TCL hunt

WeiJie · Post by **WeiJie** » Mon Sep 06, 2004 7:11 am

Recently, my channel have been attacked by a bunch of proxy users... like sock/wingate, but when i try to install a anti-sock/wingate on join to a eggdrop, the bot would always pto or lagged due to the scanning of each user...

1) where can i do to get a fast and reliable anti-sock/wingate tcl?
2) is there any other tcls that anyone out there recommend to revents 20+ flooders on join/pte msg flood operators other den +limit tcl?
3) is there a way to prevent all this?

Thanks

greenbear · Post by **greenbear** » Mon Sep 06, 2004 11:03 am

Just ban everyone with no identd and be done with it

awyeah · Post by **awyeah** » Mon Sep 06, 2004 9:39 pm

Scanning each user on join will obviously lagg the bot and wouldn't even make it effective against mass join flood protections.

Well usually those bots have random nicks. I have made a script using string match and regexp to match against certain nicks with certain combinations of alphabets present in them and a few characters and words. You can define the combinations to trigger and exempt on.

It is not fool proof but it is good enough to remove random drone nicks which join channels to flood. Also some bots might have same IP's check for similar *!*@host on join like some clone scripts, and ban if say 2 or 3 similar ips join in your channel in less than 1-3 seconds or so. Or you can enable flood-join which is good to.

There are other precautions to be taken as well.

WeiJie · Post by **WeiJie** » Tue Sep 07, 2004 3:55 am

Mmm... The script u have make won't make the bot go crazy and kick some particular innocent user who actually have those combinations alphabets present in them? Actually I don't really approve of the script you make... lol. It might kicked wrong user out of the channel... And most importantly, the drones/flood bots are actually loaded in real different nick at time...

Yes, I enable the flood:join some times back, but whenever there's a bad/serious netsplit going on, and majority of users got splitted out and came back at a later time, the bots will kick everyone (those who just joined in due to netsplit) out and even ban some hostmask which is similar to others like *!*@*.com.sg (for Singapore) and this will cause a "war" in the channel. And I have add a user "blacklist" and chattr +k to the blacklist user and added hostmask which seems reguarly for floodbots and drones, but the only thing that I'm afraid is that if there's a large drones or flood bots joined a channel, the bot will be BUSY (real BUSY I mean) kicking and banning, this will causes a excess flood and by the time the bot return, the channel will be flooded to the maxium.

Another question is that, is there any tcl recommended by anyone out there to prevent this problem?

awyeah wrote:Scanning each user on join will obviously lagg the bot and wouldn't even make it effective against mass join flood protections.

Well usually those bots have random nicks. I have made a script using string match and regexp to match against certain nicks with certain combinations of alphabets present in them and a few characters and words. You can define the combinations to trigger and exempt on.

It is not fool proof but it is good enough to remove random drone nicks which join channels to flood. Also some bots might have same IP's check for similar *!*@host on join like some clone scripts, and ban if say 2 or 3 similar ips join in your channel in less than 1-3 seconds or so. Or you can enable flood-join which is good to.

There are other precautions to be taken as well.

WeiJie · Post by **WeiJie** » Tue Sep 07, 2004 3:58 am

Thanks for ur reply... I've think of this solution also, but some user due to the router's or bad identd (not drones/flood bot), they may get kicked out, out of no reason... So I've dropped the thinking instead...

gb wrote:Just ban everyone with no identd and be done with it

awyeah · Post by **awyeah** » Tue Sep 07, 2004 5:11 am

You might want to try out sentinel.tcl by slennox on egghelp.org for mass join flood, or join/part protections.

I am currently doing a script similarly to, it will lock the channel to some desired modes so the bots don't text/notice flood. It will prevent mass joins of alot of hosts in a less amount of time, mass joins of 2-3 similar hosts in less than desired secs and mass join/parts of similar hosts in the desired time. Still it is under test and development to some extent.

As for your drone nick problem. I use the script on a channel with 300+ users, regular users i.e. no bots or xdcc bots and it works fine for me. It has never gone mad and starting kicking everyone joining, out of 100 users kicked 2-3 might be innocent. However, likely alot of random nicks might not be kicked as there are alot of variations. It is based on the same pattern of matching which ozscript (mIRC script) uses for nonsense.ini (nosense nicks).

I have daily recorded logs for this estimate. The script won't go mad, although it might kick 1% innocent users sometimes out of the 99% as it is not always perfect. The more matches and exempts you define for it the better it can get, obviously. It is a random/drone nick kicker. I can't give it to you at the moment though, it will be released on egghelp.org when I fully test it as well.

