|
by The Cyber God
http://blacksun.box.sk/
Version 1.1, 24/9/99
Updated , 7/20/01 by Mikkkeee
Converted to HTML by Mikkkeee
[Editor Notes]
Please send comments, questions and feedback to
talrun@actcom.co.il You can always visit us at
http://blacksun.box.sk/
[Disclaimer]
We will not help you actualize the things that you will
learn here. The information here is for educational
purposes only (for learning how the attacks are done and
how to prevent them).
We are not responsible in any way for any damage that might
happen to you. This includes software damages and law
issues.
[Table
Of Contents]
- What is IRC?
- An introduction to the way that IRC works
- Some notes on different IRC networks and their
daemon software
- Why IRC wars started?
- What do the others know about me?
- How to spoof / hide your identity on the IRC
- Bans and how to bypass them
- I don't like your nickname... / Getting a user
off the IRC
- Can I get caught and will I?
- What are netsplits and how can they help me?
- Channel Takeovers
- How To Completly Ruin A Channel
- Some expansion about RAW sessions
- Faking /ctcp replies
- How to spoof via https proxys
- War Scripts
- Editorial - IRC wars, another perspective
- Some interesting articles by Packet
- Bibliography
[What
is IRC?]
IRC stands for "Internet Relay Chat". Jarkko Oikarinen
originally wrote it in 1988. Since starting in Finland, it
has been used in over 60 countries around the world. It was
designed as a replacement for the "talk" program but has
become much, much more than that. IRC is a multi-user chat
system, where people meet on "channels" (rooms, virtual
places, usually with a certain topic of conversation) to
talk in-groups, or privately. There is no restriction to the
number of people that can participate in a given discussion
or the number of channels that can be formed on IRC.
[An
introduction to the way IRC works]
All the communications in the world of IRC are done through
the server. (This does not includes the DCC (Direct Client
Communication) protocol)
When you connect to a server, you send it 2 commands: NICK
& USER. These commands are used to identify you on the IRC.
Here is the format of the commands:
NICK nickname - Sets your nickname
USER username host server :real name - Set your userid and
real name. Host is your host and server is the server you
are connecting to.
For example to open a raw IRC session you can telnet to an
IRC server on port 6667 or 7000 (the standard ports). Here
is an example for telneting my localhost (note: the lines
beginning with * have been written by me. The rest are the
output I got from the server):
* nick
^TCG^
NOTICE ^TCG^ :*** If you are having problems connecting due
to ping timeouts, please type /notice E3AA3478 nospoof now.
PING
:E3AA3478
* user
^TCG^ 127.0.0.1 localhost :The Cyber God
:localhost 001 ^TCG^ :Welcome to the DALnet IRC Network
^TCG^!~tcg@thegod.actcom.co.il
:localhost 002 ^TCG^ :Your host is
localhost[thegod.actcom.co.il], running version
dal4.6.7.DreamForge.win32
:localhost 003 ^TCG^ :This server was created Fri Jul 24
07:48:52 1998
:localhost 004 ^TCG^ localhost dal4.6.7.DreamForge.win32
oiwsghOkcfrRaAb biklmnopstvR
:localhost 005 ^TCG^ NOQUIT TOKEN WATCH=128 SAFELIST :are
available on this server
:localhost 251 ^TCG^ :There are 0 users and 0 invisible on
1 servers
:localhost 253 ^TCG^ 4 :unknown connection(s)
:localhost 255 ^TCG^ :I have 0 clients and 0 servers
:localhost 265 ^TCG^ :Current local users: 0 Max: 0
:localhost 266 ^TCG^ :Current global users: 0 Max: 0
:localhost 422 ^TCG^ :MOTD File is missing
:^TCG^ MODE ^TCG^ :+iw
...
ok
As you can see, the second parameter of the USER commands
includes my IP. You might be thinking right now that you
could enter any IP you want and fake your IP. Well you are
wrong. On really older versions of the IRC daemon (Those
that were used in Efnet), you WAS able to spoof your IP. But
today there are 2 types of antispoof-patches: The one that
doesn't care about the IP you entered and connects you using
your real IP (which it gets from the socket) and the other
one just doesn't allow you to connect to the server until
you give your real IP address.
The first method of Anti-Spoofing is most used most in the
server version of DALnet and the second is used most by
EliteIRCD (which is based on DALnet) and the servers that
are based on it.
Now, if it all goes ok then you just opened a raw session
to IRC!
