I just wanna put a little bit effort into this now so we maybe get the thing solved. therefore I try to be as precise as possible in the following description.
my botnet consists of 2 bots.
the HubBot is on a firewalled box with a static, public IP. the leafbot is on a firewalled box with a dynamic, public IP.
the firewalls are bocking ICMP; the listening and dcc-range ports are opened.
here are the partyline messages (just for the sake of completness ;> they have been posted here thousand times before)
::: case 1 - HubBot linking to LeafBot :::
on HubBot
Linking to LeafBot at LeafBot.host.from.dyndns.org:1234 ...
Linked to LeafBot.
*** Linked to LeafBot
Creating resync buffer for LeafBot
Sending user file send request to LeafBot
Disconnected from: LeafBot. No reason (lost 1 bot and 0 users)
*** Disconnected from: LeafBot. No reason (lost 1 bot and 0 users)
(Userlist transmit aborted.)
::: Case 2 - LeafBot linking to HubBot :::on LeafBot
Received challenge from HubBot... sending response ...
Linked to HubBot.
*** Linked to HubBot
Downloading user file from HubBot
[Failed connection; aborted userfile transfer.
Disconnected from: HubBot. No reason (lost 1 bot and 0 users)
*** Disconnected from: HubBot. No reason (lost 1 bot and 0 users)
on HubBot
Telnet connection: LeafBot.hostname/30000
Lost connection while identing [LeafBot.hostname/30000]
on LeafBot
Linking to HubBot at HubBot.hostname:1234 ...
*** [LeafBot] Couldn't link to HubBot.
Failed link to HubBot.
configuration HubBot:
Code: Select all
set my-ip "123.456.78.90"
[...]
listen 1234 all
set protect-telnet 1
set ident-timeout 60
set open-telnets 0
set stealth-telnets 1
set connect-timeout 60
set paranoid-telnet-flood 1
set resolve-timeout 60
[...]
set reserved-portrange 1234:4321
[...]
set allow-resync 0
transfer, filesys and shared module loaded and working. as you can see: I increased all timeouts form 15 secs to 60 but it's still not working.
the configuration on the LeafBot looks almost the same. with only one difference:
Code: Select all
set my-hostname "LeafBot.hostname.from.dyndns.org"
a demon is updating the hostname regularly so the hostname always links to the current dynamic IP.
I can telnet in to both bots on the specific listening ports, so the firewall should not be the problem.
but tbh I dont know what else I could try. I hope anyone here got a good idea.
thx for reading
/gogo
edit:
both boxes dont have an identd running