Cac Decryption

[pasquam076]

When decrpyting the first encrypted part in !!!cac.lua it outputs this

local fragmentBlacklist =
{
	"aimbot",
	"*******",
	"esp",
	"gdaap",
	"hack",
	"wallhack"
}

timer.Simple (30,
	function ()
		pcall (
			function ()
				for commandName, _ in pairs (concommand.GetTable ()) do
					for _, fragment in ipairs (fragmentBlacklist) do
						if string.find (commandName, fragment) then
							net.Start ("CAC_BanMe")
								net.WriteString ("concommand")
								net.WriteString (commandName)
							net.SendToServer ()
						end
					end
				end
				
				for eventName, eventTable in pairs (hook.GetTable ()) do
					for hookName, f in pairs (eventTable) do
						for _, fragment in ipairs (fragmentBlacklist) do
							if string.find (hookName, fragment) then
								net.Start ("CAC_BanMe")
									net.WriteString ("hook")
									net.WriteString (eventName)
									net.WriteString (hookName)
								net.SendToServer ()
							end
						end
					end
				end
			end
		)
	end
)
​

but the second block of encrypted code in the timer always gets decrypted to a randomized string of garbage like this

Zl`?.H???K??N??Ε ?]?HA?
?v??R??TSm?+??ebNæS??pKq]???)?N?BA?d4?햶C?M?/u
?0??_i$????,??g??,???
?N҄:?kT??~x?e6???Ih?????bg??a??yC??ۆ???V????e?`??L`?=k????$p???(R???A?a??9$D)???խHk82??G?c?6?]???)Y?1??{??UQ?$}??BK??p?'?T?5;?[?]??7???|?36ommS????/W?
P?Ɨ6??^?Ѐ???`?Zm4?c\K?e???t?
?0??̘/????'??????&t???(?????E???A??UPuWgB????ҭ??TR???Dݿ-uy?A???-?:F
o7?|+???hSU?.??Zw?Oo??Dەto;?
?)p ѻa@zi?O?xa1?[???

anybody have any clue why it does this or has anyone successful decrypted the second part yet?

[rockran]

What're you decrypting it with?
I don't see the second block on my side.

[Cyaegha]

This is junk code loaded by !CAC, it's completely useless. The main part of !CAC is vehicle.lua and the payloads which are impossible to get via a file stealer without detouring CompileString before the files load.

[pasquam076]

What're you decrypting it with?
I don't see the second block on my side.

Currently using this to decrypt it

function Decode (array, key)
	local keyArray = { string.byte (key, 1, #key) }
	
	local out = {}
	for i = 1, #array do
		out [i] = bit.bxor (array [i], keyArray [(i - 1) % #keyArray + 1])
	end
	
	return out
end

function BytesToStr (array)
	local out = {}
	
	for i = 1, #array do
		out [#out + 1] = string.char (array [i])
	end
	
	return table.concat (out)
end

function RunDecrypt (codeArray, key)
	local code = BytesToStr (Decode (codeArray, key))
	print(code)
end