All the data transferred to the user (Private
Messages/Notices and Channel Events) is transferred from the
server. If the user that sent you a message is on a
DIFFERENT server than you (but NOT a different network) the
message "moves" from the servers until it reaches your
server and you. To send someone a message in our raw IRC
session type: 'PRIVMSG nick :message' (without the quotes)
where nick is the target nickname and message is the message
(You must include a : before the message).
When a message moves from server to server it looks like
this:
:SenderNick PRIVMSG nick :message
All the IRC commands move from server to server like this.
For example when someone uses the NICK command ALL the
servers get a notice about it.
[Some
notes on different IRC networks and their daemon software]
Different IRC networks have different IRC daemons. It is
important to know the futures / limits of the server your
network uses. For example, OLD Efnet servers don't know the
+b channel mode (ban someone). When trying to start IRC wars
you need to know what are the limitations of the server. If
it got services, if so does they have a bug that can crash
them? Can you obtain Channel Operator in a net-split (we'll
get to that)? And so on... During the rest of this tutorial
we will discuss different daemon software and bugs, as well
as different ways to "get in".
[Why
IRC wars started?]
Generally, IRC wars started on the IRC network Efnet. In
this IRC network you can't register your nickname so ANYONE
can use it. If for example someone logged to this IRC
network (By the way, did you know that it is the first IRC
network ever (!)) and he saw that his nick is taken. He
probably said something like "How Rude?!" or "Mother-F*cker"
or anything else. Then he started thinking about ways to get
this user off the server. Users started to try many
different things on each other and that's pretty much how
IRC wars started. Today, users might start IRC wars "just
for fun", or for taking over channels they don't like or
kicking off users they don't like.
[What
do the others know about me?]
OK people! This is actually the first important thing about
the IRC wars. Before starting out you need to know what
others can find out about you and what can you find out
about them.
If you are not connected through a BNC, firewall or a shell
(we'll get to this neat stuff later), what I mean, that if
you are connected directly to the IRC, using a dial-up for
example users can first of all knows your IP. Newbies might
say right now, ok... well.... So he knows my IP... who gives
a shit anyway?
Well if you said this you are wrong. Let's take a look on
my host (resolved IP) for example:
P34.haifa2.actcom.co.il
| | | |_ You can see that my ISP is in
Israel, and so am I (unless
| | | I'm dialing to foreign ISPs just to
cover my identity, which
| | | is a thing people don't do because
of... financial issues).
| | |_ You can see that my ISP (Internet Service
Provider) is Actcom
| |_ You can see that I am from Haifa ).
|_My modem number at the ISP's office.
See how many things the host gave you?
1) My ISP
2) My city
3) My country
Now You can also know that if my ISP address is
actcom.co.il you can send complains about me to
abuse@actcom.co.il for example, give them my IP and tell
them what I did to you and they will do the rest.
That is what users know about you. Some times you will only
see numbers like 19.114.47.1 and not the host. That is
because the server failed to resolve your hostname. To
resolve it you can download a program called 'nslookup' from
somewhere (note: nslookup comes with all Unix systems), give
it the IP and it will try to resolve it. Also see the entry
'DNS Servers' in the Newbies Corner.
Now, for those who don't know you can get the IP/host by
"whoising" the user.
To do a whois on a user in mIrc, BitchX, IRCii, Pirch and
some other known IRC clients all you need to do is type
/whois nickname
To whois someone in our raw connection (the one I taught
you how to establish at the beginning) type 'whois nickname'
(without the quotes)
Here is what I get when I whois my self in the raw
connection:
whois ^TCG^
:localhost 311 ^TCG^ ^TCG^ ~TCG thegod.actcom.co.il * :The
Cyber God
:localhost 312 ^TCG^ ^TCG^ localhost :test server
:localhost 317 ^TCG^ ^TCG^ 9 932030074 :seconds idle,
signon time
:localhost 318 ^TCG^ ^TCG^ :End of /WHOIS list.
Ok, before I explain what you got here, here is the format:
Format: :server-name raw-number sender target data.
Server-name is the server that gives you the data.
Raw-number is the ID of the data you got (it is used to
determine what data you are getting).
Sender: the senders nickname (you!!).
Target: The target (The nick you are whoising).
Data: The data.
