TestVulnerabilityScript.luau

--!nocheck

--[[
    Vulnerability Check Script.lua ~ v0.1.1 ----  by RbxStu Contributors -> https://discord.gg/BE6JzuzSB8

    This script attempts to check for possible vulnerabilities on Execution tools in ROBLOX.

    The test results may look oversized (function count) as it attempts to bypass it using classic tactiques such as null-bytes, and other similar techniques.

    DISCLAIMER:
        Some functions this test flag MAY be innocent, this script will NOT guarantee your safety using an execution tool,
        it can only give you an overall idea on what could be improved, solved, or fixed 
]]

local RunService = game:GetService("RunService")

local isExternal = not pcall(function()
	assert(hookfunction)

	local function a()
		return "Hello"
	end

	local function b()
		return "Bye"
	end

	hookfunction(a, b)
	assert(a() == b()) -- If the functions aren't hooked, likely an external.

	local oldGame = game

	getfenv(1).game = nil -- Environment sandboxing on externals should prevent this operation.
	assert(oldGame == getfenv(1).game)
	assert(type(getfenv(0).game) == "userdata")
	assert(type(rawget(getfenv(0), "game")) == "nil")
end)

local Bypasses = {
	["External__EnvironmentEscape"] = "External Environment Escape",
	["ServiceObtentionViaSignal"] = "Obtained a Service via a Signal",
}

local TestData = {
	--- How many calls have been successfully blocked.
	Passes = 0,
	--- How many calls have successfully gone through.
	Failures = 0,
	--- Tests which do not really matter (i.e: Cannot test a hookmetamethod-based vulnerability if it isn't present).
	NotApplicable = 0,
	--- Whether the tool is an external (bytecode overwrite) based tool
	IsExternal = isExternal,
	--- Whether the tool is a studio based tool
	IsStudio = RunService:IsStudio(),
	TestedFunctions = {},
	SuccessfulBypasses = {},
}

do -- ServiceProvider exposes a Signal called ServiceAdded and ServiceRemoving, this could aid us in obtaining a blocked service.
	print(
		"-- Set up a possible bypass for accessing blocked services via the usage of ServiceAdded and ServiceRemoving!"
	)
	local function connectToSignal(serviceProvider: ServiceProvider)
		serviceProvider.ServiceAdded:Connect(function(svc: Instance)
			if not table.find(TestData.SuccessfulBypasses, Bypasses.ServiceObtentionViaSignal) then
				warn(
					"-- Bypass succeeeded! A service was obtained via ServiceAdded, whilst this may NOT result in a vulnerability, this should be taken care of!"
				)
				table.insert(TestData.SuccessfulBypasses, Bypasses.ServiceObtentionViaSignal)
			end
		end)
	end

	for _, service: ServiceProvider in { game } do
		connectToSignal(service)
	end
end

if TestData.IsExternal then
	print("Attempting to escape the function environment [Applicable to Externals]...")
	local s, e = pcall(function()
		--[[
                On Luau, metamethods will be executed if the table has no such member. This means that if we set a member to nil, and we attempt to use it afterwards,
                the table will find the value to be nil, and will use __index, which if it is the original roblox environment, it means we will escape the external sandbox
                and have unrestricted access, which means we can COMPLETELY escape the environment by making ALL values on getfenv(1) nil, as it will then call Roblox's __index.
            ]]

		local env = getfenv(1)
		local oldGame = rawget(env, "game")
		rawset(env, "game", nil)
		rawset(env, "tostring", nil) -- Avoid going through an overridden tostring, and using roblox's directly.

