Problem with Mass Join Clone Kicker Script.

awyeah · Post by **awyeah** » Sat May 22, 2004 6:04 pm

Hello,

I have developed this script from algol's clonepro tcl
which is quite alike. He had sticky bans in it newchanban
which I didnt like, and I wanted to make normal user channel
bans.

The script executes fine, after changing the utimer variable
as mentioned by someone, because this script has a vulnerability
but it works excellent now.

The only problem I am facing is, that it doesn't kick out all the
clones. Here is the script.

Code: Select all

# The channels you want this script active on
set cp_chans "#eleet"

# Number of *!*@host joins in how many seconds, joins:seconds
set cp_j_flood 2:5

# Number of *!*user@host join/part cycles in how many seconds, j/p_cycles:seconds
set cp_jp_flood 2:8

# Period in minutes to ban *!*@host for multiple joins or join/part floods
set clone_btime 10


##### DON'T edit anything below this line unless you know what you're doing #####

bind join - * clone_pro_join
bind part - * clone_pro_leave
bind sign - * clone_pro_leave

proc clone_pro_join {nick uhost hand chan} {
	global cp_chans cp_j_flood cp_jp_flood cp_host_count cp_uh_count clone_btime
	set uhost [string tolower $uhost]
	set host [lindex [split $uhost @] 1]
	set chan [string tolower $chan]
	set file [open $::kickno r]
	set tilnow "[gets $file]"
	catch {close $file}
	set totalkicks [expr $tilnow]
      set cloneban "*!*@[lindex [split $uhost @] 1]"
	if {[lsearch -exact $cp_chans $chan] == -1} {return 0}
	if {![info exists cp_host_count($host:$chan)]} {
		set cp_host_count($host:$chan) 1
	} else {
		incr cp_host_count($host:$chan)
	}
	utimer [lindex $cp_j_flood 1] [list cp_expire cp_host_count($host:$chan)]
	if {$cp_host_count($host:$chan) > [lindex $cp_j_flood 0]} {
            if {[botisop $chan]} {
      		putquick "MODE $chan +b $cloneban"
			timer $clone_btime "pushmode $chan -b $cloneban"
 			set mask "*!*@[lindex [split $uhost @] 1]"
			set list [list] 
			  foreach user [chanlist $chan] { 
			    if {[string equal -nocase $user $nick]} { continue } 
			    if {[string match -nocase $mask "${nick}![getchanhost $user $chan]"]} { lappend list $user }
			  } 
			  putserv "KICK $chan [join $list {,}] :0,1 Excessive Clone/Botnet Kick 12,0 - 12Detected 2*3 or more* 12clients with the 2host $cloneban 12joining in here, in 2less than 4 secs. 2Excessive Clones 12and 2Botnets 12are 2not allowed 12to 2enter this channel, 12if done so further more 2your host 12will be 2banned permanently.2 - (Kick #$totalkicks)"
		}
    }
	if {![info exists cp_uh_count($uhost:$chan)]} {
		set cp_uh_count($uhost:$chan) 1
	} else {
		incr cp_uh_count($uhost:$chan)
	}
	utimer [lindex $cp_jp_flood 1] [list cp_expire cp_uh_count($uhost:$chan)]
	if {$cp_uh_count($uhost:$chan) >= [expr [lindex $cp_jp_flood 0]*2]} {
            if {[botisop $chan]} {
      		putquick "MODE $chan +b $cloneban"
      		putquick "KICK $chan $nick :0,1 Mass Join/Part Flood Kick 12,0 - 12Detected 2multiple 12clients in here, with the 2host $cloneban 12performing2 *more than 3* join/part cycles,12 in less than2 10 secs. 2Mass Join/Part floods 12by 2botnets 12are 2prohibited in here, 12if done so further more 212you will be 2banned permanently 12from this 2network/channel.2 - (Kick #$totalkicks)"
		      timer $clone_btime "pushmode $chan -b $cloneban"
		}
	}
}

And here, is a some testing I did with it

Code: Select all

* Joins: Woaaaaaah (goodguy@219.92.24.5)
* Joins: RocketScientist (goodguy@219.92.24.5)
* Joins: Shakeel- (goodguy@219.92.24.5)
* adapter sets mode: +b *!*@219.92.24.5
* Woaaaaaah was kicked by adapter ( Excessive Clone/Botnet Kick  - Detected *3 or more* clients with the host *!*@219.92.24.5 joining in here, in less than 4 secs. Excessive Clones and Botnets are not allowed to enter this channel, if done so further more your host will be banned permanentl)
* RocketScientist was kicked by adapter ( Excessive Clone/Botnet Kick  - Detected *3 or more* clients with the host *!*@219.92.24.5 joining in here, in less than 4 secs. Excessive Clones and Botnets are not allowed to enter this channel, if done so further more your host will be banned permanentl)
* awyeah sets mode: -b *!*@219.92.24.5

It didn't seem to kick the, third clone joining in, which was the nick "Woaaaaah".