Now here is an explanation on all the 4 lines
In the first one you see the user-name and the host of the
user, you also see his real name:
~TCG
thegod.actcom.co.il * :The Cyber God
| | |_ The user's real name
(you can fake this :))
| |_ The user host or IP
|
|_ The username (set by IdentD, will be explained later,
when followed by a '~' you see that the IdentD is NOT
running and the Ident (username) might be fake).
The
second line:
localhost :test server
| |_ Comment about the server (set by the
server admin)
|_ The server that user is connected to
Third
line:
9 932030074 :seconds idle, signon time
| |_When the user signed in
|_ How many seconds has he been idle
Last
line:
:End of /WHOIS list.
|_ Shows you that there is no more data.
Also, when users know your IP they can start almost any
Denial of Service (DoS) attack on your host like WinNuke
(Arggg... Lame Lame Lame!!!) or a lovely ping flood that
will chew up all of your bandwidth, depending on the
attacker's bandwidth (for more info and more sophisticated
DoS attacks, see the DoS tutorial at blacksun.box.sk).
[How
to spoof / hide your identity on the IRC]
After seeing what users can find out about you, it is time
to learn how to hide your identity.
There is no easy and lame way to do this. Here are the most
knows ways: FireWall, WinGate and a Bouncer aka (As Knows
As) BNC.
We will start from the firewall.
The firewall we are talking about is software that runs on
some machine and is used to filter incoming packets (packets
that arrive to the machine which is running the firewall)
and outgoing packets (packets that are sent from the machine
which is running the firewall). Some firewalls are not
configured very well and allow anyone to connect to them.
The hard part is to find a working one that will allow you
to use it to connect through it, and once you are connected,
using it so users that will whois you or dns you will see
the firewall's IP! If, for example, there is a misconfigured
FireWall on the host firewall.someone.com, you can use it in
mIRC, for example, by starting the mIRC program (I use the
newest version 5.6, go download it at www.mirc.co.uk) and:
1. Click on the Files menu, then Options.
2. On the topmost label of the tree where you can see
'Connect', If you see a '+' next to it click it. If you see
a '-' go to the next step
3. Click on the sub-item Firewall (duh...)
4. Be sure the 'Use SOCKS firewall' checkbox is marked (has
an 'X' in it).
5. In the Hostname field, write the IP / Hostname of the
firewall. For example lets use firewall.someone.com
6. Leave the USER ID and PASSWORD empty, and make sure the
port in 1080.
7. Click OK.
Now, next time you will type /server ... To connect to the
IRC server the connection will be relayed through the
firewall, so if someone will whois you he would see
something like this:
:localhost 311 ^TCG^ ^TCG^ ~TCG firewall.someone.com * :The
Cyber God
:localhost 312 ^TCG^ ^TCG^ localhost :test server
:localhost 317 ^TCG^ ^TCG^ 9 932030074 :seconds idle,
signon time
:localhost 318 ^TCG^ ^TCG^ :End of /WHOIS list.
You can see that my host is NO LONGER thegod.actcom.co.il,
instead it is now firewall.someone.com!!
Now I am protected. You might be asking right now where to
get the firewalls hosts. One idea is go asking your friends.
Other is going to Altavista (www.altavista.com) and
searching for "firewall AND list" and stuff like that.
Another way of spoofing your IP is a WinGate. WinGate is
software for Windows that is used to let several computers
that are connected through a local network of some sort to
use one computer's Internet access. It also allows you to
fake your IP _EXACTLY_ the same way. After installing
WinGate, anyone will be able to use it if you don't
configure it well (I personally recommend using SyGate
instead). To find Wingate addresses you can ask your
friends, run a Wingate scanner that will scan whole subnets
for Wingates or look for lists on the web.
Note: newer versions of the IRC daemons will automatically
check for an open Wingate or a firewall, and if they will
detect one they will kill your session and might even K-Line
(Ban the host from using the server/network) the host as
well.
Now, on to the Bouncer (aka BNC) spoofing.
Bouncer is software that runs on Unix computers. If, for
example, there is a BNC on bnc.shell.com on port 1234, you
can connect to it by typing: /server bnc.shell.com 1234
After that you should be getting something like this:
-BNC- Please type your password via /quote pass
Crap... You need a password. If you know the password you
have no problem. Just type '/qoute pass password' (without
the quotes), and replace 'password' is your password.
If you don't know the password you need to ask the guy that
gave you the BNC (or you could always hack the server... ;)
but this tutorial is about IRC warfare, not hacking servers
and getting passwords). You should also ask him if it (the
BNC) has vhosts. Vhosts are multiple IPs and hostnames for
the same BNC. If it has vhosts, you can set your active host
by typing '/quote vip the.host.name.here' (as you should be
able to figure by now, it is done without the quotes).
