Java Edition:Command Sign
In 14w25a (a 1.8 snapshot), signs received JSON text support, including the ability to run commands through the click event (either clickEvent or click_event, depending on the version) tag. Signs containing a custom click event are only meant to be available from commands for custom map makers or server administrators to allow non-operator players to use commands in a controlled manner. However, there are several unintentional ways to obtain such signs without access to commands.
These signs are particularly dangerous before 1.8.5, as from their addition in 14w25a to 1.8.4 signs would execute their commands with level 4 operator privileges, allowing players to execute any command. This is extremely dangerous, especially on multiplayer servers, as players can /op themselves!!! 1.8.5 changed signs to execute their commands with level 2 operator privileges, which is the level command blocks execute commands at.
Obtaining
Modified Client
The new JSON sign packet in 14w25a (a 1.8 snapshot) was only supposed to allow for raw text JSON components, but instead it originally allowed for any JSON component. This allowed for modified clients to create signs with any desired click event. The client must modify the sign GUI class to send a custom sign update packet containing the command(s) one wishes to place into the sign. 1.8.1-pre1 fixed this glaring oversight in the packet processing code, only copying the text content of the JSON the client sent to the server to the sign.
When a client needs to update the contents of a sign to the server, it does so by serializing an array containing four text elements, one per line. The server will then deserialize this array, and copy it directly to the signs tile entity with zero checks on the input. Normally when a client sends this data, this array only contains literal text elements without any styling applied to them. However, modified clients can apply custom styling to this data, such as click events.
Click events have many variations, but the important one is the command click event, as when a sign is right clicked, it will iterate through its text elements and attempt to execute any command click events with either level 4 operator privileges or level 2 operator privileges, depending on the version.
| Command Sign Clients | |
|---|---|
| Mod | Versions |
| SignMod by Captain_S0L0 | 1.8 |
Any NBT on Any Item
The April Fools' snapshot 23w13a_or_b allowed for the creation of any item with any NBT. To create command signs with this method, the following steps must be performed.
Firstly, the NBT crafting rule must be approved. NBT crafting is necessary to create the data of the sign and the chest that will contain it. Next, create a NBT compound tag item with the necessary NBT tag. The following example NBT structure is for a container containing the desired sign item. The sign item, when placed from 14w25a (a 1.8 snapshot) to 1.8.5, will create a sign with the command /give @p bedrock 1 inside. If the sign is placed in versions newer than 1.8.5 without either having cheats enabled in the world or being an operator, the sign will place with no NBT data.
{BlockEntityTag:{Items:[{Slot:0b,Count:1b,id:"minecraft:sign",tag:{BlockEntityTag:{Text1:"{\"text\":\"Run Me!\",\"clickEvent\":{\"action\":\"run_command\",\"value\":\"give @p bedrock 1\"}}"}}}]}}
It is important that any container created that contains such a sign cannot be placed in 18w43a (a 1.14 snapshot) or later, as 18w43a added sign variants, renaming the 1.8 sign item from minecraft:sign to minecraft:oak_sign. The desired container must contain the minecraft:sign variant, as that is what is a valid sign item in the placement version range.
Next, an item replacement vote must be used to convert the NBT compound tag item into a container item that both existed in 1.8.5 and before and that exists in 23w13a_or_b (a chest, furnace, brewing stand, shulker box, dispenser, dropper, hopper, or trapped chest). After the NBT compound is converted to a container item, it must be downgraded to any version between 14w25a and 1.8.5, inclusive. Place the container down, grab the sign from inside, and place the sign. The sign will now contain the command that was set in the NBT tag, and can be run by right clicking the sign.
This is only an example of one tag and replacement vote that may be used. Many other variations exist, such as structuring the data for replacement with a spawn egg for higher valid item replacement vote chances, or giving multiple sign items in a single container.
Text Component Injection
By downgrading from the version range 25w02a (a 1.21.5 snapshot) and newer to the version range 24w09a (a 1.20.5 snapshot) to 1.21.4, the way that text components were saved to disk changed in such a way to allow creating nearly any text component, including click events on signs.
Using
Once the sign is created, it may simply be right-clicked by any player to execute the stored commands. The player does not need operator privileges, and cheats do not need to be enabled in the world.
If one is in versions 23w12a (a 1.20 snapshot) to 23w13a_or_b, the sign must be waxed to be able to execute its commands, and attempting to edit the sign will result in the commands being removed. In 23w14a (a 1.20 snapshot) and above, signs with commands become uneditable by default and do not need to be waxed to be able to execute their commands.
Uses
Items which were added after 1.8 can be obtained by creating a chest with a BlockEntityTag.Items tag, this will allow the chest to hold items, even items which have not been added to the game yet. The player must wait until these are added to place the chest, if the chest is placed prior to the item being added it could be deleted. This can also be used for any block by creating a block item with a custom BlockEntityTag, and an entity by creating spawn eggs with a custom EntityTag.
See also