The Powerful Minecraft EXPLOIT Mojang Didn't Want to Fix... 

Make sure to subscribe! Join my discord - discord.com/invite/WGc9UNM

A gamerule that is set to false by default to allow dispensers to place them would have been a better fix. have a note saying that it can be a security risks when enabling would have also been good.

This defitely played a part in the decline of custom maps along side less RU-vidrs covering custom maps. It wasn't totally fatal and the Bedrock marketplace would eventually have an even worse impact on high quality maps becoming less common for java edition imo, which sucks for me as I only play java.

this is genuinely the first time im hearing any youtuber bring up plot worlds in any context, i practically grew up on these types of servers. shame they fell out of fashion for the most part

0:10 It can place carved pumpkins and Wither Skulls too.

Im not a java developer, but I don’t think that it would’ve been too difficult to make the dispenser place command blocks a setting that can be toggled. It would be on by default in single player but it multiplayer, it would be opt-in.

Ah I remember the feature being removed. I do remember hopping on an old old creative world of mine and trying to implement a Pseudo RNG system that instead relied on scoreboard points instead. Might make a version of that for current MC, but man this brings me back to that day when I noticed the removal of it.

omg... I remember this exploit. A server I'm now admin of got hit by this (and so did some related servers). The owner had to physically pull the plug on the server to boot a person who exploited this. Never again...

Mojang then: "We usually don't break compatibility and this will be an exception to the rule, hopefully the only one" Mojang releasing 1.13: "nah screw that change every command and block ID"

That's quite sad to see a feature being used for good things getting removed because certain people take advantage of it and use it for destructive purposes, it ruins it for those using for things like making cool maps.

I remember playing on a 1.8.3 Server with a plugin that prevents the ability to craft signs and a whole lot of other things, limiting Minecraft to a simple block game with almost no quality of life features. And that the problem was fixed in 1.8.5 already, but they then kept the plugin anyway, despite updating 4 months after 1.8.5 came.

To my knowledge, there is another force op exploit. It requires you to obtain a mob spawner with nbt data, which will spawn command block minecarts and if one of them gets activated via a rail, you can get operator privileges.

For the Vanilla players you can get a command block with nbt through saved hotbars

Using the save hotbar and load hotbar feature, it is still possible to get NBT data command blocks. Though, you need creative to do so. Works on servers.

"1.8 snapshot thats almost 10 years old now" Me asf: 👴👴👴

I guess this is an instance of a few bad actors ruining something for everyone else shame this got removed, maybe there could be a safer way to bring this back later (if there isn't already something like this)

Well since 1.13 we got datapacks and the new execute command, so we no longer need to rely on command blocks for map making while being able to make even more complex mechanics

I used to play on an svanilla server when this exploit was at its height, and one of the more notorious abusers of this exploit had basically held the server hostage until he was given a permanent staff position. We became good friends, chances are you learned his name during the research of this video. It’s fun seeing this revisited!

Command block dispensing is completely overshadowed by the eventual release of datapack functionality.

for a good long while in bedrock edition something like this existed as well it was known as the inventory transaction exploit (now patched) it allowed complete NBT editing as well as command block editing and some found other ways around just holding a command block minecart (which was the main exploit) such as creating beehives that instead of having bees had a command block minecart of course servers which were vanilla tried to combat this by simply removing beehives and bee nests then players started using fish buckets seeing as they could output an entity with nbt data to place command block minecarts once that was patched hackers found something pretty interesting they found a way to not only spoof the item but spoof the minecart as well so it couldnt just be /killed they used an unknown block that acted like a beehive and it output not a minecart but a moving block (the same entity used as a piston head) that acted like a command block this became so hard to completely patch that users would have to create mods just to try to patch these because combating them with just command blocks became nearly impossible but one day i hear mojang held a mobvote and some attackers used these exploits only then did mojang patch this this exploit lasted for years on end and all they had to do was make all item transactions handled server side

Since you can now dispense shulker boxes, you can effectively still use the feature, but you have to run it through a red-coder which will select the matching signal strength of the schulker box you place, which means you can do the same thing, you just have a little more delay and noise. Not a perfect solution, but you can effectively do the same thing still.

There was also a command written book in wurst years ago. If people clicked on the book it would run a command on their client.

Spawning NBT edited items is possible in complete vannila minecraft using the ‘saved toolbars’ section, you can save all kinds of items there, including command blocks with NBT data.

Hello! keep up the great work! you are probably the most interesting minecraft youtuber i watch.

Genuinely never knew about this cheers

A good example of the power of the sign and command blocks and op is to watch Spoke and how he made the wormhole on Lifesteal SMP. He used many glitches to basically ban the owner account and he went from a player to a op.

4:00 thanks for reminding me I'm old as I remember hacked clients (like wurst) having the OP sign option.