After this you type '/conn server'. For example /conn
irc.dal.net will connect you to irc.dal.net with the
bouncer's host.
Note: unlike firewalls and badly configured Wingates, the
server cannot detect a BNC, so there is no chance you will
be banned for using it.
[Bans and how to bypass them]
Channel Operators might ban you after you have done
something in their channel that made them angry :( .
To bypass a ban you first need to know the ban type. There
are a few ban types:
1. nick!*@* - Bans you by your nickname. All you need to do
is change your nick (by typing /nick newnick, or in raw
session NICK newnick) and you can reenter the channel.
2. *!user@* - Bans you by your Ident (UserID). If your
computer is not running an IdentD daemon (A win9x with mIRC
for example) you can easily change your Ident by clicking on
the File menu, selecting Options, opening the 'Connect'
sub-tree, clicking the IdentD label and changing the User
ID. If you are under a Unix / Linux machine that is already
running an IdentD daemon, you can't change it because it
automatically sets your ident username to your login name.
To change this you need to logon to the IRC through a
Bouncer because bouncers fake you IdentD.
3. *!*@host - You are banned by your IP / host. All you
need to do is to connect through a firewall or a Wingate.
Some times the bans are more complex like
^TCG^!*@*.actcom.co.il.
This ban will prevent anyone named ^TCG^ with host that
ends with .actcom.co.il
If you are interested here is the format:
Nick!user@host / IP
| | |_ The IP or hostmask.
| |
| |_ Your username. The IdentD sets this. When running
IdentD daemon it
| mostly not faked but when running windows or
connection through a
| bouncer it is probably faked.
|
|_The user nickname. If might also contain wildcards like
*T*C*G*.
This will prevent anyone with the letters T, C and G (in
this order)
to join the channel.
Examples: ^TCG!*@*.actcom.co.il
| | |_________The server
| |_Your Ident user (defined as the wildcard
'*', meaning ANYTHING)
|_Your nickname
As you probably know, channels have different modes. For
example +o to make a certain person an OP (Operator), +b to
ban a person etc'. To set a ban you type: /mode #Channel +b
nick!user@host and to remove a ban you type /mode #Channel
-b nick!user@host
On a raw session you don't need the '/'.
[I don't like your nickname... / Getting a user off the
IRC]
The easiest way to get a user off the IRC is using a
program called "Click2" for Windows.
If might not always work and it is considered extremely
lame, but it might work sometimes.
After you got this program, do the following:
1. Set the "Packets to:" option box to "Clinet"
2. In the Server textbox fill-in the TARGET server. You can
figure it out by doing a /whois or a /dns on the target's
nickname.
3. In the Client textbox fill-in the TARGET IP address. You
can also figure this by doing a /whois or /dns on him but if
he uses any spoofing technique like a BNC or a Wingate it
won't harm him even a bit (it may harm the Wingate /
Firewall / BNC, though).
4. Be sure that you set it to send 64 packets every 1000ms
in the 2 textboxes at the end of the window.
5. The client start port should be 1024 and the stop 1500.
6. Now hit nuke....
This is what you will see if it worked and you were in a
channel, and the target in also in this channel:
*** Quits: ^TCG^ (Connection reset by peer)
(Or something likes this)
The target should see something like this:
*** [10053] Software caused connection abort
If it is not working, you won't see anything and he won't
either. If he is running some packet-logger that logs ICMP
packets he will see your IP but most users do not run these.
Another lame way is to try winnuking the address. I won't
explain here how to do it and what winnuke is because it has
nothing to do with this tutorial (see R a v e N's DoS
tutorial for Winnuke information, as well as information on
more sophisticated attacks).
Here is a more complex way.
You will need a flood program like "Floods". (Ask me if you
want it)
After running it or any other flooding script that is based
on clone loading you connect the clones to the target IRC
server. (~6 clones should do the job)
Before we continue, I want to explain you how this works.
Each user on the IRC got something called SendQ and RecvQ.
They contain the data the user is sending / receiving.
They also have a maximum value. If this value is achieved,
the server will automatically close their connection.
Flood programs and flood scripts load clones
(computer-operated IRC "users") and start sending lot of
crap to the target nick, causing his RecvQ to fill up and he
should get disconnected :).