I've tried many output combinations with the list, and the putkick commands, but it only kicks two people, not three, I dont understand.

I've also tried changining the timer settings, from the variables, in the setting options to flexibility in seconds as well, but still not yet. It doesnt seem to kick out all the clones of the host.

Please help me.

greenbear · Post by **greenbear** » Sun May 23, 2004 10:57 am

Try with a shorter kick msg, you might trigger some anti-flood setting with it being so long.

Set your bots +enforcebans

Hope this helps.

awyeah · Post by **awyeah** » Sun May 23, 2004 11:05 am

Actually I don't want enforce bans on.

The bot monitors a channel exceeding
200-300 users and it can cause a chaos
using enforce bans. Like most people
are on from cafe's with static Ip's as well.

But anyway, OK I will try a smaller kick
message just to test it out. But the script
is okay right, It cound'nt have been better
especially the $list and the lappend list $user
section.

How if I do this,

Code: Select all

..............
..............
         channel set $chan +enforcebans
         putquick "MODE $chan +b $cloneban" 
         timer $clone_btime "pushmode $chan -b $cloneban"
         channel set $chan -enforcebans
..............
..............

What do you think, would this kick out all the clones that joined in fast succession, in that period of time?

Nucleus · Post by **Nucleus** » Thu Apr 21, 2005 2:06 am

awyeah, did you find the solution to the problem? I would like to use this script.

Post by **Sir_Fz** » Thu Apr 21, 2005 9:03 am

lappend the nicks in an array (i.e. clones($host:$chan)) then foreach nick of the array, kick them.

PS: It was me who posted this script for check if there's a volnurability in it, and user found it

awyeah · Post by **awyeah** » Thu Apr 21, 2005 10:00 am

Nucleus:
Not really much, there are 2-3 ways of detecting clones. One if anyone joins scan the chan userlist for and if more than your defined number of people match that mask kick all of them out -- fairly easy I say.

The other one is, mass joins if particular number of hosts join within or less than the time peroid in seconds you have defined. I have reduced kick messages, my bot is mostly slow, since I have lots of other tcls in progress also with it. The script pasted above does catch on join flooders.

However these bots do join fast, my recommendation the smaller and well written the code is, the more efficient and faster it will execute, try to ban all ips first then kick them out delayed or later if you don't want the bot to get excess flood, and try to lock the chan immediately after you detect, then ban and kick etc.

Also try to get a shell provider with high uplink speed, for faster connectivity, so your bot reacts fast.

Sir_Fz:
Well it works quite good, lappend is really not needed since, we are detecting similar hosts here. Like the repeat one you did a while ago on the forum from different hosts, that one would have lappend in handy. But even if you scan the chan for the mass joining host you can easily catch all I guess, you dont really need to save all of the mass joining nicks into a list.

sKy · Post by **sKy** » Thu Apr 21, 2005 11:50 am

Please tell me exact what the script should do.

You want to remove clones on channel which just sitting on (and join slow before). ? I think no.

You want to ban a user which join in short time some clones from his ip in your channel?
Example:

cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
....

Or you want ban flooders which join with some hosts from same subnet?
Example:

cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
cYpwOo1 (~chatzilla@13.104.99-85.rev.gaoland.net) has joined #channel
cYpwOo2 (~chatzilla@13.104.99-86.rev.gaoland.net) has joined #channel

Or for join/part/quit flood?

I can`t fix the bug (because i code in another style) but i will try to make a new script.

Post by **Sir_Fz** » Thu Apr 21, 2005 5:58 pm

If you just use putquick "kick ...." then ofcourse the bot will only kick the last joining nick since the code triggered on him (clone count became > than it should be). Thus, if you lappend the nicks to an array ($host:$chan) as the counter's, you can simply kick all the nicks in this array when the offence is reached.