egghelp/eggheads community

kk

2003-12-21T00:48:15-04:00

hello.

i want to make a botnet with dynamic ip/hostnames. for this reason i need to have a stable hub always online. i've thought to this solution :

aalina is my hub
adele is leaf n.1
agnese is leaf n.2 but is an alternative hub for adele
alberta is leaf n.3 but is an alternative hub for adele
ambra is leaf n.4 but is an alternative hub for adele
anna is leaf n.5 but is an alternative hub for adele
barbara is leaf n.6 but is an alternative hub for adele
betta is leaf n.7 but is an alternative hub for adele
and so on,until leaf 99...

with this structure i can have always a hub online. if someone wants to denial of service a part of my botnet,the rest of it will be alive and linked always with one hub but i don't know what could happens if the leaf n.1 will be offline. what do u think about this solution ?

Statistics: Posted by virtuoso — Sun Dec 21, 2003 12:48 am

make a botnet with dynamic ip numbers

2003-12-19T14:14:26-04:00

BAH.

It have never been safe, nor unsafe.

To get the password in the first place, they must of hacked the information, upon which point your screwed regardless.

You should be more worried about general security and system security than the fact that hostmasks don't always match a single machine.

Statistics: Posted by ppslim — Fri Dec 19, 2003 2:14 pm

ddd

2003-12-19T12:23:37-04:00

this is what im trying to say ! but peoples are telling that's a safe solution. i think i should use the tcl that i've posted at the beginning.

Statistics: Posted by virtuoso — Fri Dec 19, 2003 12:23 pm

make a botnet with dynamic ip numbers

2003-12-19T12:12:08-04:00

That has always been a security concern form day one.

The same can be said for any system that determines if a user is legitmate on more than just a username and password.

You are never going to get hardcore security out of a dynamic IP full stop.

Statistics: Posted by ppslim — Fri Dec 19, 2003 12:12 pm

sss

2003-12-19T11:27:40-04:00

but excusme but on which kind of parameters are they based ?

Statistics: Posted by virtuoso — Fri Dec 19, 2003 11:27 am

make a botnet with dynamic ip numbers

2003-12-19T10:05:40-04:00

No, passwords can't be re-do.
The password is created when the bots link for the first time, and they're keeped.

Statistics: Posted by CrazyCat — Fri Dec 19, 2003 10:05 am

ssss

2003-12-19T08:59:31-04:00

>The fakebot won't connect to the botnet without knowing the right >password wich will be set by the bots at the first linking.

but if the fakebot is built by nick + user id + hostmask , and nick + user id are easy to be cloned and the hostmask can be obtained from any1,because its enough to use the same isp,the password created during the linking should be valid for the fake bot too...

Statistics: Posted by virtuoso — Fri Dec 19, 2003 8:59 am

make a botnet with dynamic ip numbers

2003-12-19T05:26:58-04:00

Nope, since the dynamic part is replaced by the asterix, there's no need to do anything.

Nothing much, beside that one has either to use the same ISP or to fake the hostmaskhe has also to use the exact Botname!ident@*.hostmask.
But even if, it's the same like a faked user. The fakebot won't connect to the botnet without knowing the right password wich will be set by the bots at the first linking.

Not more or less difficult than killing a bot on a server from any shell provider by using a DoS or DDoS.

I don't see any real problems. For security reasons I wouldn't give such a bot the autoop flag, but that is something I wouldn'd do for anyone, bot or user.
The only real problem with eggdrops running on a server connected via dsl is, that most ISP's (at least here in germany) disconnect every 24 hours. If the bot is supposed to protect a channel on a network without services like chanserv, I would at least run one or better more eggdrops from drifferent shells.

Statistics: Posted by Darmoth — Fri Dec 19, 2003 5:26 am

gg

2003-12-18T10:56:59-04:00

but everytime your dynamic part changes,u should replace it ,right ?
and what happens if someone makes a fake bot ? its very easy to kill your bot using the denial of service and to clone his nickname and userid. (the dynamic part don't need to be cloned...)
for this reason i think thats not a safe solution....what do u think ?

Statistics: Posted by virtuoso — Thu Dec 18, 2003 10:56 am

make a botnet with dynamic ip numbers

2003-12-18T09:48:25-04:00

beside the eggdrops I run from my shells, i also run 2 of them from a local server, connected via dsl and dynamic IP.
It works fine. All I did was adding the bots like that:

Botname!Ident@*.this.host:port

The asterix replaces the dynamic part of the hosmask (it's changin every 24 hours.)

Statistics: Posted by Darmoth — Thu Dec 18, 2003 9:48 am

uu

2003-12-17T15:15:49-04:00

i should add :

.+bot dynamicdnsaddress:botport

but what is dynamicdnsaddress ?

Statistics: Posted by virtuoso — Wed Dec 17, 2003 3:15 pm

make a botnet with dynamic ip numbers

2003-12-17T14:32:47-04:00

Then "Nutellina" is not added as a bot. Check http://www.egghelp.org/enhance.htm

Statistics: Posted by user — Wed Dec 17, 2003 2:32 pm

uuu

2003-12-16T22:56:36-04:00

ok. the hub is called nutellina ; its located on a shell and the stable hostname is :

Nutellina is virtuoso@62.80.109.152 * Nutellina

i've logon on dcc with the first leaf,after have installed on his box a dns tool for updating the ip number with a stable hostname (called ada.toh.info) and i've written :

.chaddr Nutellina ada.toh.info:4764

and the output has been :

This command is only useful for tandem bots.

Statistics: Posted by virtuoso — Tue Dec 16, 2003 10:56 pm

make a botnet with dynamic ip numbers

2003-12-16T18:27:44-04:00

1) Get an account with some dynamic dns provider
2) Install a suitable client for updating the ip (on the box your hub is running from)
3) In leafs: .chaddr hub :
4) Enjoy

Statistics: Posted by user — Tue Dec 16, 2003 6:27 pm

make a botnet with dynamic ip numbers

2003-12-16T18:08:07-04:00

so, my hub will be

HUB ---> *@*.pool*.interbusiness.it,

right ?

and u wanna link the leafs manually,everytime a pc go online ?

if yes,your way its not safe...

Statistics: Posted by virtuoso — Tue Dec 16, 2003 6:08 pm