every online game, strange mojang cound't do it
@@Loki-qo2kb they probably encountered a bug when trying to fix it and didn't want to spend more time
@@Ramej so they were just lazy
@@xXRealXx yeah, few lines of codes can easily fix that but their dev team back then are incompetent
@@Loki-qo2kb I get why mojang did not decide to go this path because this would only prevent future issues, as people who already have command blocks with nbt in their inventory or already put it into a dispenser would just be able to use them in future updates, thus it still createas a security risk for servers. You might say "nobody would still have that" but if they bring it back and tell you that they fixed players being able to put arbitrary nbt into a command block, every server where you could attain a command block like that will be at risk if they take even a day until they update, bad actors would just try to get command blocks on as many servers as possible until they update, and when they update, they are still at risk.
If you say "they should also validate player inventories", they will jujst hide it in dispensers, if you say "they should also validate dispensers then", then maps will break as the dispensers have to be validated. I fully understand why you can't just bring it back.
Ah I remember the feature being removed.
I do remember hopping on an old old creative world of mine and trying to implement a Pseudo RNG system that instead relied on scoreboard points instead.
Might make a version of that for current MC, but man this brings me back to that day when I noticed the removal of it.
now there is a /random command for random values without dispenser command block jank :)
i did use such a method in a 1.19 server using tags and counting up the number on said tag. saddly if you repetetively use this it will repeat the randomizer pretty much every time getting the same output. also this method if used uses up resources so if you dont need the feature a lot there should be a way to stop it. also the use it was used in was a minigame as an anouncment title that pops up saying who won and a funny text message
omg... I remember this exploit. A server I'm now admin of got hit by this (and so did some related servers). The owner had to physically pull the plug on the server to boot a person who exploited this. Never again...
Mojang then: "We usually don't break compatibility and this will be an exception to the rule, hopefully the only one"
Mojang releasing 1.13: "nah screw that change every command and block ID"
fr tho i missed block IDs
@@disketteguytbh i think the system of block ids sucked, i absolutely hated needing to remember each id to create a monstrosity like /give @p 35:14 instead of just saying /give @p red_wool
@@kImJC1 they could've do the legacy magic thing like a symbolic link - in fact modern world edit did just that
It was an objectively worse system.
@@kImJC1fr it was a nightmare to make any command with this
I remember me and my friend making maps in 1.2.8 and I was the command block guy and I had to try and error until I find the correct color he wanted
That's quite sad to see a feature being used for good things getting removed because certain people take advantage of it and use it for destructive purposes, it ruins it for those using for things like making cool maps.
Don't blame the people exploiting, blame the devs for being too lazy to add a gamerule that allows dispensers to place command blocks that's off by default.
They couldn't write what amounts to adding 1 "if" or "and" statement. They already needed to check if it's dispensing a command block, all they had to do was add a nested if that checks if the gamerule is set to true or even just add an and qualifier in the same if they use for placing.
@@dragonproductions236 its 50-50 its players and mojang's fault.
I remember playing on a 1.8.3 Server with a plugin that prevents the ability to craft signs and a whole lot of other things, limiting Minecraft to a simple block game with almost no quality of life features.
And that the problem was fixed in 1.8.5 already, but they then kept the plugin anyway, despite updating 4 months after 1.8.5 came.
To my knowledge, there is another force op exploit. It requires you to obtain a mob spawner with nbt data, which will spawn command block minecarts and if one of them gets activated via a rail, you can get operator privileges.
Yeah, this one is Bedrock only iirc
@@wernerderchamp Someone has shown it to me on my server. It was so chaotic in general, so it was rather hard to see whether it worked.
@@wernerderchamp Spawners can't spawn in entities with NBT data in Bedrock.
For the Vanilla players you can get a command block with nbt through saved hotbars
Pretty sure those didn't exist in 1.8
Using the save hotbar and load hotbar feature, it is still possible to get NBT data command blocks. Though, you need creative to do so. Works on servers.
good idea
And op to run the comand
"1.8 snapshot thats almost 10 years old now"
Me asf: 👴👴👴
I guess this is an instance of a few bad actors ruining something for everyone else
shame this got removed, maybe there could be a safer way to bring this back later (if there isn't already something like this)
nah its bad programmers, like they just had to add server side validation for nbt data editing and done. No more adding nbt data without server permission
The same effect can be done today, but not as easily.
@@MrBelles104 its a rewrite of the nbt system, but not too much work probably
@@Loki-qo2kb first do it yourself and then tell us if it is possible
Maybe make a Admin Dispenser with the Ability to place any kind of Blocks to alleviate the issue?
Well since 1.13 we got datapacks and the new execute command, so we no longer need to rely on command blocks for map making while being able to make even more complex mechanics
I used to play on an svanilla server when this exploit was at its height, and one of the more notorious abusers of this exploit had basically held the server hostage until he was given a permanent staff position. We became good friends, chances are you learned his name during the research of this video. It’s fun seeing this revisited!
