sv_luctus_bdscanner.lua

--Luctus Backdoor Scanner
--Made by OverlordAkise

--This is only able to find conspicuous code
--or code that could be used for backdoors / exploits
--This is not a guarantee to make your server secure or find any problem that may occur

--Usage: add this to your server and run the console command 'luctus_scan'
--This command can be run on client and server

concommand.Add("luctus_scan", function(ply)
    if IsValid(ply) and not ply:IsSuperAdmin() then return end
    LuctusScannerStart(ply)
end)

local function atf(t) --appendToFile
    if string.StartsWith(t,"^ ") then
        file.Append("luctus_scan.txt","  "..t)
    else
        file.Append("luctus_scan.txt","\n")
        file.Append("luctus_scan.txt",t)
    end
end

function LuctusScannerGetPrintFunc(ply)
    file.Write("luctus_scan.txt","")
    if ply and IsValid(ply) then
        return function(text) atf(text) ply:PrintMessage(HUD_PRINTCONSOLE,text) end
    else
        return function(text) atf(text) print(text) end
    end
end

LUCTUS_SCANNER_CHECKS = {
    {"STEAM_[0-9]+:[0-9]+:[0-9]+",  "SteamID        "},
    {"[0-9]{17}",                   "SteamID64 (?)  "},
    {"http.Post",                   "Using HTTP     "},
    {"http.Fetch",                  "Using HTTP     "},
    {"HTTP",                        "Using HTTP     "},
    {"CompileString",               "Dynamic code   "},
    {"RunString",                   "Dynamic code   "},
    {"removeip",                    "Unban IP       "},
    {"removeid",                    "Unban SteamID  "},
    {"banip",                       "Ban IP         "},
    {"writeid",                     "Ban SteamID    "},
    {"SetUserGroup",                "SetUserGroup   "},
    {"file.Read",                   "Reading files  "},
    {"file.Delete",                 "Deleting files "},
    {"0[xX][0-9a-fA-F]+",           "Obfuscation(?) "},
    {"\\[0-9]+",                    "Obfuscation(?) "},
    {"\\[xX][0-9a-fA-F][0-9a-fA-F]","Obfuscation(?) "},
    {"getfenv",                     "Using getfenv  "},
    {"_G[\r\n\t ]*%[",              "Using _G       "},
    {"_G[\r\n\t ]*%.",              "Using _G       "},
    {"=[\r\n\t ]*_G",               "Using _G       "},
    {"=.*,[\r\n\t ]*_G",            "Using _G       "},
    {"[^a-zA-Z1-9]_G",              "Using _G       "},
    {"^_G",                         "Using _G       "},
}

function LuctusScannerStart(ply)
    local sprint = LuctusScannerGetPrintFunc(ply)
    sprint("[luctus_bdscanner] Starting scan, this may freeze the server for some seconds")
    local starttime = SysTime()
    LuctusScannerRecursive("lua/","WORKSHOP",sprint)
    LuctusScannerRecursive("addons/","GAME",sprint)
    LuctusScannerRecursive("lua/autorun/","GAME",sprint)
    LuctusScannerNetwork(sprint)
    sprint("[luctus_bdscanner] Scan finished, time taken: "..string.ToMinutesSecondsMilliseconds(SysTime()-starttime))
end

function LuctusScannerRecursive(curfolder,base,sprint)
    local files,folders = file.Find(curfolder.."*",base)
    if files then
        for k,v in ipairs(files) do
            if not string.find(v,".lua") then continue end
            local curobj = curfolder..v
            local fileText = file.Read(curobj,base)
            LuctusScannerScanFile(fileText,curobj,base,sprint)
        end
    end
    if folders then
        for k,v in ipairs(folders) do
            local curobj = curfolder..v
            if curobj == "addons/luctus_scanner" then continue end --?
            LuctusScannerRecursive(curobj.."/",base,sprint)
        end
    end
end

function LuctusScannerScanFile(text,filename,base,sprint)
    if not text then return end
    text = string.gsub(text, "\r", "")
    local lines = string.Split(text,"\n")
    --LuctusScannerScanLine(text,"MULTILINE",filename,base,sprint)
    for linenumber,line in ipairs(lines) do
        LuctusScannerScanLine(line,linenumber,filename,base,sprint)
    end
end

function LuctusScannerScanLine(text,linenumber,filename,base,sprint)
    for k,scan in ipairs(LUCTUS_SCANNER_CHECKS) do
        if string.find(text,scan[1]) then
            sprint(scan[2].."\t"..string.sub(base,1,4).."\t"..filename..":"..linenumber)
            sprint("^ "..string.Left(text, 247))--256limit
        end
    end
end

function LuctusScannerNetwork(sprint)
    for k,v in pairs(net.Receivers) do
        local src = debug.getinfo(v).short_src
        if not string.StartsWith(src,"addon") and not string.StartsWith(src,"lua") and not string.StartsWith(src,"gamemode") then
            sprint("Suspicious netmsg".."\t"..k.."\t"..src)
        end
    end
end

print("[luctus_bdscanner] sv loaded")