Pivity

PSA: Script Enforcer Backdoor

Last read Never
#1

For anyone who has old versions of addons installed with scriptenforcer, UPDATE THEM. Every script running it gets a backdoor ran on it. This script redirects players to Pheonix's personal GmodDayZ server after subscribing to his workshop collection. Unless they're an admin.

enter image description here Found by Trixter - just helping make people aware.

I just scanned some of our machines for customers using script enforcer & found way more than I'd expect. So you guys might want to check your server for addons like gmaps, civs, vliss, unisec, arivia - these seem to be the most common scripts using SE still. For Crident customers, I'm exploring the possibility of entirely dropping all traffic to or from their domain. If you'd like us to scan your server for any scripts that might be using Script Enforcer drop us a ticket. If you're using a dedicated server or VPS, this might be useful:

grep -R scriptenforcer.net /path/to/your/server/*

Having issues finding the addon causing this on your server? Our small script will help you: https://github.com/SnowboiTheGr8/backdoor-buster

Winner x 8Friendly x 2
#2

Thanks for the info! What a jerk :p

Friendly x 1
#3

Wow, what a cheap move.

Agree x 1
#4

Wow. Are...you...fucking....serious....

Agree x 5Funny x 1
#5
ByRichardat 10th of February 2018 18:18:06
Wow. Are...you...fucking....serious....

What's worse is that he isn't even using Crident to host his shitty DayZ server... :(

Funny x 2Agree x 1
#6

Wait, so Phoenix still has his DayZ server up and is actively still involved with gmod?

Agree x 2
#7

henlo

credit to https://www.gmodstore.com/users/view/76561198090893259-svn

Funny x 13Winner x 1
#8

Wow what a dick move! He should work for his players, just like all the other hard working server owners.

Funny x 1
#9
ByRichardat 10th of February 2018 18:20:52
Wait, so Phoenix still has his DayZ server up and is actively still involved with gmod?

It seems new. Maybe money got tight? :v It also seems that this is an attempt for a player injection, you can see by looking at GT it wasn't exactly a hot launch...

Agree x 1
#10

I wonder how Josh Breakell (@Phoenixf129) will find a job after that, he just didn't close his service without telling anyone and fucking us, he also re-enabled his website to fuck the people who were using old version to inject malicious code.

Edit :

Phoenixf129 was owning a DRM service, we -dev- were paying each months to use this service, and one day after some drama, he decided to shut-down his service (refunding some of us tho) but without notice, then, about one year later, his website is back online but people who own our addon but are still using old version will contact the website and run the malicious code.

#11

I'm going to be honest, I'm quite frankly not surprised - after all of the shit he has pulled over the years, I'm frankly stumped on how he got so far.

Agree x 3
#12
ByLapinat 10th of February 2018 18:25:30
he also re-enabled his website to fuck the people who were using old version to inject malicious code.

It's worth highlighting these were his paying customers.

Edited

By[SSC] anthonystegemollerat 10th of February 2018 18:21:31
He should work for his players, just like all the other hard working server owners.

tell me about it! (contact me for pricing phoenix)

Agree x 3
#13

It could of been a lot worse, to be honest

He had more than 100+ servers backdoored, with all of the power that he had he could of fuck all the servers instead A LOT WORSE of just "injecting players" to his community

At least he's not that kind of a dickhead and for people who had leaks he kept the backdoor, but people who bought it he guided them on how to remove it, doesn't fully make him a dickhead

Dumb x 2
#14
Bygalaxyo_at 10th of February 2018 18:43:40
It could of been a lot worse, to be honest

and he could be sued

Disagree x 4
#15
ByLapinat 10th of February 2018 18:47:26
and he could be sued

I don't think so? the company doesn't exist anymore?

Dumb x 3
#16
Bygalaxyo_at 10th of February 2018 18:43:40
It could of been a lot worse, to be honestHe had more than 100+ servers backdoored, with all of the power that he had he could of fuck all the servers insteadA LOT WORSEof just "injecting players" to his communityAt least he's not that kind of a dickhead and for people who had leaks he kept the backdoor, but people who bought it he guided them on how to remove it.

He could have been made it worse, but why would he? He is doing this for HIS gain, destroying servers doesn't profit him in any way, but redirecting players does (and causing other servers lose their population).

Winner x 1
#17
ByTrixter.xyzat 10th of February 2018 18:48:26
He could have been made it worse, but why would he? He is doing this for HIS gain, destroying servers doesn't profit him in any way, but redirecting players does (and causing other servers lose their population).

Trixter is right. He's also trying to avoid being detected; hence the random chance to get connected to his server, and the check to avoid reconnecting admins.

#18
Bydrizzy.vip - cridentat 10th of February 2018 18:49:28
Trixter is right. He's also trying to avoid being detected; hence the random chance to get connected to his server, and the check to avoid reconnecting admins.

He's not trying to avoid being detected cuz it prints "stop using se scripts its dead", he doesn't give a fuck what are you on about smh

Banned (Alt of banned user)

Dumb x 1
#19
Bygalaxyo_at 10th of February 2018 18:51:12
He's not trying to avoid being detected cuz it printes "stop using se scripts its dead"

he got a point here

Funny x 1
#20
Bygalaxyo_at 10th of February 2018 18:51:12
He's not trying to avoid being detected cuz it prints "stop using se scripts its dead", he doesn't give a fuck what are you on about smh

That doesn't justify anything, and I really doubt people notice that in their consoles. If he wouldn't want to be detected, he wouldn't have random chances to get redirected or checks if the player was redirected before.

Users viewing this thread
Nobody