WeiJie · Post by **WeiJie** » Tue Sep 07, 2004 8:47 am

I knew there's this script caled sentine.tcl but quite a time back when i installed it on my botty, perhaps due to my wrong configuration, most of the time the bot will kick numbers of users out during netsplit (when they returned) and this i really withness it.. lolx!

Hmmm, awyeah, would like u to do me a favour... When u have posted the script that u have mention in this topic, please send me a msg to my forum's inbox or leave a msg here yea?

Thanks...

Mmm...Cause i have no idea what's the drones or flood bots's nicks...As it was loaded manually by the user 1 by 1 so he can decide on what's the nicks and the username and wadever... Anyway, do anyone have a tcl that will make a bot whois a on-join user and check for their realname and den if it was blacklisted, it will kick + ban him/her out of the #? Will thsi tcl lag the bot too?

awyeah wrote:You might want to try out sentinel.tcl by slennox on egghelp.org for mass join flood, or join/part protections.

I am currently doing a script similarly to, it will lock the channel to some desired modes so the bots don't text/notice flood. It will prevent mass joins of alot of hosts in a less amount of time, mass joins of 2-3 similar hosts in less than desired secs and mass join/parts of similar hosts in the desired time. Still it is under test and development to some extent.

As for your drone nick problem. I use the script on a channel with 300+ users, regular users i.e. no bots or xdcc bots and it works fine for me. It has never gone mad and starting kicking everyone joining, out of 100 users kicked 2-3 might be innocent. However, likely alot of random nicks might not be kicked as there are alot of variations. It is based on the same pattern of matching which ozscript (mIRC script) uses for nonsense.ini (nosense nicks).

I have daily recorded logs for this estimate. The script won't go mad, although it might kick 1% innocent users sometimes out of the 99% as it is not always perfect. The more matches and exempts you define for it the better it can get, obviously. It is a random/drone nick kicker. I can't give it to you at the moment though, it will be released on egghelp.org when I fully test it as well.

awyeah · Post by **awyeah** » Tue Sep 07, 2004 9:50 pm

I knew there's this script caled sentine.tcl but quite a time back when i installed it on my botty, perhaps due to my wrong configuration, most of the time the bot will kick numbers of users out during netsplit (when they returned) and this i really withness it.. lolx!

I recommend you to use sentinel.tcl as it is currently one of the best flood protection scripts around. Especially I like the avalanche/tsunami protection, that is really effective.

If you are having troubles with setting up sentinel, then on this same forum in the 'slennoxs scripts' section post a thread with your problem and slennox will get back to you as he is the creator of sentinel.tcl.

As for the netsplit thing make sure you have set this correct in your configuration file so, the bot doesn't kick users on a netsplit rejoin.

Code: Select all

# Set here the time (in seconds) to wait for someone to return from a netsplit
# (i.e. wasop will expire afterwards). Set this to 1500 on IRCnet since its
# nick delay stops after 30 minutes.
set wait-split 600

Hmmm, awyeah, would like u to do me a favour... When u have posted the script that u have mention in this topic, please send me a msg to my forum's inbox or leave a msg here yea? Thanks...

I will release the script publicly on www.egghelp.org's tcl archive when I am done and through with it. Currently it is under test and will take sometime, approx. 2-3times. Unfortunately I haven't been getting so much time to do scripts these days!

Mmm...Cause i have no idea what's the drones or flood bots's nicks...As it was loaded manually by the user 1 by 1 so he can decide on what's the nicks and the username and wadever... Anyway, do anyone have a tcl that will make a bot whois a on-join user and check for their realname and den if it was blacklisted, it will kick + ban him/her out of the #? Will thsi tcl lag the bot too?

Basically my drone nick kicker will exempt all nicks with VOWELS, like nicks which have a, e, i, o, u and y also (if specified). It will match against certain combinations such as if "gv" or "zx" "wc" "rw" etc some of these kinds of combinations are present with a specific nick length and a specific user ident length also checking if the ident is dynamic (with an ~ at the front). All these conditions make it work perfectly fine, especially the dynamic ident (~) makes it easier to detect proxied bots as their idents do not resolve behind a proxy.

There is a tcl named badrealname.tcl search that on tclscript.com or egghelp.org. You can find it go ahead and use it will do the same. WHOIS users on join and check if a matching word is found in the realname it will ban it, with 'newchanban'. If you know how to code tcls you can remove that ban and .chattr [user/host] +k, blacklist and kick/ban that ip range.

