drone script not kicking drones

Xeon · Post by **Xeon** » Tue Dec 20, 2005 6:32 pm

Hello,

I've been working on a drone script which was originally created by awyeah called dronenick.tcl. So far this script has only kicked one drone despite the fact that I have lowered the thresholds within the script to try and detect these drones, hundreds of drones have gotten past it.

Has anyone had any experience with this script that could help me determine how to set it for our particular drones or if you've developed a better regexp to be used with this script could you pass along the information you've gleaned?

Here is a partial list of some of the drones we are encountering. Hopefully someone here can help me develop a better regexp or something similiar that will help make this script work more effectively.

List of drone /whois:

fqjtgldl is fqjtgldl!wyspqet@54A8D473.F65DEAB9.C52F060.IP
fqjtgldl's real name: ltwuw

lzrhck is lzrhck!zltcvxd@23F59026.BB089248.FD48FE29.IP
lzrhck's real name: yxjoseke

ozirknliw is ozirknliw!rmbr@7DD740F1.EA80AF5A.F4C40CD8.IP
ozirknliw's real name: nbvemcjpj

Any and all help here would be greatly appreciated.

BTW, this particular script can be found right here at egghelp.org within their tcl archive.

demond · Post by **demond** » Tue Dec 20, 2005 11:25 pm

try out xchannel

it has an effective (I think) anti-drone fuzzy logic, play with score threshold to suit your needs; of course, it will never be 100% effective, but if you can achieve like 80% you can call it success

Post by **Sir_Fz** » Wed Dec 21, 2005 7:05 am

Check out the method used in allprotection perfect for the example nicks you gave. (will improve in 4.6)

Xeon · Post by **Xeon** » Wed Dec 21, 2005 4:26 pm

Ok I'll give them both a try, I've been modifying the dronenick.tcl by awyeah to try and get results but it's missing 99% of all these drones. These drone producers are getting trickier with their bots and modifying them so that these scripts stop working.

When is your 4.6 version going to be out Sir_Fz?

Thanks for both these suggestions, I appreciate it a lot.

BTW Sir_Fz, the link to allprotections you have above is timing out.

Thanks,

Xeon

Post by **Sir_Fz** » Wed Dec 21, 2005 5:11 pm

4.6 is being tested right now but is looking good, should be released by the year 2006 (which is very soon

) as for the link, I noticed that people are not being able to access it (although I can

) so use this instead.

Xeon · Post by **Xeon** » Thu Dec 22, 2005 6:15 am

After taking a look at the allprotections script, it appears that the regexp used there for drone detection won't work in the case of the drones we are seeing.

Correct me if I'm wrong but it looks like you are relying on the drones not having any vowels and that just won't work here since they all DO have vowels.

I'm also not interested in having this huge script with all the other things in it. I only want a script that does the drone detection. I'll try and test the script against the drones we are seeing but I'm pretty sure that it's not going to work against them.

Thanks,

Xeon · Post by **Xeon** » Thu Dec 22, 2005 7:52 am

I'm seeing massive tcl errors with the allprotection.tcl script. They are as follows:

[03:50] Tcl error [btext:chars]: can't read "o": no such variable
[03:50] Tcl error [btext:line]: can't read "o": no such variable
[03:50] Tcl error [repeat:kick]: can't read "o": no such variable
[03:50] Tcl error [caps:kick]: can't read "p": no such variable
[03:50] Tcl error [text:char]: can't read "o": no such variable
[03:50] Tcl error [text:line]: can't read "o": no such variable
[03:50] Tcl error [caps:action]: can't read "p": no such variable
[03:50] Tcl error [char:action]: can't read "o": no such variable
[03:50] Tcl error [text:action]: can't read "o": no such variable

Suggestions?

nANDu · Post by **nANDu** » Thu Dec 22, 2005 8:24 am

Code: Select all


proc checkdrone {n u h c} { 
  global droneip
  if {(![botisop $c]) || ([matchattr $h of|of])} {return}
  scan $u %\[^@\]@%s u host
  set u [string trimleft $u ~]
  if {([info exists droneip($n)]) || ([string length $n] < 5) || ([string length $n] > 11) || ([string length $u] < 4)} {return}
  if {([string is alpha $n]) && ([string is alpha $u])} {
     if {([check:drone $n] == 1) && ([check:drone $u] == 1)} {
        putquick "KICK $c $n :DRONE!!" -next
     }
     if {![info exists droneip($n)]} {set droneip($n) 0}
     timer 300 [list unset droneip($n)]
  }
}
proc check:drone {d} {
  set l2 [string length $d] ; set l3 [expr [expr $l2/2]-1]
  set part1 [string range $d 0 2] ; set part2 [string range $d end-2 end]  
  set part3 [string range $d $l3 [expr $l3+2]]
  if {([c:d $part1] == 1)||([c:d $part2] == 1)||([c:d $part3] == 1)} {return 1}
  return 0
}
proc c:d {d} {
  set ln [string length $d]
    if {[llength [regexp -all -inline \[aeiou\] $d]] >= 1} {return 0}
    if {[llength [regexp -all -inline (aaa|bbb|ccc|ddd|eee|fff|ggg|hhh|iii|jjj|kkk|lll|mmm|nnn|ooo|ppp|qqq|rrr|sss|ttt|uuu|vvv|www|xxx|yyy|zzz) $d]] >= 2} {return 0}
    return 1
}

It checks for nick!ident.
ex: nicks is split to nic, cks & ick. If any one has no vowel, it will proceed.
If u want to check for nick OR ident

Code: Select all

    if {([check:drone $n] == 1) || ([check:drone $trimud] == 1)} {

It also remembers drone nick for 300 mins. (i.e) Nicks which rejoin doesn't get kicked.

Xeon · Post by **Xeon** » Thu Dec 22, 2005 10:03 am

Great nANDu, I'll give this a try.

Thanks a lot,

BTW Sir_Fz, your script does a good job of detecting the drones we are seeing. I just wish you had yours in just a drone script without all the other stuff.

Thanks to you as well for putting the effort into the one you have, it looks like a really good script.

Take care,

Xeon

Post by **Sir_Fz** » Thu Dec 22, 2005 12:43 pm

You need to .restart, not just .rehash, after loading allprotection. If you don't want the other protections then just disable them.

awyeah · Post by **awyeah** » Fri Dec 23, 2005 12:32 am

Actually my script incorporates all types of drone nick detection mechanisms I had found through the past months making a couple of my own, getting some from other people which I had seen and so. Using complex matching, regexp and normal matching and detecting drones based on "nick!ident" scores and so.

I've used it on DALnet like on very happening channels such as #india and so and to my surprise the accuracy of the script was 90%-95% with only a few innocent users being kicked.

My bots still use the same script and detect and remove all types of random nicks encountered.

Post by **caesar** » Fri Dec 23, 2005 4:34 pm

Could you guys just send the users to the TCL Archive without competing and recommanding your script as beeing *the best* .. just let the user decide upon what tcl script to stick.

metroid · Post by **metroid** » Fri Dec 23, 2005 5:41 pm

I agree, it's abit crappy to see xchannel/allprotection get recommended in just about every post made in this section of the forum

Alchera · Post by **Alchera** » Fri Dec 23, 2005 6:36 pm

MeTroiD wrote:I agree, it's abit crappy to see xchannel/allprotection get recommended in just about every post made in this section of the forum

In just about every section; not just this.

Post by **Sir_Fz** » Fri Dec 23, 2005 9:18 pm

I don't see xchannel/allprotection being recommended in this post though, he asked for drone checking techniques and he was directed to that. Very sad you feel that way heh