I remember hearing some issues similar to this but was mainly bukit servers with plugins like essentials+ I think

Maps, plot worlds, and kneesnap. What a throwback to a forgotten era. I miss those days so much

I remember using the mechanic to build a machine that can play Rock Paper Scissors. Good times.

I didn't knew you could copy a block's NBT data by holding ctrl before middle click, that is so helpful, i wish i knew this sooner.

I actually used the OP-Sign exploit to take down a vanilla server at the time. It was a very interesting exploit that has stayed in my memory for the past ten years :)

I've been involved with watching/playing minecraft since late 2012 to early 2013 and never even knew this was a thing.

I love commands in mc and well, 1 thank you for this video :) but 2 these days theyve since added a better way to get random effects by adding a sort=random selector to entity selectors

Fun fact: the Norwegian Minecraft server Skogliv has a creative plot world type. The reason I know this is because I actually bought Minecraft Java to hop in to the 10 year anniversary of a Norwegian newsletter sub brand called Aftenposten JR.

this is why no public server runs on vanilla if even they say its "vanilla"

I love the music you use in your videos.

"When you put a command block in a dispenser and activate it, nothing happens" *you didnt have to cut me off*

Wouldn't this still work with command block minecarts? Also, dispensers can also place carved pumpkins and wither skeleton skulls, if the dispenser believes this will create a mob. IIRC, the dispense is sometimes wrong about that. (Also, technically, water and lava sources are blocks, but I understand not counting those)

Happy new year everybody!

Luckily, with the new updates to Minecraft datapacks, you can pretty much recreate this effect.

Man I was lucky not seeing this in servers. I was out there destroying my pc with 1000 mods back then

Man i love how nobody talking about the breaking gold blocks nearby [Currently trading piglins]

i feel like the best way to patch this (better than a gamerule, even) would be to implement some form of "random" command-- i.e. /random [/say hello] [/say goodbye] or something, where it chooses randomly which command to execute

Wow. That's a blast down memory lane. Seen some names I haven't heard in years in this video. Guess it's appropriate to see my name at 6:50 I don't know if I was the first to discover both of these bugs, but there was one this video was missing. Spawners could be placed that could spawn entities with passengers of falling block entities, which were command blocks with commands already set. That one went unpatched slightly longer than the others due to the convolutedness.

Im pretty sure you can also dispense the pumpkin or carved pumpkin blocks so that snow golems can be automated

Hmm... I was petty new to the game during the 1.8 versions, and didn't do much with commands, so I might be wrong about what command blocks were capable of at the time, but wasn't it possible to set a command block to detect the presence of a particular item? A dropper filled with items, and then a set of detectors that activated further commands would be larger and clunkier than directly dispensing a random command block, but do basically the same thing. And even if you couldn't do the detection directly with commands, you could definitely do it a little slower with item sorters. Not necessarily better than an armor stand randomizer (I don't know enough about those to compare) but at the very least another option.

I had made a forceOP book that when you open it just automatically OPS every player in the radius, but the bad thing about said book is you would need creative which can be done in creative servers/

The fact that mojang remove the nbt in bedrock but can't do it in java it would have been amazing if they actually remove nbt and added back the dispenser that can place items

wow command blocks have existed for so long and I've still never seen one in game

Happy new years! guys

In the modern versions of the game, randomizers can still be made but the easiest are still no where near as easy. One solution that would have slightly lessened the complaints would allow the dispensers to work properly on singleplayer and not multiplayer. Basically the internal server would allow people to still enjoy *some* maps by themselves, but if they opened up to lan or joined a server through the multiplayer screen, the behavior wouldn't work.

Mojang should prevent creative mode players from spawning in items with arbitrary NBT data. Nothing good can come from it. They could still keep the middle mouse button feature working without letting people create whatever NBT monstrosities they wish.

Actually you don't even need a hacked client - you can save an item with whatever nbt you want in the saved hotbars of the vanilla client.

an exploit that mojang hasn't fixed yet?!?!!?!?! never seen that before

Spoke be like: nice vid i think its really fun ;)

They could've made a special dispenser that can place only and put items in by operators.

*Dispencers also place Carved Pumpkins, if in close proximity to two snow blocks

You can also place pumpkins with dispensers

best channel logo ever

I feel like if they made it a per world toggle then it would have still been okay. I do know however that it isn't that simple and would take a lot of programming and testing to make it secure whist still giving that ability to the maps that need it.

On vanilla servers you can do force op to this day but there are no vanilla servers anymore

there is still one way to 'wormhole' items into servers.

