+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: IRC Hijack? (/showthread.php?tid=5935381)
IRC Hijack? - R A B B - Jan 29, 2019
Is it possible to Hijack a IRC Botnet. I see a lot of these twitter kids posting there servers.. And i am wondering if it is possible to hijack there IRC servers from them to were its benefits me but not them.
I believe i read up on this awhile ago but maybe you guys will have more knowledge and be able to assist with how i can go about doing so.
RE: IRC Hijack? - I.M.P - Jan 29, 2019
getting the url/ip and brute forcing the login could do some damage if you get in! 🤝
RE: IRC Hijack? - R A B B - Jan 29, 2019
(Jan 29, 2019 01:19 PM)Atroxcity Wrote: getting the url/ip and brute forcing the login could do some damage if you get in! 🤝
Thats what I wanna hear! Thanks man I knew it was possible just not sure how. But now brute force there login haha
This password list gonna get put to use.
RE: IRC Hijack? - I.M.P - Jan 29, 2019
(Jan 29, 2019 01:32 PM)R A B B Wrote: Thats what I wanna hear! Thanks man I knew it was possible just not sure how. But now brute force there login haha
This password list gonna get put to use.
I was hoping what I said would help 🤫
just remember to change the login when you get in 🤫
RE: IRC Hijack? - __Digital__ - Jan 29, 2019
Well considering there are exploits for unrealircd and inspirircd i would suggest looking into that and yes you can try and bruteforce the logins however if they are configured after 5 incorrect logins you will be banned from the ircd server. keep in mind the login attempts can be changed in their config.
RE: IRC Hijack? - R A B B - Jan 29, 2019
(Jan 29, 2019 01:42 PM)__Digital__ Wrote: Well considering there are exploits for unrealircd and inspirircd i would suggest looking into that and yes you can try and bruteforce the logins however if they are configured after 5 incorrect logins you will be banned from the ircd server. keep in mind the login attempts can be changed in their config.
Exploiting using Metasploit correct? What I am finding online
RE: IRC Hijack? - SnuggleKittens - Jan 29, 2019
isn't the problem that the bots only listen to hostmask? I mean without knowing that and or having opper privs the bots wouldn't reply anyways.
but then any good sysadmin is going to stamp out any irc related connections and firewall / remove the infection so I feel that IRC bots are doomed anyways.
p.s. does it make more sense to scan for 6667 and try and exploit Unrealircd (most of these people are getting packs from youtube / pastebin (I think)
RE: IRC Hijack? - R A B B - Jan 29, 2019
(Jan 29, 2019 03:16 PM)SnuggleKittens Wrote: isn't the problem that the bots only listen to hostmask? I mean without knowing that and or having opper privs the bots wouldn't reply anyways.
but then any good sysadmin is going to stamp out any irc related connections and firewall / remove the infection so I feel that IRC bots are doomed anyways.
p.s. does it make more sense to scan for 6667 and try and exploit Unrealircd (most of these people are getting packs from youtube / pastebin (I think)
I wouldn't know to much about the hostmask information I only ever had spots in slots never had my own and never really asked questions on setup haha
You are correct tho with scanning 6667 and try to exploit it but some of them use other ports also
I'm not sure not accurate this website is but it gives information on IRC Bots IP & Port connection.
https://www.honerix.com/botnet/
If anybody has information on the accuracy of URL above would awesome.
RE: IRC Hijack? - Nyx - Jan 29, 2019
There used to be metasploit exploits for unrealircd back in the day but those are out of date.
RE: IRC Hijack? - R A B B - Jan 29, 2019
(Jan 29, 2019 07:39 PM)ᗯitch Wrote: There used to be metasploit exploits for unrealircd back in the day but those are out of date.
I seen on youtube after_Digital_ mentioned that and there are still people using them so i was thinking of hijacking some twitter kids server
I posted a link that showed IRC Channels that run Botnets but not sure how accurate the sites information is.
RE: IRC Hijack? - El Lobo - Jan 30, 2019
How about instead of doing that shit you simply get your hands on the bin, reverse it and extract the username and password from it.
RE: IRC Hijack? - wolfhackertr - Mar 8, 2023
getting the url/ip and brute forcing the login could do some damage if you get in
RE: IRC Hijack? - UDPz0r - Mar 8, 2023
(Jan 30, 2019 02:43 AM)El Lobo Wrote: How about instead of doing that shit you simply get your hands on the bin, reverse it and extract the username and password from it.
get the bot exe use hexeditor or ida pro, get the bot pass and update command