		if not oldGame then
			return -- The executor is using a metamethod for this, because of this, testing is unfeasable
		end

		if tostring(game) == tostring(oldGame) then
			error("Bypass failed")
		else
			error("bypass successful")
		end
	end)
	print(s, e)
	if s then
		warn(
			"Bypass unknown: Your executor seems to have blocked the __newindex, ignored it or simply is using a metamethod inside of another metamethod for this, This test results in no answer."
		)
	elseif not s and e:match("bypass successful") then
		warn(
			"The bypass has succeeded -- This could mean your executor has been vulnerated, after you run this script, restart your game!"
		)
	elseif not s and e:match("bypass failed") then
		warn(
			"The bypass has failed   -- The bypass has failed, either that, or the developer is faking this by modifying the environments' tostring function in a nested metamethod!"
		)
	end
end

local function AttemptObtainService(
	serviceProvider: ServiceProvider,
	serviceName: string
): (boolean, boolean, Instance? | string) -- HasFailed, IsUnknown, Service
	local hasFailed = false
	local isUnknown = false
	local serviceFound = nil :: Instance?
	local retIfServiceFoundIsNil = ""

	local provider = serviceProvider

	local s__index_service, ret = pcall(function(svc)
		return provider.service(provider, svc)
	end, serviceName)

	if s__index_service and type(ret) == "userdata" then
		if type(ret) == "userdata" then
			hasFailed = true
			serviceFound = ret
		else
			isUnknown = true
			retIfServiceFoundIsNil = ret
		end
	else
		retIfServiceFoundIsNil = ret
	end

	s__index_service, ret = pcall(function(svc)
		return provider.getService(provider, svc)
	end, serviceName)

	if s__index_service and type(ret) == "userdata" then
		if type(ret) == "userdata" then
			hasFailed = true
			serviceFound = ret
		else
			isUnknown = true
			retIfServiceFoundIsNil = ret
		end
	else
		retIfServiceFoundIsNil = ret
	end

	s__index_service, ret = pcall(function(svc)
		return provider.GetService(provider, svc)
	end, serviceName)

	if s__index_service and type(ret) == "userdata" then
		if type(ret) == "userdata" then
			hasFailed = true
			serviceFound = ret
		else
			isUnknown = true
			retIfServiceFoundIsNil = ret
		end
	else
		retIfServiceFoundIsNil = ret
	end

	s__index_service, ret = pcall(function(svc)
		return provider.FindService(provider, svc)
	end, serviceName)

	if s__index_service and type(ret) == "userdata" then
		if type(ret) == "userdata" then
			hasFailed = true
			serviceFound = ret
		else
			isUnknown = true
			serviceFound = ret
			retIfServiceFoundIsNil = ret
		end
	else
		retIfServiceFoundIsNil = ret
	end

	return hasFailed, isUnknown, (serviceFound or retIfServiceFoundIsNil or nil)
end

local function ExecuteTest(
	serviceName: string,
	functionName: string?,
	onPass: (() -> ())?,
	onFailure: (() -> ())?,
	onUnknown: (() -> ())?
)
	assert(serviceName)
	if not functionName then
		assert(typeof(serviceName) == "string")
		--[[
            Your executor must check the following three functions and its inputs.

            these functions come from ServiceProvider -- https://create.roblox.com/docs/reference/engine/classes/ServiceProvider

            provider.service           [DEPRECATED, BUT CAN BE USED TO BYPASS] -> https://create.roblox.com/docs/reference/engine/classes/ServiceProvider#service
            provider.getService        [DEPRECATED, BUT CAN BE USED TO BYPASS] -> https://create.roblox.com/docs/reference/engine/classes/ServiceProvider#getService
            provider.GetService                                                -> https://create.roblox.com/docs/reference/engine/classes/ServiceProvider#GetService
            provider.FindService                                               -> https://create.roblox.com/docs/reference/engine/classes/ServiceProvider#FindService
        ]]

		if serviceName:lower():match("datamodel") then
			return -- Not a vulnerability, but depended upon.
		end

		local nameBypasses = {
			serviceName,
			serviceName .. "\0", -- \0 is crazy.
		}

		local wasFailed = false
		local wasUnknown = false
		for _, bypassedServiceName in nameBypasses do
			for _, provider: ServiceProvider in { game } do
				local hasFailed, isUnknown, __service = AttemptObtainService(provider, bypassedServiceName)
				if hasFailed and typeof(__service) ~= "nil" then
					warn("⛔ Fail: Your executor allowed access to '" .. bypassedServiceName .. "'!")
					wasFailed = true
				end