They had to wait three major versions to get another dispenser block randomiser

On cracked servers you used to be able to yoink the admins nickname, join the server and give players op without even logging into the server

I just realized your server has ranks

bro, the old textures make me think that you're playing on an older version of minecraft

I really really enjoyed this video 👍

is this deja vu or have i already seen this covered on another channel

hey, did you know that if you go to any p2w creative server, you can lag the game infinitely?

Clients can create NBT signs? .. I mean, I guess it would be pointless if you already have OP, but that could be used to give yourself sharpness 1,000 swords, or thorns 1,000.. oak planks

they also place pumpkins most of the time it completes the golem but there's methods to place just the pumpkin

I decided to look at minecraft's official server list created by Microsoft. Unfortunately its no different than any other server list site, plagued with mostly p2w servers

Why couldn't there just be a check for non-op players that the block they're "copying" actually exists nearby on the copy side of the operation?

I mean.. they could have just tracked down the cause of the placing (aka, droppers placed by non-OP people cant place command blocks) or, by checking if the activator (lever or whatever) was placed by an OP-person..

Can the old maps be remade in current version using datapack functions?

Why don't they just make a "make dispensers place command blocks" tick in World Options for single player?

8:00 insert vsauce music here

They could just add NBT for dispenser to allow this behavior. But player with no sufficient permission could not place it.

it really seems like command blocks shouldn't be able to set op to begin with. I honestly can't think of a single reason you'd want that to be a feature. It's too important of a command. That said, even with that removed, people would probably just give themselves creative mode, or use the fill command or any number of other ways to destroy things quickly... Even if theat was the case though

Sooo what exactly is stopping mojang from simply making it impossible to obtain NBT data on any block without the operator status, or, better yet, making the operator command be impossible to run on a command block? I feel like an exception like that would be painfully trivial and wouldn't break anything

Happy New Year!🎉🎉

8:45 that apparently happened on the day of my 10th birthday. Weird

As someone who doesn't make maps, I probably can't *fully* understand the pain and frustration that mapmakers went through when this incredible idea went to the trash. However, I think it was for the better. Had it not been for the fact that Mojang patched it, servers would be extremely unbearable and awful because people (specifically hackers and whatnot) suck. It's a pain sure, but a necessary one.

Huh. Couldn't they just add gamerule for dispensers placing commandblocks that by default be false , but mapmakers could just set it to true?

I mean wouldn’t it be as simple as making non-op players not be able to put command blocks in dispensers

6:45 you didn`t even need the hacked client in this case. go to an creative world,make the comandblock, middleclick it so u get the nbtdata,save it to your toolbar,go on the creative server,take the comand block from your toolbar,place it in a dispenser,and that`s it

8:00 Why didn't you use Vsauce music here 😭

What if it was an option in world settings?

erm actually a dispenser can also place a pumpkin if there is snow in a certain way

I feel like there should be some kind of non op command block. Where the command block has some kind of ownership tag that gets set and can only run commands that the owner has permission to.

Imagine this one in the game spoke would love this in lifesteal smp

If you had Minecraft Bedrock I have a server you could dupe on It's liveboat you can only play 30 minutes in each gamemode

omg! this exploit is crazy! it will destroy Minecraft forever! .....if you are using a 10 year old version of the game .... and if you are using a hacked client ......insane!!!

Reminds me of the UUID spoofing days lol

I think you forgot the command block in minecart with nbt data inside it which I was using before until I got bored

This was a catastrophic RCE from the get go. I don't understand why Mojang keeps presenting what is essentially a cheat shell as a viable multiplayer mechanic. If they want to make a real user-accessible command system they should start with an ownership and permission system (Unix is a good example in that it gets pretty far with very little logic), or completely separate data from logic. Redstone is a bad tool to manage command block control flow as well.

They could have copied the original dispenser code to an "admin dispenser". Then copy the command block's code that prevents non admins from placing or changing them. Exploits to get the admin dispenser would already work on the command block, meaning the block existing creates no new security holes.

They could have done it where they give dispensers 2 block states: Normal (the one we use in survival mode), and CommandBlockDispensing. You can only set it to CommandBlock Dispensing state via a debug stick. That would have fixed it.

This seems to be a running theme with exploits in minecraft and in minecraft mods. An exploit is found, and the developers refuse to address the root cause properly. Why do they allow clients to create items with artibrary NBT data? If the purpose of the feature is to allow you to copy existing things with existing NBT data, why not just keep track of that on the server instead of trusting the client with such great power? By addressing the actual problem, they could have kept the feature. It's like when an exploit was found on an anarchy server that allowed a patient exploiter to identify which chunks were loaded on the server, and consequently, the rough location of other players. The first attempt to patch this didn't even bother to address the fact that the game client was requesting information about chunks that were obviously too far away, and this resulted in the exploiting continuing later. Only the second time around did they actually address the root problem. It's like these developers never learned the first rule of software security: never trust the client