So after you launched the program, you start flooding. I
can't tell you exactly how because there are lot of programs
and I can't explain you how every one works, but I can help
you via my e-mail:
talrun@actcom.co.il
There are also more advanced programs that support clone
loading through firewalls and Wingates. When a user loses
his connection to the IRC because of such an attack,
everyone on every channel he was present on will see the
following:
*** Quits: ^TCG^ (Excess Flood)
Another way of disconnecting a user from the IRC is
exploiting a bug in his OS. You need to determine his OS and
start this attack on him. There are lots of different types
of attacks. To learn about them, read R a v e N's DoS
tutorial.
[Can I
get caught and will I?]
First of all, it depends on what you are going to do or
already did.
When you are going to take over a channel for example, if
you are doing it without hiding your identity first (See
previous chapter) you can get caught but nothing will
probably happen to you. You might receive a DoS attack that
can terminate your IRC session or lag you like hell. If you
are using a bouncer for example, you won't get caught for
this. But if you "click" someone and he logs the packets he
can e-mail your ISP with your IP and they might kill your
account.
If you are killing someone with a netsplit (See next
chapter) you won't get caught and nothing will happens to
you since you haven't done anything illegal.
Also, it is good to know as much as possible about your
target. If you see some one that is named 'Ass^Hole' for
example, you have no good reason to go packet him or flood
him. He might have access to an OC3 or a DS-3 line
(Extremely fast connections to the Internet) and he might
also detect your attacks and start flooding you in return.
Trust me, you don't want this to happen. One day my T3 line
got ping flooded from an OC3 line and it stopped working for
about 30 minutes. Just for your information, OC3 can
transfer up to 255Mbit and a T3 can transfer up to 9Mbit (I
think). If such a line will flood your computer you don't
stand a chance.
[What are netsplits and how can they help me?]
Large IRC networks consist of various servers. A NetSplit
occurs when a link between one of the servers and the others
gets broken because of lag or other reasons. All users that
were connected to this channel will be separated from the
others as long as the netsplit occurs.
Therefore, lots of channels become empty, and get closed.
When you will join a channel that became empty, or you left
only 1 user in the channel and you will cycle it, there is a
chance that you will obtain the channel operator status (OP,
@).
On a NetJoin (When the server relink to the entire network
again) you might still have the channel operator status. On
new servers, you won't get the operator status when the
network is in a spilt mode, but if you could find an old
server or network you just might get lucky. Breaking a
connection between 2 servers by yourself is very difficult.
You need to pick 2 servers that are already lagged and start
ping-flooding the target server from a fast connection.
Once a netjoin occurs, it is recommended to have a war
script (we'll get to those) that will DeOP everyone on the
channel so other OPs won't be able to DeOP you.
NetSplits can also let you disconnect a user from the IRC.
Let's say you want to disconnect a user named 'Lamer'. When
a netsplit occurs, there are two different possibilities:
1) The target user ('Lamer', in our case) was on the server
that did the netsplit and has left the IRC network, but will
return once a netjoin occurs (shouldn't take a lot of time).
2) The user is still on the network and has nothing to do
with the netsplit.
If number 1 occurs then all you need to do is connect to
the network using his nickname and wait for the netjoin.
When the servers will re-link they will see that there are 2
users with the same nickname. Such thing cannot possibly
happen, so one user must be killed. The user that was NOT on
the network, (which means he was on the splitted server)
will probably get killed. If option 2 occurs then all you
can do is to put a clone (open another IRC sesssion),
connect to the splitted server and change your nick to his
nick. When the servers will rejoin there is a small chance
that he will get killed, so cross your fingers. :)
Now, for the 1,000,000$ question: how do I detect a
netsplit? You can detect a netsplit if the user(s) quit
message is "Server1 Server2". For example:
Lamar
has quit IRC (irc.magic.com irc.freei.net)
| |_Server2
|_Server1
This message tells you that there is a split between
irc.magic.com and irc.freei.net
The second server (Server2) is the server that left the
net.
[Channel Takeovers]
Channel takeovers are used to take a channel from a user,
and prevent him from reentering the channel or gaining
operator status in the channel. The first thing you need to
do is to get ops. Here are 4 ways to get ops:
1. Via a NetSplit. (might take a lot of time)
2. Asking one of the ops to let you be an op (Who knows?
You might get lucky).
3. Running a bot on your computer or on a shell account and
telling the other ops that it is online 24 hours a day, and
ask them to op it. They might do it, then tell the bot to op
you.