				if isUnknown then
					warn(
						"⏺️ Unknown: Your executor seems to have the protection implemented in a special manner or is unprotected but due to low level of execution it is not vulnerable '"
							.. bypassedServiceName
							.. "'!"
					)
					wasUnknown = true
				end
			end
		end

		if wasUnknown then
			TestData.NotApplicable += 1
			if onUnknown then
				onUnknown()
			end
		end

		if wasFailed then
			TestData.Failures += 1
			if onFailure then
				onFailure()
			end
		end

		if not wasUnknown and not wasFailed then
			TestData.Passes += 1
			print("✅ Pass: Your executor has blocked access to '" .. serviceName .. "'")
			if onPass then
				onPass()
			end
		end
	else
		local isError, isUnknown, __service__
		if serviceName:lower():match("datamodel") then
			isError, isUnknown, __service__ = false, false, game
		else
			isError, isUnknown, __service__ = AttemptObtainService(game, serviceName)
		end

		if (isError or isUnknown) and type(__service__) ~= "userdata" then
			print("✅ Pass: Cannot test, Service appears to be blocked.")
			TestData.Passes += 1
			return
		end

		if
			not __service__.ClassName:lower():match(serviceName:lower())
			and (not serviceName:match("\0")) -- Functions with null-byte will fail to match, even after lowered, ignore them
		then
			print(
				"⏺️ Unknown: Service.ClassName ~= serviceName, this should not even be possible unless the environment has undergone proxying of any kind. | serviceName provided: "
					.. serviceName
					.. " tostring(Service) -> "
					.. __service__.ClassName
			)
			TestData.NotApplicable += 1
			return
		end

		local nameBypasses = {
			functionName,
			functionName .. "\0",
		}

		local failed = false
		for _, bypassedFunctionName in nameBypasses do
			local success, e = pcall(function(...)
				local f = __service__[functionName]
				f(__service__, ...)
			end)

			if success or (not success and e:lower():match("argument")) then -- Argument error, this means, well, it was able to be accessed, just no comment lmao.
				warn(
					"⛔ Fail: Your executor allowed access to "
						.. (__service__.ClassName == "DataModel" and "game" or __service__.ClassName)
						.. '["'
						.. bypassedFunctionName
						.. '"]('
						.. (__service__.ClassName == "DataModel" and "game" or __service__.ClassName)
						.. ", ...) !"
				)
				failed = true
			else
				print(
					"✅ Pass: Your executor blocked access to "
						.. (__service__.ClassName == "DataModel" and "game" or __service__.ClassName)
						.. '["'
						.. bypassedFunctionName
						.. '"]('
						.. (__service__.ClassName == "DataModel" and "game" or __service__.ClassName)
						.. ", ...) !"
				)
			end

			--! Supporting __namecall will be the 9th circle of hell, so for now, its not checked.
		end

		if failed then
			TestData.Failures += 1
		else
			TestData.Passes += 1
		end
	end
end

local function TestMany(serviceName: string, vulnerableFunctions: { string })
	local nameBypasses = {
		serviceName,
		serviceName .. "\0", -- \0 is crazy.
	}
	for _, svcName__Bypassed in nameBypasses do
		for _, functionName in vulnerableFunctions do
			local functionNameBypasses = {
				functionName,
				functionName .. "\0", -- \0 is crazy.
			}
			for _, functionName__Bypassed in functionNameBypasses do
				ExecuteTest(svcName__Bypassed, functionName__Bypassed)
			end
		end
	end
end

