This is the new home of the egghelp.org community forum.
All data has been migrated (including user logins/passwords) to a new phpBB version.


For more information, see this announcement post. Click the X in the top right-corner of this box to dismiss this message.

BotNet Protocol, Help?

Old posts that have not been replied to for several years.
Locked
C
Chr1s

BotNet Protocol, Help?

Post by Chr1s »

I was wondering if anyone knows where I can find the botnet protocol and explanations about the different packets sent and received.

I've figured out some stuff like when the bot connects it's requested a username and password the same way as a user that connects by telnet:
Packet Information:
IN
IN
IN Lamestb2t (Eggdrop v1.6.13 (C) 1997 Robey Pointer (C) 2002 Eggheads)
IN
IN Please enter your nickname.
OUT lamestb0t
IN passreq <72303e8f308a@Lamestb2t>
OUT testpass
I'm still wondering what the 72303e8f308a means in the passreq packet as well as whats the EL packet mean when linking to a bot.

Here's basically a bit of the botnet protocol I could get:
IN
IN
IN Lamestb2t (Eggdrop v1.6.13 (C) 1997 Robey Pointer (C) 2002 Eggheads)
IN
IN Please enter your nickname.
OUT lamestb0t
IN passreq <72303e8f308a@Lamestb2t>
OUT testpass
IN *hello!
IN
IN version 1061300 9 eggdrop v1.6.13 <I.didn't.edit.my.config.file.net>
OUT version 1000000 9 eggdrop v1.0.0 <I.didn't.edit.my.config.file.net>
IN thisbot Lamestb2t
IN join Lamestb2t chris 0 *8 telnet@192.168.0.1
IN idle Lamestb2t 8 71
IN el
IN chan chris@Lamestb2t 0 some text blah blah
IN ping
OUT pong
IN chat Lamestb2t Linked to Lamestbot
IN nlinked Lamestbot Lamestb2t -1061300
IN join Lamestbot Chris 0 *8 testbot75k@192.168.0.1
IN idle Lamestbot 8 2
IN unlinked Lamestbot
IN unlinked Lamestbot
OUT chan Lamestb0t 0 blah blah blah
IN chat Lamestb2t BOT SHUTDOWN (Authorized by chris)
IN bye
g
guppy
eggdrop engineer
Posts: 199
Joined: Mon Sep 24, 2001 8:00 pm
Location: Canada
Contact:

Post by guppy »

g
guppy
eggdrop engineer
Posts: 199
Joined: Mon Sep 24, 2001 8:00 pm
Location: Canada
Contact:

Post by guppy »

Damn it :P
Locked