Command block dispensing is completely overshadowed by the eventual release of datapack functionality.
for a good long while in bedrock edition something like this existed as well it was known as the inventory transaction exploit (now patched) it allowed complete NBT editing as well as command block editing and some found other ways around just holding a command block minecart (which was the main exploit) such as creating beehives that instead of having bees had a command block minecart of course servers which were vanilla tried to combat this by simply removing beehives and bee nests then players started using fish buckets seeing as they could output an entity with nbt data to place command block minecarts once that was patched hackers found something pretty interesting they found a way to not only spoof the item but spoof the minecart as well so it couldnt just be /killed they used an unknown block that acted like a beehive and it output not a minecart but a moving block (the same entity used as a piston head) that acted like a command block this became so hard to completely patch that users would have to create mods just to try to patch these because combating them with just command blocks became nearly impossible but one day i hear mojang held a mobvote and some attackers used these exploits only then did mojang patch this this exploit lasted for years on end and all they had to do was make all item transactions handled server side
im having a stroke reading this, though i recall some hacker do exactly that in mob votes 2022
Inventories were server-sided on bedrock ever since 1.14 its just that there was a source type that was used for crafting, enchanting, beacon payment, repairing, renaming items that practically no validation checks.
In 1.16 Mojang added the ItemStackRequest packet which was designed to replace the InventoryTransaction packet. It was used for all the purposes I listed above. However, Mojang never removed the functionality for that source type until 1.19.60, which was what let people to spawn in any items they wanted.
Since you can now dispense shulker boxes, you can effectively still use the feature, but you have to run it through a red-coder which will select the matching signal strength of the schulker box you place, which means you can do the same thing, you just have a little more delay and noise. Not a perfect solution, but you can effectively do the same thing still.
There was also a command written book in wurst years ago. If people clicked on the book it would run a command on their client.
Spawning NBT edited items is possible in complete vannila minecraft using the ‘saved toolbars’ section, you can save all kinds of items there, including command blocks with NBT data.
did this with books that made me op, a bunch of people on small servers give you creative mode if ur kind and professional
Hello! keep up the great work! you are probably the most interesting minecraft youtuber i watch.
Genuinely never knew about this cheers
A good example of the power of the sign and command blocks and op is to watch Spoke and how he made the wormhole on Lifesteal SMP. He used many glitches to basically ban the owner account and he went from a player to a op.
4:00 thanks for reminding me I'm old as I remember hacked clients (like wurst) having the OP sign option.
I remember hearing some issues similar to this but was mainly bukit servers with plugins like essentials+ I think
Maps, plot worlds, and kneesnap. What a throwback to a forgotten era. I miss those days so much
I remember using the mechanic to build a machine that can play Rock Paper Scissors. Good times.
I didn't knew you could copy a block's NBT data by holding ctrl before middle click, that is so helpful, i wish i knew this sooner.
I actually used the OP-Sign exploit to take down a vanilla server at the time.
It was a very interesting exploit that has stayed in my memory for the past ten years :)
I've been involved with watching/playing minecraft since late 2012 to early 2013 and never even knew this was a thing.
I love commands in mc and well, 1 thank you for this video :) but 2 these days theyve since added a better way to get random effects by adding a sort=random selector to entity selectors
Fun fact: the Norwegian Minecraft server Skogliv has a creative plot world type. The reason I know this is because I actually bought Minecraft Java to hop in to the 10 year anniversary of a Norwegian newsletter sub brand called Aftenposten JR.
this is why no public server runs on vanilla if even they say its "vanilla"
I love the music you use in your videos.
"When you put a command block in a dispenser and activate it, nothing happens"
*you didnt have to cut me off*
Wouldn't this still work with command block minecarts?
Also, dispensers can also place carved pumpkins and wither skeleton skulls, if the dispenser believes this will create a mob. IIRC, the dispense is sometimes wrong about that. (Also, technically, water and lava sources are blocks, but I understand not counting those)
Happy new year everybody!
Luckily, with the new updates to Minecraft datapacks, you can pretty much recreate this effect.
Man I was lucky not seeing this in servers. I was out there destroying my pc with 1000 mods back then
Man i love how nobody talking about the breaking gold blocks nearby [Currently trading piglins]
i feel like the best way to patch this (better than a gamerule, even) would be to implement some form of "random" command-- i.e. /random [/say hello] [/say goodbye] or something, where it chooses randomly which command to execute
Yes, but that would require adding useful features. MS wants people to fight and scream over every update.