4. You can always lure the other ops into giving you op by
telling them that you will advertise their channel and bring
them users and you might earn the ops status.
You can do nothing without the OP status. Here is what you
do after you got an op and you want to close they're
channels:
1. First, mass de-op all the users so they won't kick or
ban you. There are a lot of scripts out there that will do
this for you.
2. Then place a ban on *!*@*
3. Mass-Kick the channel (also with a script)
4. After this set the following modes: +smilk 1 1 (you type
/mode #Channel +smilk 1 1)
5. You took over the channel! :)
There is a problem with this, when you will leave the
channel he will get empty and then closed. The only solution
for this is placing a 24/7 (24 hours a day, 7 days a week)
bot in the channel. If channel services are available on
this network (Like in DALnet), you can register the channel
if no one else have done this already.
If you took over a registered channel, you will have a
problem keeping it because Channel Services can give the
channel back to its legal owner with no problem.
[How
to completely ruin a channel]
Here are some possible ways to completely ruin a channel:
1) Turning the channel into an invite-only channel, so only
people who were invited (to invite people, type /invite
nick) can join.
2) Making the channel password-protected.
3) Making sure that you are the only OP in the channel and
then turning the channel into moderated mode and then
mass-devoicing everyone. In moderated mode, only voiced
users (people with a little + in the beginning of their
nick. To voice people, do /mode #channel +v nick or -v to
devoice) can talk. That way, users will be able to see who
is on the channel (note: you can see who's on a channel
without joining it by typing /names #channel), but they
won't be able to chat, and they will have to listen to
you... :)
[Some
expansion about RAW sessions]
Too lazy to read RFC ?
Well, this is the "SUMMARY" of rfc1459 (IRC Protocol).
Hopefully after reading this you'll have better
understanding of how the protocol work (hey... don't just
use it... try to understand how it work). Yeah... this is
also how some people spoof their IP by telneting from some
restricted shell account with no IRC client access.
[Connecting to the IRC daemon]
Telnet/netcat (yep... we're gonna use a raw socket) to the
IRC port (6667/6668..etc) of the IRC server.
eg <:> telnet irc.dal.net 6667
Send your nick & username to be recognized after u got
connected using the user command in this form "user ".
eg <:> user nobody localhost localhost :I'm nobody nick
nobody
-------------------------[!! NOTE
!!]-------------------------
At any time if your receive anything like this
ping :1234567 <-- The sequence number change all the time
or
ping :192.0.0.1 <-- Some IP address
You must send back the number with a pong
eg <:> pong :1234567
or
pong :192.0.0.1
If you don't pong back, you'll be disconnected with a ping
timeout error.
---------------------[!! END OF NOTE !!]-------------------
[Exploring some basic commands]
Ok, after the nick & user commands you can start chatting
now. Type join #channel (Without the /) to join #channel.
(Yea... most commands you use in your BitchX or mIRC client
can also be
used here too...just don't include the /
eg: part #channel
quit :I'm out
etc... )
To send your message to a channel, use the privmsg command.
eg <:> privmsg #channel : Hi guys...Sup? (Dont forget the
":" if you are going to send more then one word)
This will send "Hi guys...Sup?" to #channel
To send a private message to a user:
eg <:> privmsg nickname : HI ya
This will send "HI ya" to nickname.
To set a mode on a channel you simply type mode #channel
mode.
For example, MODE #Channel +b 192.114.*.* will ban everyone
that they're IP begin with 192.114.
[Fun
stuff to do]
If you get something like this ":nick!user@ip-address
PRIVMSG your-nick :_VERSION_"
this means that nick is trying ctcp/version you. This
command is used to find out your version.
Send the version back using the NOTICE command... it could
be anything you want.
eg : NOTICE nick :_VERSION Telnet version 0.1 :) _
This will send "Telnet version 0.1 :)" as the version
reply.
[Faking /CTCP Replies]
Now many of you guys chat and have various people always
doing{Client for Client Protocol} CTCP replies, ie.
VERSION, TIME, FINGER, PING replies on you. These replies
can get you in a lot of trouble, mainly its a way for people
to gather information about you then start up an attack.
Now it is time to change the replies your mirc will give in
a way to cause the other end to be fooled. Well this topic
has been covered by many writers and warscript developers,
but many don't know about changing the replies to their
advantage, well look no further, here we go!
One of the most devistating attacks can come from a VERSION
reply.