Well this tcl will not lag the bot. Depends I had a bad channel kicker it used todo the same check for bad channels on join. It was loaded onto a channel with 300+ users, having 1 user join atleast 1-2secs so my bot was under alot of stress, and it used to die checking fast on join spammers. So I guess if the joining count and time are less it should be okay else if it is a big channel with a large user count and frequent joins of users within 1-5 secs then it might lagg the bot.

WeiJie · Post by **WeiJie** » Tue Sep 07, 2004 10:03 pm

Hey, thanks alot... I will try out ur solution/advises...

WeiJie · Post by **WeiJie** » Fri Sep 10, 2004 2:37 am

Could anyone help with this? I just downloaded badrealname.tcl by Papillon and loaded it into my eggdrop, but will it's only allow to scan 1 channel i think... how could i let it scan few #s?

YooHoo · Post by **YooHoo** » Fri Sep 10, 2004 3:28 am

WeiJie wrote:Could anyone help with this? I just downloaded badrealname.tcl by Papillon and loaded it into my eggdrop, but will it's only allow to scan 1 channel i think... how could i let it scan few #s?

Code: Select all

# The realname check should be done only in what channel?
set badr(chan) "#*"

and this won't work?

awyeah · Post by **awyeah** » Fri Sep 10, 2004 3:49 am

Hehe, I have modified it to work on more than 1 channels. Simply by changing it to a list and then lsearching finding and comparing the channel with the list if it is found.

Code: Select all

And "#*" won't work.

WeiJie · Post by **WeiJie** » Fri Sep 10, 2004 6:35 am

Mmm... I don't really get what u mean thou... ;P

awyeah wrote:Hehe, I have modified it to work on more than 1 channels. Simply by changing it to a list and then lsearching finding and comparing the channel with the list if it is found.
Code: Select all
And "#*" won't work.

awyeah · Post by **awyeah** » Fri Sep 10, 2004 7:04 am

Here use this now.
Although this script can be further corrected as it not yet in the best shape, but as it works for multiple channels I suggest you use it.

Code: Select all

### Setting options and variables ###

# What bad realnames should be banned?
set badrlist {
"sex"
"xxx"
"horny"
"bitch"
"asshole"
"pussy"
"penis"
"naked"
"blowjob"
}

# Set the channels to kick on
set badrcheck "#funchat #gossip #giggles #usa #elite"

# Set the kick message
set badrkick "bad channel found!"

# For how many minutes would you like to ban?
set badrtime "60"


### SCRIPT ###
bind join - * brealname:join
bind raw - 311 brealname:check

proc brealname:join {nick uhost hand chan} { 
 global botnick badrcheck
  if {([lsearch -exact [split [string tolower $badrcheck]] [string tolower $chan]] != -1) && (![string equal -nocase $botnick $nick]) && (![matchattr $hand of|fo $chan])} {
  putserv "WHOIS $nick"; return 0
  }
}

proc brealname:check {from keyword arg} {
 global botnick badrcheck badrlist badrkick badrtime
  set realname [string tolower [ctrl:filter [lindex [lrange [split $arg ":"] 1 end] 0]]]
  set nick [lindex $arg 1]; set uhost [getchanhost $nick]
  foreach realnamechan [string tolower $badrcheck] {
   if {([botisop $realnamechan]) && (![isop $nick $realnamechan]) && (![isvoice $nick $realnamechan]) && ([onchan $nick $realnamechan])} {
   foreach name [string tolower $badrlist] {
   if {([string match -nocase *$name* $realname])} {
    putserv "MODE $realnamechan +b *!*@[lindex [split $uhost "@"] 1]"
    putserv "KICK $chan $realnamechan :$badrkick"
    timer $badrtime "pushmode $chan -b *!*@[lindex [split $uhost "@"] 1]"
    return 1
    }
   }
  }
 }
}

proc ctrl:filter {str} {
  regsub -all -- {\003([0-9]{1,2}(,[0-9]{1,2})?)?|\017|\037|\002|\026|\006|\007} $str "" str
  return $str
}

WeiJie · Post by **WeiJie** » Fri Sep 10, 2004 9:33 am

Mmm... Thanks alot abt the code... But right now i have another problem... I searching for a TCL which kick and ban user out when they have bad nickname... But all of the TCLs i've found doesn't spare Ops, flagged or voiced user at all...

Any recommend script/TCL anyone?