egghelp/eggheads community

bind notc - * ...

2003-11-06T05:38:41-04:00

kinda got to figur out some more about irc , i made eggdrop start new connection as server to irc so kinda working on that first i want to make it connect as a service not as a bot but maybe i can help .. do share if you want or people here

i mean speed it up eh

Statistics: Posted by Ofloo — Thu Nov 06, 2003 5:38 am

bind notc - * ...

2003-11-04T09:58:42-04:00

Was wondering if you had any luck with your bot / drone scanner script? I've been working on one as well, and I think I got it but it is way way too slow to be effective..

Statistics: Posted by Guest — Tue Nov 04, 2003 9:58 am

bind notc - * ...

2003-09-03T16:26:24-04:00

nice script man nice indeed

Statistics: Posted by Ofloo — Wed Sep 03, 2003 4:26 pm

bind notc - * ...

2003-09-03T16:19:44-04:00

and if i finish the script ill post it here will take a while tho i know some guy who is working on a drone scanner (scans irc for ddos bots and stuff) i wana do bot drone scan and check the ones that connect on version, but some change the version of couse thats where the drone scanner comes in

it all works manual but now i wana create it so that it's automatic and all tcl cause part of it is mrc and ... if you know what i mean hehe but tnx for the script i am realy sur i could use some samples from it

Statistics: Posted by Ofloo — Wed Sep 03, 2003 4:19 pm

bind notc - * ...

2003-09-03T16:14:55-04:00

tnx got to go over if i got questions ill youll hear a scream if you don't mind hehe

Statistics: Posted by Ofloo — Wed Sep 03, 2003 4:14 pm

ok, here goes

2003-09-02T17:02:10-04:00

Please be advised, that this was my tcl script that I wrote. But, like what I think your trying to do. It was to help protect the irc network that I am a part of. What this paragraph does is interpet any notice that the eggdrop receives, looking only for connect notices(both far and local). This specific script ignores any connect notices that occur from either services or statserv, which I beleive you will want to also. Once it was determined that a connect was occuring against the network, the script then takes the string as an array and strips out the ip. Which, then I did what I needed to do. Follows is the code for the raw NOTICE bind and paragraph that I use.

Code:

## non_scannable_servers is the names of servers that you do not want netbopm to monitor.  Examples would#       be services due to people not identifying their nick in time.  Waste of time for netbopm to even#       look at anything from there, and statserv due to various bots that join to collect statistics.#set     non_scannable_servers   {        "Services.AwesomeChat.Net"        "Stats.AwesomeChat.Net"   }## Variable for determining if a user has connected on the server that the eggdrop is on, or another# server on the network.#       set     remote_connect          "Client connecting at"# Check_Raw_Notices: This event is used to capture the connects of users from the various#       servers.  Once the bind occurs, then the server is checked to determine if there is#       an active bopm proxy bot monitoring it.  If not, then a random bopm proxy bot is#       selected.  And a manual scan command is issued to the bopm monitor channel for the#       ip of the connecting user to be checked.#bind    raw     -       Notice  Check_Raw_Noticeproc    Check_Raw_Notice        {from   word    text} {        global  botnick        global  bopm_channel        global  active_bopm_bots        global  active_bopm_servers        global  non_scannable_servers        global  ips_scanned         global  remote_connect          global  ban_time        global  server        set     string_text     [join [list $text]]        set     string_check1   [string match *problems* $string_text]        if      {([string match *connecting* $string_text])        &&       (!$string_check1)} {                if {[string match *$remote_connect* $string_text]} {                        set enclosed_ip         [string trimleft [lrange [split $text] 9 9] *(]                        set da_server           [split [lindex $text 7] :]                        set connect_nick        [lindex $string_text 8]                } else {                        set enclosed_ip         [string trimleft [lrange [split $text] 10 10] *(]                        set da_server           [split $server :]                        set connect_server      [lindex $da_server 0]                        set connect_nick        [lindex $string_text 9]                }                set connect_server      [lindex $da_server 0]                set enclosed_ip [string trimright $enclosed_ip )*]                set list_ip     [split $enclosed_ip @]                set daip        [lindex $list_ip 1]                puthelp "PRIVMSG $bopm_channel :$connect_nick has connected oin $connect_server"                if {([llength $active_bopm_bots] == -1)} {                        return 0                } else {                        if  {([llength $active_bopm_bots] == 0)} {                                set danumber    0                        } else {                                set danumber    [rand [llength $active_bopm_bots]]                        }                }                set danick              [lindex $active_bopm_bots $danumber]                if      {(![string match *$connect_server* $active_bopm_servers])                &&       (![string match *$connect_server* $non_scannable_servers*])} {                        putloglev * $bopm_channel "---"                        putloglev * $bopm_channel "$danick is scanning ip $daip on server $connect_server"                        putloglev * $bopm_channel "---"                        puthelp "PRIVMSG $bopm_channel :$danick scan $daip"                        incr ips_scanned 1                }         }        return 0}

