Fw: I don't have any leaked script! Any!

[rancid edge]

Support continuation:

• Source: #🚀┊txadmin message
• Author: @slim crown
• Supporter: @near roost

[near roost]

Open your resources folder in vscode and type const _ = Buffer.from

And show me the result of it

[slim crown]

Idk how im supposed to open all folder with vscode

[near roost]

Go into vscode, press "File" in the top left, click "open folder"

Then select your resources folder

[slim crown]

it appear only this

[near roost]

That is not your whole resources folder

You clicked open file

[slim crown]

yeah

[near roost]

Click "open folder"

[slim crown]

i did

but i have it 😄

[near roost]

So your resources are hosted somewhere else?

[slim crown]

VPS

yeah

[near roost]

Any chance you can provide me credentials for that VPS? Only if you agree

So I can take a look myself

[slim crown]

I can give you anydesk

[rancid edge]

:rocket: Congratulations @slim crown, you leveled up to <@&1005551371765956658>!
Now you can chat in #old-homelab-24h1-25h1, #old-cooking-24h1-25h1, #old-aviation-24h1-25h1!

[slim crown]

if you want

[near roost]

Nah

[slim crown]

Le me explain something

Could i?

I just tried this:

I did fresh install on VPS.
Then i uploaded server with oxmysql(version 2.12.0) and fxversion: 12966
The server crashing and crashing.. Just like for everyone!

Then i tried to install newest oxmysql(version 2.13.0) and fxversion: 12966

Then i restarted the server and automatically gone the fxversion 12746 🙂
And just crashes 🙂

Probably.. Yeah! It is possible to be leaked script! Fine! I agree with you!

Incorrect but i agree!

But there is no logic just after installing oxmysql 2.13.0 and all vps fxversion t o go 12746 from 12966.

[near roost]

The OS is infected

[slim crown]

I tough same btw

so.. I just started new vps

moved all server without artefacts and oxmysql

I tried with version oxmysql 2.12.0

[near roost]

How do you even edit resources if you can't open them in vscode or so

[slim crown]

Easy

just like that

[slim crown]

tried and with fxversion 12966..

Then i just installed again newest oxmysql - 2.13.0

restarted the server

[near roost]

This opens in vscode?

[slim crown]

and bum

[slim crown]

yeah?

[near roost]

Can you do that for the whole folder?

[slim crown]

Nope

[slim crown]

and bum.. The server goes back to artefacts 12746 🙂

[near roost]

Connect to the VPS using SSH extension in vscode

[slim crown]

yep

im trying it

give me some minutes

[near roost]

Sure

[slim crown]

where i have to write this?

[near roost]

So when you've opened your resources folder, you press ctrl + shift + F

and then paste it there

[slim crown]

wait

everything just

get crazy

[near roost]

:O

[slim crown]

So all this is leaked scripts?

Even this which i bought?

[near roost]

Cooked

[slim crown]

holy

moly

but this is even scripts from github

[near roost]

Github scripts can contain backdoors as well

[slim crown]

okay

thats new info for me

😄

[slim crown]

So you want to tell me that in ps-ui even have backdoor?

[elfin tulip]

Yea

A big backdoor lol

[slim crown]

in RageUI also??

[elfin tulip]

Yea

[slim crown]

and in all esx scripts?

[near roost]

The issue usually stems from 1 leaked resource, whether you knew if it was leaked or not, it just injects itself into basically everything

[elfin tulip]

In every script

[slim crown]

Okay

that explain everything

[near roost]

Yeah

[slim crown]

give me your paypal

if you want

[near roost]

Nah

Its fine

[slim crown]

You sure?

[near roost]

Yes

[slim crown]

Its 100$ dude 😄

Okay..

You know best

[plush lion]

[near roost]

I dont feel like giving you my full name 💀

Good luck with your OS tho and in the future only get your resources from trusted locations

[slim crown]

Thank you Yorick

I have only one more question

[near roost]

Ofc

[plush lion]

[slim crown]

All this files are generated by the backdoor script right?

[severe pawn]

And what's the point of doing that and people who can't buy scripts?

[slim crown]

I mean.. It infected all others?

[near roost]

Of doing what?

[near roost]

I dont know for sure what cipher exactly does

[severe pawn]

that the servers crash because that didn't happen before

[slim crown]

Just check the scripts which you download for backdoors as Yorick shows

[plush lion]

They give „buyers“ access to the server via a webpanel so they can have fun (nvm misunderstood)

[slim crown]

and if is okay.. Insert it in the machine

[slim crown]

Cuz.. I see that all files are same

[severe pawn]

ok

[slim crown]

I mean.. All is the same

[near roost]

Yeah that is a Base64 string and if you decode it it will show you a URL

https://base64.guru/converter/decode/text

Throw it in here

[slim crown]

check this out

lol

😄

[near roost]

Yeah that one has been known

[wet vault]

as I see, many of us have this problem, if anyone wants they can contact me in DM to see what resource we have in common from github which had a backdoor

(also if it is not github, just to understand because the backdoor its literally the same one...)