To do a ctcp version reply on a user, all you have to do
is type:
"/ctcp <nick> VERSION " This will return the nick's irc
client. Now you may ask why is that important? Well lets say
your using mirc 5.7x which suffers from heap overflow of 217
bytes, and 5.8 heap overflow of 226 bytes by knowing your
version an attacher already knows which operating system
your using and a version, so they can hack you without a
trojan and you won't know it happened.
Lets kill the version reply to either give a fake reply or
no reply at all so they can sit there waiting, lol.
Okay you will need a hex editor for this, I recomment Hiew,
get it here!
-make a backup of your mirc32.exe.
-install hiew, load it up, once you have clicked mirc32.exe
now you will see some garbage, click F7 that should popup
the search box, type in VERSION you should be able to find
the reply something like mIRC32 v5.8 K.Mardam-Bey. Now just
delete the reply. If you have trouble doing it with Hiew
then get another hex editor, there are many around but its
the best. So save and exit. Now you can chose to have no
Version reply to make your attacker suffer from waiting when
there isn't going to be a reply or you can fake your reply
to trick him.
Lets trick the attacker:
Load up you mirc, then goto the tools menu, then click "
Remote ". There you should see a box,
now simply write this mini script,
ctcp 1:VERSION:{
.notice $me Recieved CTCP VERSION from $nick $+ / $+
$site
ctcpreply $nick VERSION "write your reply here, make it
funny" | halt
}
So now we have faked our ctcp reply it should look like
this, if we faked it to have no reply
/ctcp Mikkkeee VERSION
-> [Mikkkeee] VERSION
-
[Mikkkeee VERSION]
-
Well now the attacker will keep waiting and waiting.
Lets fake some more,
Another ctcp reply that can be of usage is /ctcp <nick>
PING
This reply of your ping will tell the attacker the speed
of your connection and if your lagging, wink wink he might
want to do a dos attack and boot you, so lets fake the reply
to our advantage.
Same as above write this mini script in our tools, then
"remote"
ctcp 1:PING:{
ctcpreply $nick PING "your pings number in sec" | halt
}
Usually I have mine set to 1 sec , but you can make it
funny like 690263165 sec, which would leave the attacker
fooled/confused.
Another reply that can cause you a bit of harm is /ctcp
<nick > TIME which will send the other user, your local
time/date. This is very bad cause if your busy trying to
bounce your ip over wingates and proxys and now your ip is
somewhere in Asia, and someone does ctcp TIME then they will
know your true location in the world, which can hurt your
spoofing tricks.
So lets fake it to our advantage!
ctcp 1:TIME:{
ctcpreply $nick TIME "your new time" | halt
}
your new time can be something like, Tue Jun 12 22:23:17
1989 be creative!
Another ctcp reply that can be used to gather some info on
you is /ctcp <nick> FINGER
its not a big deal but it simply replies what you have told
it to reply, so just fake everything.
hope that helps!
[How
to spoof via https proxys]
Now this idea is very creative, and I just found a little
program that you can use to do it. It is called
ThroughTheFire 0.9 which is able to spoof your ip via https
proxys. It is a new innovation in spoofing, lol !You can
also use this program to spoof telnet and i guess ftp
sufing. Well all you have to do now is find working https
proxy lists. To do so just type in ww.altavista.com
+"Https proxy" and you should get some results, maybe not
working results. Read the
Search Engines Ripped Apart tutorial to see other methods
on using search engines.
[War
Scripts]
War scripts are usually scripts for IRC clients that
contain features like Mass DEOP / Kick, channel takeover
options, nukers, flooders, clones and sometimes bots. Some
scripts even contain some nice and funny features that don't
necessarily have something to do with IRC Warfare.
In this section I will briefly cover some of the more known
war scripts and their features.
7th Sphere Script (c) 1996-1997 7th Sphere Enterprises
Support@7thSphere.com - http://www.7thSphere.com
Pros: Easy setup, Nice protections, Automatically runs the
Click nuker and fills-in all the needed values.
Cons: Protections are not customizable enough. Channel
Takeover doesn't mass kick / ban the channel.
TRiBE (t7) By kefz(tribe)
Pros: Excellent protections, Excellent socket flood clones
and firewall flood clones. The best I have ever seen! Comes
with a great set of utilities. Can automatically run click
with all the options pre-configured. Excellent set of
scripts / clients / bots exploits / backdoors.
Cons: None! Go get this script now!
Peace and Protection 4.0
Pros: Get it and see for your self, simply a work of art!