print("Executor Vulnerability Check -- RbxStu Contributors -> ")
print(
	"Your executor is an "
		.. (TestData.IsExternal and "External" or "Internal")
		.. " named '"
		.. (identifyexecutor())
		.. "'! Is"
		.. (not TestData.IsStudio and " not" or "")
		.. " a Studio Executor!"
)
print("✅ - Pass, ⛔ - Fail, ⏺️ - Unknown")
print("✅ Pass: Your executor has successfully blocked the vulnerable function")
print("⛔ Fail: Your executor has not blocked the vulnerable function")
print("⏺️ Unknown: Your executor may or may not have blocked the vulnerable function.")
print(
	"This script will also attempt to bypass the function name (if blocked) using tactiques like \\0! Your console will have many prints, so beware!"
)
warn("Test beginning in 5 seconds!")
task.wait(5)
do
	--[[
        HttpRbxApiService -- Used by CoreScripts to access the Roblox API. The request HAVE you ROBLOSECURITY, this means ANY operation can be run if this service is allowed.
    ]]
	local vulnerableFunctions = {
		"PostAsync",
		"PostAsyncFullUrl",
		"GetAsync",
		"GetAsyncFullUrl",
		"RequestAsync",
		"RequestLimitedAsync",
		-- GetDocumentationUrl is NOT considered a vulnerability.
		-- API Link: https://robloxapi.github.io/ref/class/HttpRbxApiService.html
	}
	ExecuteTest("HttpRbxApiService")
	TestMany("HttpRbxApiService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        ScriptContext -- Service is not risky to expose. Only specific functions in it are!
    ]]
	local vulnerableFunctions = {
		"AddCoreScriptLocal",
		"SaveScriptProfilingData",
		-- SetTimeout COULD be considered a vulnerability under specific conditions.
		-- API Link: https://robloxapi.github.io/ref/class/ScriptContext.html
	}

	TestMany("ScriptContext", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        ScriptContext -- Service is risky to expose, and can be used to open browser sessions, allowing for possible dangerous conditions.
    ]]
	local vulnerableFunctions = {
		"CopyAuthCookieFromBrowserToEngine", -- I really don't understand who in their sane mind would do this.
		"EmitHybridEvent",
		"ExecuteJavaScript",
		"OpenBrowserWindow",
		"OpenNativeOverlay",
		"OpenWeChatAuthWindow",
		"ReturnToJavaScript",
		"SendCommand",
		-- The events could be considered dangerous, thus block them if possible, but they're unchecked, since they're events after all...
		-- API Link: https://robloxapi.github.io/ref/class/BrowserService.html
	}

	ExecuteTest("BrowserService")
	TestMany("BrowserService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        MarketplaceService -- Service is risky to expose, can be used to perform purchases without the users' consent and check their ROBUX balance.
    ]]
	local vulnerableFunctions = {
		"GetRobuxBalance",
		"GetUserSubscriptionDetailsInternalAsync",
		"PerformBulkPurchase",
		"PerformPurchase",
		"PerformPurchaseV2",
		"PerformSubscriptionPuchase",
		"PerformSubscriptionPuchaseV2",
		"PrepareCollectiblesPurchase",

		"PlayerOwnsAsset", -- This can lead to targeting specific players with phishing campaigns for their items.
		"PlayerOwnsBundle", -- This can lead to targeting specific players with phishing campaigns for their items.

		"PromptBulkPurchase",
		"PromptBundlePurchase",
		"PromptCancelSubscription",
		"PromptCollectiblesPurchase",
		"PromptGamePassPurchase",
		"PromptNativePurchaseWithLocalPlayer",
		"PromptPremiumPurchase",
		"PromptRobloxPurchase",
		"PromptThirdPartyPurchase",
		"ReportAssetSale",
		-- API Link: https://robloxapi.github.io/ref/class/MarketplaceService.html
	}

	ExecuteTest("MarketplaceService")
	TestMany("MarketplaceService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        HttpService -- Service is not risky to expose.
    ]]
	local vulnerableFunctions = {
		"RequestInternal",
		-- API Link: https://robloxapi.github.io/ref/class/HttpService.html
	}

	if TestData.IsStudio then
		print("-- Executor is for studio! Adding extra dangerous functions specific to Roblox Studio environments!")
		table.insert(vulnerableFunctions, "GetSecret")
		table.insert(vulnerableFunctions, "SetHttpEnabled")
	end

	TestMany("HttpService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        GuiService -- Service is not risky to expose.
    ]]
	local vulnerableFunctions = {
		"OpenNativeOverlay",
		"OpenBrowserWindow",
		-- API Link: https://robloxapi.github.io/ref/class/GuiService.html
	}