RunDecrypt (
	{
		0x2f, 0x2e, 0x20, 0x22, 0x2d, 0x63, 0x25, 0x33, 0x22, 0x24, 0x2c, 0x26, 0x2d, 0x35, 0x01, 0x2f,
		0x20, 0x20, 0x28, 0x2d, 0x2a, 0x30, 0x35, 0x63, 0x7e, 0x4b, 0x38, 0x49, 0x48, 0x61, 0x22, 0x28,
		0x2e, 0x21, 0x2e, 0x37, 0x61, 0x6d, 0x49, 0x4a, 0x63, 0x22, 0x2a, 0x2c, 0x34, 0x22, 0x33, 0x26,
		0x61, 0x6d, 0x49, 0x4a, 0x63, 0x26, 0x30, 0x31, 0x61, 0x6f, 0x4b, 0x4a, 0x61, 0x26, 0x27, 0x22,
		0x20, 0x33, 0x61, 0x6d, 0x49, 0x4a, 0x63, 0x2b, 0x22, 0x22, 0x28, 0x61, 0x6d, 0x49, 0x4a, 0x63,
		0x34, 0x22, 0x2d, 0x2f, 0x2b, 0x20, 0x20, 0x28, 0x63, 0x49, 0x3e, 0x4b, 0x49, 0x37, 0x28, 0x2e,
		0x26, 0x33, 0x6d, 0x10, 0x28, 0x2e, 0x33, 0x2d, 0x26, 0x63, 0x69, 0x70, 0x73, 0x6d, 0x49, 0x4a,
		0x27, 0x36, 0x2d, 0x22, 0x37, 0x2a, 0x2e, 0x2d, 0x63, 0x69, 0x6a, 0x49, 0x48, 0x4a, 0x33, 0x22,
		0x22, 0x2f, 0x2d, 0x63, 0x6b, 0x4b, 0x4a, 0x4a, 0x48, 0x25, 0x36, 0x2f, 0x20, 0x37, 0x28, 0x2c,
		0x2d, 0x61, 0x6b, 0x6a, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x25, 0x2e, 0x31, 0x63, 0x22, 0x2c, 0x2e,
		0x2c, 0x22, 0x2d, 0x25, 0x0d, 0x22, 0x2c, 0x26, 0x6f, 0x61, 0x1c, 0x63, 0x28, 0x2d, 0x63, 0x31,
		0x22, 0x2a, 0x33, 0x30, 0x63, 0x69, 0x20, 0x2c, 0x2f, 0x20, 0x2c, 0x2c, 0x2e, 0x22, 0x2f, 0x27,
		0x6d, 0x06, 0x26, 0x37, 0x15, 0x22, 0x21, 0x2d, 0x26, 0x63, 0x69, 0x6a, 0x6a, 0x61, 0x27, 0x2c,
		0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x27, 0x2c, 0x31, 0x61, 0x1c, 0x6f, 0x61, 0x25, 0x31, 0x20,
		0x24, 0x2e, 0x24, 0x2d, 0x37, 0x61, 0x2a, 0x2d, 0x61, 0x2a, 0x33, 0x20, 0x2a, 0x31, 0x32, 0x63,
		0x6b, 0x27, 0x31, 0x22, 0x26, 0x2e, 0x26, 0x2f, 0x37, 0x01, 0x2d, 0x22, 0x20, 0x2a, 0x2f, 0x2a,
		0x32, 0x37, 0x6a, 0x61, 0x27, 0x2c, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x2a, 0x25, 0x61,
		0x30, 0x37, 0x33, 0x2a, 0x2d, 0x26, 0x6d, 0x25, 0x28, 0x2d, 0x27, 0x61, 0x6b, 0x20, 0x2e, 0x2e,
		0x2e, 0x20, 0x2d, 0x27, 0x0f, 0x22, 0x2e, 0x24, 0x6f, 0x63, 0x27, 0x31, 0x22, 0x26, 0x2e, 0x26,
		0x2f, 0x37, 0x6a, 0x61, 0x37, 0x2b, 0x24, 0x2d, 0x49, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48,
		0x2d, 0x26, 0x35, 0x6d, 0x10, 0x35, 0x22, 0x31, 0x35, 0x63, 0x6b, 0x63, 0x00, 0x02, 0x02, 0x1c,
		0x01, 0x20, 0x2d, 0x0e, 0x24, 0x61, 0x6a, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a,
		0x2f, 0x26, 0x37, 0x6f, 0x14, 0x31, 0x28, 0x37, 0x26, 0x12, 0x37, 0x31, 0x28, 0x2d, 0x24, 0x61,
		0x6b, 0x61, 0x22, 0x2c, 0x2d, 0x22, 0x2c, 0x2e, 0x2c, 0x22, 0x2d, 0x25, 0x61, 0x6a, 0x4b, 0x4a,
		0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x2f, 0x26, 0x37, 0x6f, 0x14, 0x31, 0x28, 0x37, 0x26,
		0x12, 0x37, 0x31, 0x28, 0x2d, 0x24, 0x61, 0x6b, 0x20, 0x2e, 0x2e, 0x2e, 0x20, 0x2d, 0x27, 0x0f,
		0x22, 0x2e, 0x24, 0x6a, 0x49, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x2d, 0x26, 0x35, 0x6d,
		0x10, 0x24, 0x2d, 0x27, 0x15, 0x2c, 0x10, 0x24, 0x31, 0x35, 0x24, 0x31, 0x63, 0x69, 0x6a, 0x49,
		0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x24, 0x2d, 0x27, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x24,