There are predicates
Im pretty sure you can also dispense the pumpkin or carved pumpkin blocks so that snow golems can be automated
Only on snow blocks
@@mineralnoodles oh yeah that’s probably also why so many people don’t know about it
@@Fjordztyep and you can dispense wither skulls on soul blocks too
Wow. That's a blast down memory lane. Seen some names I haven't heard in years in this video. Guess it's appropriate to see my name at 6:50
I don't know if I was the first to discover both of these bugs, but there was one this video was missing. Spawners could be placed that could spawn entities with passengers of falling block entities, which were command blocks with commands already set. That one went unpatched slightly longer than the others due to the convolutedness.
mustard
@@elizabethmackay972 Paula Deen
Hmm... I was petty new to the game during the 1.8 versions, and didn't do much with commands, so I might be wrong about what command blocks were capable of at the time, but wasn't it possible to set a command block to detect the presence of a particular item? A dropper filled with items, and then a set of detectors that activated further commands would be larger and clunkier than directly dispensing a random command block, but do basically the same thing. And even if you couldn't do the detection directly with commands, you could definitely do it a little slower with item sorters. Not necessarily better than an armor stand randomizer (I don't know enough about those to compare) but at the very least another option.
I had made a forceOP book that when you open it just automatically OPS every player in the radius, but the bad thing about said book is you would need creative which can be done in creative servers/
The fact that mojang remove the nbt in bedrock but can't do it in java it would have been amazing if they actually remove nbt and added back the dispenser that can place items
wow command blocks have existed for so long and I've still never seen one in game
Happy new years! guys
In the modern versions of the game, randomizers can still be made but the easiest are still no where near as easy. One solution that would have slightly lessened the complaints would allow the dispensers to work properly on singleplayer and not multiplayer. Basically the internal server would allow people to still enjoy *some* maps by themselves, but if they opened up to lan or joined a server through the multiplayer screen, the behavior wouldn't work.
In modern Minecraft it is easier than ever before to make a randomizer by using the /random command(at least in java)
Yeah, these days such features are just not necessery (in fact, completely useless). Datapacks removed the need for making any contraptions and modern commands simplified almost every aspect of the mapmapking. The development in minecraft is nowadays completely different than a few years ago.
Mojang should prevent creative mode players from spawning in items with arbitrary NBT data. Nothing good can come from it. They could still keep the middle mouse button feature working without letting people create whatever NBT monstrosities they wish.
Quite a lot of Good can come from it
@@leonardonetagamer For any good that could come from it a proper method for letting the player spawn those items in would be better than just letting any item be spawned in.
thats not really possible since there are items in the creative inventory that have custom nbt and it would break mods (and saved inventories are useful)
@@SmokeFactory I am specifically against arbitrary custom NBT. I see nothing wrong with a creative mode user being able to spawn an enchant book. For saved inventories if it's of legitimate items a creative made user should be able to spawn those in.
@@gyroninjamodderhow are they gonna tell the difference between ‘good’ and ‘bad’ nbt
Actually you don't even need a hacked client - you can save an item with whatever nbt you want in the saved hotbars of the vanilla client.
an exploit that mojang hasn't fixed yet?!?!!?!?!
never seen that before
Spoke be like: nice vid i think its really fun ;)
They could've made a special dispenser that can place only and put items in by operators.
*Dispencers also place Carved Pumpkins, if in close proximity to two snow blocks
You can also place pumpkins with dispensers
best channel logo ever
I feel like if they made it a per world toggle then it would have still been okay. I do know however that it isn't that simple and would take a lot of programming and testing to make it secure whist still giving that ability to the maps that need it.
On vanilla servers you can do force op to this day but there are no vanilla servers anymore
there is still one way to 'wormhole' items into servers.
They had to wait three major versions to get another dispenser block randomiser
On cracked servers you used to be able to yoink the admins nickname, join the server and give players op without even logging into the server
I just realized your server has ranks
bro, the old textures make me think that you're playing on an older version of minecraft
I really really enjoyed this video 👍
is this deja vu or have i already seen this covered on another channel
hey, did you know that if you go to any p2w creative server, you can lag the game infinitely?
Clients can create NBT signs?
..
I mean, I guess it would be pointless if you already have OP, but that could be used to give yourself sharpness 1,000 swords, or thorns 1,000.. oak planks
they also place pumpkins most of the time it completes the golem but there's methods to place just the pumpkin
I decided to look at minecraft's official server list created by Microsoft.
Unfortunately its no different than any other server list site, plagued with mostly p2w servers
Why couldn't there just be a check for non-op players that the block they're "copying" actually exists nearby on the copy side of the operation?
I mean.. they could have just tracked down the cause of the placing (aka, droppers placed by non-OP people cant place command blocks) or, by checking if the activator (lever or whatever) was placed by an OP-person..
Can the old maps be remade in current version using datapack functions?
Why don't they just make a "make dispensers place command blocks" tick in World Options for single player?