	TestMany("GuiService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        OpenCloudService -- Service is risky to expose in Studio environments.
    ]]
	local vulnerableFunctions = {
		"HttpRequestAsync",
		-- API Link: https://robloxapi.github.io/ref/class/OpenCloudService.html
	}

	if TestData.IsStudio then
		print("-- Executor is for studio! Adding extra dangerous functions specific to Roblox Studio environments!")
		table.insert(vulnerableFunctions, "RegisterOpenCloud")
		table.insert(vulnerableFunctions, "GetApiV1")

		ExecuteTest("OpenCloudService")
	end

	TestMany("OpenCloudService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        MessageBusService -- Service is risky to expose. Can lead to code execution, do NOT expose.
    ]]
	local vulnerableFunctions = {
		"Call",
		"GetLast",
		"GetMessageId",
		"GetProtocolRequestMessageId",
		"GetProtocolResponseMessageId",
		"MakeRequest",
		"Publish",
		"PublishProtocolMethodRequest",
		"PublishProtocolMethodResponse",
		"SetRequestHandler",
		"Subscribe",
		"SubscribeToProtocolMethodRequest",
		"SubscribeToProtocolMethodResponse",
		-- API Link: https://robloxapi.github.io/ref/class/MessageBusService.html
	}

	ExecuteTest("MessageBusService")
	TestMany("MessageBusService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        DataModel (game) -- Service is not risky to expose.
    ]]
	local vulnerableFunctions = {
		"Load",
		"OpenVideosFolder",
		"OpenScreenshotsFolder",
		"Shutdown", -- Labeled due to kicking the player of the game forcefully.
		-- API Link: https://robloxapi.github.io/ref/class/DataModel.html
	}

	if TestData.IsStudio then
		print("-- Executor is for studio! Adding extra dangerous functions specific to Roblox Studio environments!")
		table.insert(vulnerableFunctions, "ReportInGoogleAnalytics")
		table.insert(vulnerableFunctions, "SavePlace")
		table.insert(vulnerableFunctions, "SetPlaceId")
		table.insert(vulnerableFunctions, "SetUniverseId")
	end

	TestMany("DataModel", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        OmniRecommendationsService -- Do not expose, there is no need for this service.
    ]]
	local vulnerableFunctions = {
		"MakeRequest",
		-- API Link: https://robloxapi.github.io/ref/class/OmniRecommendationsService.html
	}

	TestMany("OmniRecommendationsService", vulnerableFunctions)
end

print("------------------------------------------------")

do
	--[[
        Players -- Dangerous primitives relating to Reporting users.
    ]]
	local vulnerableFunctions = {
		"ReportAbuse",
		"ReportAbuseV3",
		-- API Link: https://robloxapi.github.io/ref/class/Players.html
	}

	if TestData.IsStudio then
		print("-- Executor is for studio! Adding extra dangerous functions specific to Roblox Studio environments!")
		table.insert(vulnerableFunctions, "UnbanAsync")
	end

	TestMany("Players", vulnerableFunctions)
end

print("------------------------------------------------")

if TestData.IsStudio then
	print("-- Executor is for studio! Testing vulnerabilities specific to Roblox Studio environments!")
	--[[
        StudioService -- Dangerous on Studio.
    ]]
	local vulnerableFunctions = {
		"CopyToClipboard", -- Blocked, use your executors version.
		"IsPluginInstalled",
		"IsPluginUpToDate",
		"OpenInBrowser_DONOTUSE",
		"SetPluginEnabled",
		"RequestClose",
		"ShowPublishToRoblox",
		"TryInstallPlugin",
		"UninstallPlugin",
		"UpdatePluginManagement",
		"PromptImportFile",
		"PromptImportFiles",
		"HasInternalPermission",
		-- API Link: https://robloxapi.github.io/ref/class/StudioService.html
	}

	TestMany("StudioService", vulnerableFunctions)
end

print("------------------------------------------------")
print("----- Testing executor  specific functions -----")
print("------------------------------------------------")

do
	print("-- Testing Filesystem APIs --")