Cons: Too many good tools, lol
Wang Script 3.5 pro
Pros: Wang Clone, Trojan scan, Password protection,
nickname find, ctcp masking, email checking/sending, clone
scanner, anti takeover, info finder, takeover, fake dcc's,
telnet, wartools addons.
Cons: NONE!
[Editorial - IRC wars, another perspective]
Note: Most of this is taken from an article that was
written by Ntd (ntd@mirc.net). I feel that this article has
the best perspective about the IRC wars.
Note 2: If you are a newbie and you think IRC wars are a
great form of hacking, and doing complex attacks you might
want to skip this chapter and read it another time.
IRC
WAR? A LOAD OF SILLY NUKES
Right, first things first, nukes - or properly, Denial of
Service (DoS) attacks - are technically nothing to do with
IRC war. They operate directly from the attacker to the
victim's IP, and IRC comes into it only inasmuch as it gives
the attacker a ready source of IP addresses to attack, and
perhaps a "motive" for doing it (e.g, "they banned me!").
But, attackers could just as easily collect IPs from
services such as ICQ (which, incidentally, has to be one of
the most idiotically insecure protocols ever invented, yet
many people who bemoan IRC attack happily run ICQ, and
probably don't even check the option to hide their IP which
is useless anyway because there are lot of patches that will
always show you the IP even if the user chose to hide it).
IRC
WAR DOESN'T HELP IMPROVE SECURITY
Surely the stupidest argument against IRC war, is that
unlike other forms of hacking, it does not help anybody
because it doesn't contribute to increased security. There
is a mass of evidence showing quite clearly that this is not
the case. Why did Microsoft release a winsock that was not
vulnerable to the port 139 OOB nuke? Because that nuke
became so widely abused. Why do current versions of mIRC
have an option to only enable the identd server during
connection? Because mIRC 5.3 had an ident exploit with which
mIRC could be crashed. Why, in fact, have flood attacks
become so obsolete? Because ircds now contain anti-flood
code written directly in response to flood abuse. Of course
these attacks are irritating and disruptive at the time, but
in the long term they have undoubtedly led to more secure
code in operating systems, clients and irc daemons.
IRC
WAR IS NOT REAL HACKING
Again, this stems from a misunderstanding of what IRC war
is. Essentially there are two types: TCP/IP attacks (ICMP
nuke, smurf, fraggle, ping of death) and ircd based attacks
(nick collisions, lag collisions, serverops, hacking
o:lines, bogus bans). While the first category are almost
exclusively "lame cracking" (that is, the user needs only to
download a program and can then use it without any actual
knowledge), the second category is more ambiguous. I know
one person who finds many exploits by working with the ircd
code (which is of course almost always free for download) -
and finding bugs by working with the source is as "real" as
hacking can get. Within a few days of their implementation
he found ways of bypassing the ircnet ircd patches designed
to protect against open socks servers and deliberate nick
collisions. He even found a method by which a normal client
could completely crash a server remotely. And what did he do
with this knowledge...?
DOS
ATTACKS
Yes, they are illegal, and yes they are disruptive.
Furthermore, many DoS attacks affect many more people than
those targeted, the most obvious example being the smurf
attack. I am one of a group of friends who run a few of the
biggest channels on ircnet, and these channels are regularly
attacked by war groups intent on taking them. I make no
exaggeration when I say that several times a week, if not
everyday, members of the original channel opers complain
that they are being smurfed by members of groups attempting
to take the channel. These smurf attacks are capable of
taking down entire ISPs and that IRC warriors recklessly use
these attacks against single users just to take an irc
channel is utterly inexcusable in my opinion.
MOTIVATION
While there are some IRC warriors / hackers like the
individual I described above, it is sadly true that there
are many more who are acting from more dubious motives. To
the people who resort to floods, nukes and such tools just
because they are banned from channels, I say: you need to
get out more. What, then is my basic point? My conclusion is
that IRC abuse and hacking is like any other branch of
hacking - it ranges from the incredibly basic and lame to
the actually quite skilled and beneficial. At the one end
are the classic 13 year old hax0r wannabes with their
CLICK.EXE, and I am in no way suggesting these people's
behaviour should be excused or tolerated. However, I urge
you all to be aware that at the other end of the scale exist
talented, knowledgeable hackers discovering and revealing
bugs in clients, OSes and ircds by a variety of methods and
in doing so making IRC more secure for all of us.
|