egghelp/eggheads community Discussion of eggdrop bots, shell accounts and tcl scripts. 2003-04-06T10:42:29-04:00 https://forum.eggheads.org/app.php/feed/topic/4064 2003-04-06T10:42:29-04:00 2003-04-06T10:42:29-04:00 https://forum.eggheads.org/viewtopic.php?p=18636#p18636 <![CDATA[BotNet Protocol, Help?]]> Statistics: Posted by guppy — Sun Apr 06, 2003 10:42 am

]]> 2003-04-06T10:42:05-04:00 2003-04-06T10:42:05-04:00 https://forum.eggheads.org/viewtopic.php?p=18635#p18635 <![CDATA[BotNet Protocol, Help?]]> http://forum.egghelp.org/viewtopic.php?t=1108 this thread at the bottom.

Statistics: Posted by guppy — Sun Apr 06, 2003 10:42 am

]]> 2003-04-05T16:20:58-04:00 2003-04-05T16:20:58-04:00 https://forum.eggheads.org/viewtopic.php?p=18621#p18621 <![CDATA[BotNet Protocol, Help?]]>
I've figured out some stuff like when the bot connects it's requested a username and password the same way as a user that connects by telnet:
Packet Information:
IN
IN
IN Lamestb2t (Eggdrop v1.6.13 (C) 1997 Robey Pointer (C) 2002 Eggheads)
IN
IN Please enter your nickname.
OUT lamestb0t
IN passreq <72303e8f308a@Lamestb2t>
OUT testpass
I'm still wondering what the 72303e8f308a means in the passreq packet as well as whats the EL packet mean when linking to a bot.

Here's basically a bit of the botnet protocol I could get:
IN
IN
IN Lamestb2t (Eggdrop v1.6.13 (C) 1997 Robey Pointer (C) 2002 Eggheads)
IN
IN Please enter your nickname.
OUT lamestb0t
IN passreq <72303e8f308a@Lamestb2t>
OUT testpass
IN *hello!
IN
IN version 1061300 9 eggdrop v1.6.13 <I.didn't.edit.my.config.file.net>
OUT version 1000000 9 eggdrop v1.0.0 <I.didn't.edit.my.config.file.net>
IN thisbot Lamestb2t
IN join Lamestb2t chris 0 *8 telnet@192.168.0.1
IN idle Lamestb2t 8 71
IN el
IN chan chris@Lamestb2t 0 some text blah blah
IN ping
OUT pong
IN chat Lamestb2t Linked to Lamestbot
IN nlinked Lamestbot Lamestb2t -1061300
IN join Lamestbot Chris 0 *8 testbot75k@192.168.0.1
IN idle Lamestbot 8 2
IN unlinked Lamestbot
IN unlinked Lamestbot
OUT chan Lamestb0t 0 blah blah blah
IN chat Lamestb2t BOT SHUTDOWN (Authorized by chris)
IN bye

Statistics: Posted by Guest — Sat Apr 05, 2003 4:20 pm

]]>