	-- Attempt path traversal attack.
	do
		local _, e = pcall(listfiles, "../..")
		if typeof(e) == "table" then
			warn("⛔ Fail: Your executor allowed a '..' access into listfiles! Return -> " .. e)
			TestData.Failures += 1
		else
			print("✅ Pass: listfiles blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end

	do
		local s, e: string = pcall(writefile, "../new_file", "sick_content")
		if s or (not s and e:lower():match("file")) then
			warn("⛔ Fail: Your executor allowed a '..' access into writefile!")
			TestData.Failures += 1
		else
			print("✅ Pass: writefile blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end

	do
		local s, e: string = pcall(readfile, "../new_file")
		if s or (not s and e:lower():match("file")) then
			warn("⛔ Fail: Your executor allowed a '..' access into readfile!")
			TestData.Failures += 1
		else
			print("✅ Pass: readfile blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end

	do
		local s, e: string = pcall(appendfile, "../new_file", "sick_new_content")
		if s or (not s and e:lower():match("file")) then
			warn("⛔ Fail: Your executor allowed a '..' access into appendfile!")
			TestData.Failures += 1
		else
			print("✅ Pass: appendfile blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end

	do
		local s, e: string = pcall(makefolder, "../new_folder_super_new" .. tostring(math.random(2, 2000000)))
		if s or (not s and e:lower():match("folder")) then
			warn("⛔ Fail: Your executor allowed a '..' access into makefolder!")
			TestData.Failures += 1
		else
			print("✅ Pass: makefolder blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end

	do
		local s, e: string = pcall(delfile, "../new_folder_super_new" .. tostring(math.random(2, 2000000)))
		if s or (not s and e:lower():match("file")) then
			warn("⛔ Fail: Your executor allowed a '..' access into delfile!")
			TestData.Failures += 1
		else
			print("✅ Pass: delfile blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end

	do
		local s, e: string = pcall(delfolder, "../new_folder_super_new" .. tostring(math.random(2, 2000000)))
		if s or (not s and e:lower():match("folder")) then
			warn("⛔ Fail: Your executor allowed a '..' access into delfolder!")
			TestData.Failures += 1
		else
			print("✅ Pass: delfolder blocked access -> " .. tostring(e))
			TestData.Passes += 1
		end
	end
end

print("------------------------------------------------")
print("Attempting to bypass function protections by utilizing hookmetamethod!")
print("------------------------------------------------")

do
	local messageBusService = nil
	local old
	old = hookmetamethod(game, "__namecall", function(...)
		if not checkcaller() then
			local oldNamecall = getnamecallmethod()
			setnamecallmethod("GetService")

			messageBusService = old(game, "MessageBusService")

			if type(messageBusService) == "nil" then
				messageBusService = old(game, "MessageBusService\0")
			end

			setnamecallmethod(oldNamecall)
		end

		return old(...)
	end)

	task.wait(2)

	if type(messageBusService) == "userdata" then
		print("⛔ Fail: An attempt to obtain MessageBusService has succeeded on a lower-context thread! (BAD)")
		TestData.Failures += 1
	elseif not messageBusService then
		print("✅ Pass: An attempt to obtain MessageBusService has failed on a lower-context thread! (OK)")
		TestData.Passes += 1
	end
end

print("------------------------------------------------")
print("---    Executor    test   completed    ✅    ---")
print("------------------------------------------------")
print("Blocked Statistics (Including bypassed names):")
print(
	"Blocked Percentage: "
		.. math.round((TestData.Passes / (TestData.Failures + TestData.Passes + TestData.NotApplicable)) * 100)
		.. "%"
)
print(
	"✅  Blocked     Functions: "
		.. tostring(TestData.Passes)
		.. "/"
		.. tostring(TestData.Failures + TestData.Passes + TestData.NotApplicable)
)
print(
	"⛔  Non-Blocked  Functions: "
		.. tostring(TestData.Failures)
		.. "/"
		.. tostring(TestData.Failures + TestData.Passes + TestData.NotApplicable)
)
print(
	"⏺️ Not Applicable (Unknown): "
		.. tostring(TestData.NotApplicable)
		.. "/"
		.. tostring(TestData.Failures + TestData.Passes + TestData.NotApplicable)
)