8:00 insert vsauce music here
They could just add NBT for dispenser to allow this behavior. But player with no sufficient permission could not place it.
it really seems like command blocks shouldn't be able to set op to begin with. I honestly can't think of a single reason you'd want that to be a feature. It's too important of a command.
That said, even with that removed, people would probably just give themselves creative mode, or use the fill command or any number of other ways to destroy things quickly...
Even if theat was the case though
Sooo what exactly is stopping mojang from simply making it impossible to obtain NBT data on any block without the operator status, or, better yet, making the operator command be impossible to run on a command block? I feel like an exception like that would be painfully trivial and wouldn't break anything
Happy New Year!🎉🎉
8:45 that apparently happened on the day of my 10th birthday. Weird
As someone who doesn't make maps, I probably can't *fully* understand the pain and frustration that mapmakers went through when this incredible idea went to the trash. However, I think it was for the better. Had it not been for the fact that Mojang patched it, servers would be extremely unbearable and awful because people (specifically hackers and whatnot) suck. It's a pain sure, but a necessary one.
Disagreed, a simple solution would be to make the ability to do this a toggleable game rule. Best of both worlds, works great for custom maps, but servers wouldn't have the risks.
Huh. Couldn't they just add gamerule for dispensers placing commandblocks that by default be false , but mapmakers could just set it to true?
I mean wouldn’t it be as simple as making non-op players not be able to put command blocks in dispensers
6:45 you didn`t even need the hacked client in this case. go to an creative world,make the comandblock, middleclick it so u get the nbtdata,save it to your toolbar,go on the creative server,take the comand block from your toolbar,place it in a dispenser,and that`s it
Saved toolbars were not added to Minecraft until 1.12.
@@mrdiamond64 oh... hos tf did i miss that
8:00 Why didn't you use Vsauce music here 😭
What if it was an option in world settings?
erm actually a dispenser can also place a pumpkin if there is snow in a certain way
I feel like there should be some kind of non op command block. Where the command block has some kind of ownership tag that gets set and can only run commands that the owner has permission to.
what would it be used for tho
edit:plus you could just spoof the ‘ownership’ tag…
then the map would only work for the admin. no one else can play the map as they don't have the admin permission for the command blocks.
@@traumatized_otaku this idea for a fix wouldn’t work for the game since it could be exploited BUT, the block would have the ‘ownership’ tag so therefore it would activate even if its not an admin using it
🗿🗿🗿
Imagine this one in the game spoke would love this in lifesteal smp
If you had Minecraft Bedrock I have a server you could dupe on It's liveboat you can only play 30 minutes in each gamemode
omg! this exploit is crazy! it will destroy Minecraft forever! .....if you are using a 10 year old version of the game ....
and if you are using a hacked client ......insane!!!
Reminds me of the UUID spoofing days lol
I think you forgot the command block in minecart with nbt data inside it which I was using before until I got bored
This was a catastrophic RCE from the get go. I don't understand why Mojang keeps presenting what is essentially a cheat shell as a viable multiplayer mechanic. If they want to make a real user-accessible command system they should start with an ownership and permission system (Unix is a good example in that it gets pretty far with very little logic), or completely separate data from logic. Redstone is a bad tool to manage command block control flow as well.
They could have copied the original dispenser code to an "admin dispenser". Then copy the command block's code that prevents non admins from placing or changing them.
Exploits to get the admin dispenser would already work on the command block, meaning the block existing creates no new security holes.
Hoppers could be a potential problem.
If an admin dispenser is already placed, anyone could attach a hopper to it and put a command block in the hopper.
Or they could use a hopper to pull a command block out of a placed admin hopper.
As a coder myself, it doesn't even need to be that complicated. Just don't allow unprivileged access to commands. Like they already have a permissions system in place, but do they apply that to the whole game equally? No, they remove features when they can't be bothered to patch the game's code a little to fix their oversight. MS is a terrible company and people need to stop referring to the MS-owned Mojang as "Mojang." The original has been gone for many years now.
They could have done it where they give dispensers 2 block states: Normal (the one we use in survival mode), and CommandBlockDispensing. You can only set it to CommandBlock Dispensing state via a debug stick. That would have fixed it.
This seems to be a running theme with exploits in minecraft and in minecraft mods. An exploit is found, and the developers refuse to address the root cause properly. Why do they allow clients to create items with artibrary NBT data? If the purpose of the feature is to allow you to copy existing things with existing NBT data, why not just keep track of that on the server instead of trusting the client with such great power? By addressing the actual problem, they could have kept the feature.
It's like when an exploit was found on an anarchy server that allowed a patient exploiter to identify which chunks were loaded on the server, and consequently, the rough location of other players. The first attempt to patch this didn't even bother to address the fact that the game client was requesting information about chunks that were obviously too far away, and this resulted in the exploiting continuing later. Only the second time around did they actually address the root problem. It's like these developers never learned the first rule of software security: never trust the client