		0x2d, 0x27, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x26, 0x2f, 0x27, 0x49, 0x48, 0x4a, 0x4a, 0x48, 0x49,
		0x4a, 0x48, 0x4a, 0x4a, 0x27, 0x2c, 0x31, 0x61, 0x26, 0x35, 0x24, 0x2d, 0x37, 0x0f, 0x22, 0x2e,
		0x24, 0x6f, 0x63, 0x24, 0x35, 0x26, 0x2f, 0x37, 0x17, 0x20, 0x21, 0x2f, 0x24, 0x63, 0x2a, 0x2f,
		0x63, 0x33, 0x20, 0x2a, 0x31, 0x32, 0x63, 0x6b, 0x29, 0x2c, 0x2c, 0x2a, 0x6d, 0x04, 0x24, 0x37,
		0x17, 0x20, 0x21, 0x2f, 0x24, 0x63, 0x6b, 0x68, 0x6a, 0x63, 0x25, 0x2c, 0x49, 0x48, 0x4a, 0x4a,
		0x48, 0x4a, 0x25, 0x2e, 0x31, 0x63, 0x29, 0x2c, 0x2c, 0x2a, 0x0d, 0x22, 0x2c, 0x26, 0x6f, 0x61,
		0x25, 0x63, 0x28, 0x2d, 0x63, 0x31, 0x22, 0x2a, 0x33, 0x30, 0x63, 0x69, 0x26, 0x35, 0x24, 0x2d,
		0x37, 0x15, 0x22, 0x21, 0x2d, 0x26, 0x6a, 0x61, 0x27, 0x2c, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a,
		0x48, 0x25, 0x2c, 0x33, 0x63, 0x1c, 0x6d, 0x63, 0x25, 0x33, 0x22, 0x24, 0x2c, 0x26, 0x2d, 0x35,
		0x63, 0x2a, 0x2f, 0x63, 0x2a, 0x31, 0x22, 0x2a, 0x33, 0x30, 0x63, 0x69, 0x25, 0x31, 0x20, 0x24,
		0x2e, 0x24, 0x2d, 0x37, 0x03, 0x2f, 0x22, 0x22, 0x28, 0x2f, 0x28, 0x30, 0x37, 0x68, 0x63, 0x27,
		0x2e, 0x49, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x28, 0x25, 0x63, 0x32, 0x37, 0x31, 0x28,
		0x2d, 0x24, 0x6f, 0x25, 0x2a, 0x2f, 0x27, 0x63, 0x69, 0x2b, 0x2c, 0x2e, 0x28, 0x0d, 0x20, 0x2e,
		0x26, 0x6d, 0x63, 0x25, 0x33, 0x22, 0x24, 0x2c, 0x26, 0x2d, 0x35, 0x6a, 0x63, 0x35, 0x2b, 0x26,
		0x2f, 0x49, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x2d, 0x26, 0x35, 0x6d, 0x10, 0x35,
		0x22, 0x31, 0x35, 0x63, 0x6b, 0x63, 0x00, 0x02, 0x02, 0x1c, 0x01, 0x20, 0x2d, 0x0e, 0x24, 0x61,
		0x6a, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x2d, 0x26, 0x35, 0x6d, 0x14,
		0x33, 0x2a, 0x37, 0x24, 0x10, 0x37, 0x33, 0x2a, 0x2d, 0x26, 0x63, 0x6b, 0x63, 0x2b, 0x2c, 0x2e,
		0x28, 0x61, 0x68, 0x49, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x2d, 0x24, 0x37,
		0x6d, 0x16, 0x31, 0x2a, 0x35, 0x26, 0x10, 0x35, 0x31, 0x2a, 0x2f, 0x24, 0x63, 0x69, 0x26, 0x35,
		0x24, 0x2d, 0x37, 0x0f, 0x22, 0x2e, 0x24, 0x6a, 0x49, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48,
		0x4a, 0x4a, 0x2f, 0x26, 0x37, 0x6f, 0x14, 0x31, 0x28, 0x37, 0x26, 0x12, 0x37, 0x31, 0x28, 0x2d,
		0x24, 0x61, 0x6b, 0x2b, 0x2e, 0x2c, 0x28, 0x0f, 0x22, 0x2e, 0x24, 0x6a, 0x49, 0x48, 0x4a, 0x4a,
		0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x2d, 0x24, 0x37, 0x6d, 0x12, 0x26, 0x2d, 0x25, 0x17, 0x2c, 0x12,
		0x26, 0x31, 0x37, 0x26, 0x31, 0x61, 0x6b, 0x6a, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x48, 0x4a,
		0x26, 0x2f, 0x27, 0x49, 0x48, 0x4a, 0x4a, 0x48, 0x4a, 0x4a, 0x24, 0x2d, 0x27, 0x4b, 0x4a, 0x4a,
		0x48, 0x4a, 0x4a, 0x24, 0x2d, 0x27, 0x4b, 0x4a, 0x4a, 0x48, 0x4a, 0x26, 0x2f, 0x27, 0x49, 0x48,
		0x4a, 0x4a, 0x24, 0x2d, 0x27, 0x4b, 0x4a, 0x4a, 0x68, 0x49, 0x4a, 0x24, 0x2d, 0x27, 0x4b, 0x6a,
		0x49, 0xa3, 0xc3, 0xc8,
	},
	"CAC"
)

[Cyaegha]

Why are you even trying? I already told you that there's no point.