Now, what they was saying is. If you read the documentation concerning the raw event. It very highly advise's of issuing a return code of 0. Very highly. Also, I know you probably didnt want to see all of this paragraph, but I wanted to show how I loaded the string from the notice into an array , pulled out the ip. What I think you are looking for is to extract the nick from a connect notice, so that you can do a ctcp version. With the case of Unreal, this is right before the location of the ip/host.
Errr, I hope this helps. By the way, again as I was saying. I think you are trying to do the same thing I am. Protect our network from bots. If you have any sugestions with regard to these sdbots. We get them too. So, Im all ears.

droolin

Statistics: Posted by droolin — Tue Sep 02, 2003 5:02 pm

bind notc - * ...

2003-09-01T23:24:24-04:00

droolin

could you give me a sample of that script i need to get ips of connection clients as well to ctcp version them to see if there sdbots or something like that so .. i would be great full if you could send me that script or tel me where to get it... i could see how you managed to create sutch bind on a raw server notice to create that script tnx

sorry for the late answer i axidently removed all my default linux routes and cause i didn't knew any think about it, it took me a while to get it back up and running tnx for understanding hehe

Statistics: Posted by Ofloo — Mon Sep 01, 2003 11:24 pm

bind notc - * ...

2003-09-01T23:22:00-04:00

sorry you all lost me let me read up on this and get back to you.

Statistics: Posted by Ofloo — Mon Sep 01, 2003 11:22 pm

I can attest to what was just said

2003-08-27T23:01:17-04:00

I found, even though I read the manual. That when I did not put in my procedures a return 0 from a raw event. I had some really strange results. And I used raw notice by the way, to interpit connections to a network. For basicatly what you are doing, except I was feeding ip's to the bopm proxy scanner bots. It definatly works.

droolin

Statistics: Posted by droolin — Wed Aug 27, 2003 11:01 pm

bind notc - * ...

2003-08-27T05:23:00-04:00

There isn't much more to say that the good old RTFM.

The RAW bind is documented.

You need to force a "return 0" in allmost every aspect of a RAW bind, to prevent your bot ignoring messages.

Statistics: Posted by ppslim — Wed Aug 27, 2003 5:23 am

bind notc - * ...

2003-08-26T21:27:36-04:00

so what your saying is that there is a return 0 and when 0 it doesn't show so i na way i need to reverse it ? or what exactly are you saying ?? you got some docu where i can read on this .. ? or is there an other raw i can use for this i just wana ban certain bots with my eggdrops, and perfrom an ctcp version on connect .. and gline certain individuals or certain users by doing this

Statistics: Posted by Ofloo — Tue Aug 26, 2003 9:27 pm

bind notc - * ...

2003-08-26T19:22:07-04:00

You should be able to catch them using the RAW bind and a key of NOTICE.

However, you should be careful and make sure you force a return code in a procedure triggered by a RAW bind.

Many people forget that TCL will use the return buffer from the last command as the return value for a procedure. In most cases, this causes the bot to ignore all input.

Statistics: Posted by ppslim — Tue Aug 26, 2003 7:22 pm

bind notc - * ...

2003-08-26T18:14:05-04:00

what's the bind for raw server notice

Description: dest will be a nickname (the bot's nickname, obviously) or a channel name. mask is matched against the entire notice and can contain wildcards. It is considered a breach of protocol to respond to a /notice on IRC, so this is intended for internal use (logging, etc.) only.Note that server notices do not trigger the NOTC bind.

just wana trigger an even when a user connects ..

Statistics: Posted by Ofloo — Tue Aug 26, 2003 6:14 pm