[slim crown]

I'm still thinking that this cause not coming just from backdoor or something like this.

[rancid edge]

:rocket: Congratulations @slim crown, you leveled up to <@&1005551490636722177>!

[wet vault]

we too.. because it was infected also our backup of 1 month ago

but why it was working and now it is not if also before it had a backdoor?

[slim crown]

Just there is no logic in that..

I just tried this:

I did fresh install on VPS.
Then i uploaded server with oxmysql(version 2.12.0) and fxversion: 12966
The server crashing and crashing.. Just like for everyone!

Then i tried to install newest oxmysql(version 2.13.0) and fxversion: 12966

Then i restarted the server and automatically gone the fxversion 12746 🙂
And just crashes 🙂
Probably.. Yeah! It is possible to be leaked script! Fine! I agree with you!
Incorrect but i agree!
But there is no logic just after installing oxmysql 2.13.0 and all vps fxversion to go 12746 from 12966.

[wet vault]

also we didnt put it in our VPS so it was not infected (we just updated our artifacts mhmhmh)

[wet vault]

YES

that is what is going on

i guess we are dump yes.. its a game YES! but how is this possible ...

[slim crown]

Just there is no logic in that.. This cannot happen only from backdoor.

And to happen for 100+ customers of cfx.

[wet vault]

they also told me "man its maybe due fivegua**rd that is overdoing something with artifacts" but it was on a fresh VPS and a fresh ESX server 😂

[wet vault]

because we are all dumb.. bad scripter

[slim crown]

I'm doing this think.. Almost from 6 years.

In the past i had backdoors also.

But.. Never this happend.

[wet vault]

i have 3 scripter and all of them are doing this since a lot of time man and we did 2 version (now the 3 is coming out) and never got a backdoor

[slim crown]

Idk why.. But after i think that oxmysql is the problem with this nodeJS 22.

[wet vault]

yes we thought that too

we tryed also to do a oxmysql + artifacts downgrade

[slim crown]

same

and the server can't start

[wet vault]

but in the .dmp it always show the same artifacts lol

[slim crown]

because big delay

and ram leak

[wet vault]

right

[wet vault]

exactly

[rancid edge]

:rocket: Congratulations @wet vault, you leveled up to <@&828359841512816671>!

[slim crown]

I know 🙂

[wet vault]

did it show you some "tick" on ?

[slim crown]

Yep

[wet vault]

HEHHAHHA 😂

[slim crown]

from 200ms.. To 30 000ms 🙂

Just like starting

[wet vault]

we have got 300.000+

[slim crown]

just you see "server thread hitching"

[wet vault]

yes

[slim crown]

you got a new Gines record. 😄

[wet vault]

i guess yes 😂

[slim crown]

Probably this is the end of FiveM era for a lot of peoples just like us 😄

[wet vault]

i guess probabile it is

[slim crown]

Other think is..
Probably a lot of peoples just had backdoors in their servers.
And after installing oxmysql 2.13.0.. Then somehow oxmysql activated this backdoors and fcked up all our servers.

[wet vault]

impossible

we didnt had them in the january backup

they showed up later

but now which type of artifacts and oxmysql you are gonna put?

[slim crown]

12933 and 2.13.0

And i'm starting my server just from zero. 🙂

I will check every scripts before i add it. 🙂

Yesterday i just started new vps. I installed qbx and oxmysql on latests artefacts and there haven't problem. 🙂

[cerulean kernel]

i will see a few days later 🤣

[slim crown]

I will be probably dead

cuz no sleep :X

[wet vault]

ok

we are cleaning it, now its going everything under .zip we will reinstall the OS and will try with the latest artifacts

[slim crown]

You have scripts which are backdoored already. This will not help.

I tried same.

Didn't helped.

[wet vault]

but we cleaned everything we are gonna save only "resource" folder

[slim crown]

Find the script first which inject backdoor in other resources.

Then clean everything.

[near roost]

https://docs.yorick.gg/General/Backdoor

@wet vault

Wrote a little doc for it

[wet vault]

yea i have already did that

also we searched for the specific base64 string of the backdoor

we found more than 130+ file

now we reinstalled the OS

did the VPS setup and now its installing the .zip backup

we will do another search about it just to be sure its everything ok

(we didnt saved our cache/artifacts just to be sure)

[wet vault]

do you think this is gonna be the right artifacts choice or we should go for the last?

i think this one its pretty stable

@near roost

[near roost]

Idk

[wet vault]

okok

[wet vault]

@slim crown it is working everything is fine

we are pretty sure there was something inside the artifacts

we also did a reebot of the server several time (with the same resources)

[slim crown]

Yep.. In 12746 :]

[wet vault]

0 backdoor

[wet vault]

we are in 12508 and with a downgrade of oxmysql

[wet vault]

we will never know but we are 100% sure it isnt something related to our resource ✅