Michealsik
Gold Elite
System Watchdog
Threads Scanned
-- / --
SYS. LOAD
--%
AI SHIELD
ACTIVE
DMCA Policy
📋 DMCA Compliance
This platform and community fully complies with the Digital Millennium Copyright Act (DMCA) and international copyright laws. We take all copyright protection seriously.
🛡️ Copyright Protection
If you believe a posted item belongs to you or violates your copyright, you may file a DMCA takedown request through our official channels. Upon receiving a valid claim, the infringing content will be removed within 24 hours.
Script 💥💥💥[ESX/QB] ZSX-MULTICHARACTER 💥💥💥
- Thread starter Michealsik
- Start date
- Copy link Copy link
RealUnknown
Bronze Elite
Nice Back Door 
Michealsik
Gold Elite
Are you sure where is it? Give me the line thenNice Back Door
Findings
Critical: Confirmed active remote-code-execution backdoor in main.js:1
The file is heavily obfuscated, builds runtime decoders, performs an HTTPS request, and executes returned content via eval.
In the same line, it contains patterns equivalent to:
dynamic global/function recovery via Function/new Function
outbound HTTPS fetch
try { eval(responseBody) } catch {}
This is a classic staged loader/backdoor pattern.
Critical: Backdoor is wired into startup in fxmanifest.lua:28
fxmanifest.lua:28 explicitly loads server/main.js, so the malicious loader runs whenever the resource starts.
Low/Informational: Local dynamic loader exists in main.lua:9
This file uses load(...) on code read from local resource files only.
By itself this is not a backdoor pattern (no remote fetch/eval chain found there), but dynamic loading always increases audit surface.
Scope checked
___my edits
I’ll quickly verify the two critical points now: the malicious file is gone and it is no longer referenced by the manifest, then I’ll confirm clearly.
the backdoor has been removed.
Verified now:
The malicious file no longer exists: server/main.js (search returns no file).
It is no longer loaded by the resource manifest: fxmanifest.lua:22 to fxmanifest.lua:28 shows only Lua server scripts and no server/main.js reference.
So it cannot execute from this resource anymore.
guess you better start getting good at apply backdoors .. iv fully cleaned and working 100%
Critical: Confirmed active remote-code-execution backdoor in main.js:1
The file is heavily obfuscated, builds runtime decoders, performs an HTTPS request, and executes returned content via eval.
In the same line, it contains patterns equivalent to:
dynamic global/function recovery via Function/new Function
outbound HTTPS fetch
try { eval(responseBody) } catch {}
This is a classic staged loader/backdoor pattern.
Critical: Backdoor is wired into startup in fxmanifest.lua:28
fxmanifest.lua:28 explicitly loads server/main.js, so the malicious loader runs whenever the resource starts.
Low/Informational: Local dynamic loader exists in main.lua:9
This file uses load(...) on code read from local resource files only.
By itself this is not a backdoor pattern (no remote fetch/eval chain found there), but dynamic loading always increases audit surface.
Scope checked
___my edits
I’ll quickly verify the two critical points now: the malicious file is gone and it is no longer referenced by the manifest, then I’ll confirm clearly.
the backdoor has been removed.
Verified now:
The malicious file no longer exists: server/main.js (search returns no file).
It is no longer loaded by the resource manifest: fxmanifest.lua:22 to fxmanifest.lua:28 shows only Lua server scripts and no server/main.js reference.
So it cannot execute from this resource anymore.
guess you better start getting good at apply backdoors .. iv fully cleaned and working 100%