help me with this regex please (anti xploiT DCC)

[Sedition]

good morning I would like all that they help me with this regex to extract of unreal it is an excellent anti dcc xploit

regex "\x01DCC (SEND|RESUME)[ ]+\"(.+ ){20}"

and the attacker uses an exploit that tries to knock down my bot but in partyline its attack goes out for me so:

<(Kantuta> [06:20:00] @#Beni (+tn) : [m/9 o/4 h/0 v/0 n/5 b/0 e/- I/-]
<(Kantuta> [06:20:35] [miguelito!~miguelito@xx.xx.xx.xx] DCC SeND "+ w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w + w

try to arm the tcl but it me does not work someone please who helps me is so that it detects the attack xploit and punishes it

Code: Select all

bind CTCP - DCC handle_exploit
proc handle_exploit {nick uhost hand dest key arg} {
if {[regexp {(SEND|RESUME)[ ]+\"(.+ ){20}} $arg]} {
 foreach chan [channels] {
   pushmode $chan +b "*!*@[lindex [split $uhost "@"] end]"
   putkick $chan $nick "please stop no xploits Dcc."
  }
}
}

please someone who helps me with this code would be grateful to him very much


////////////////// /////////////////////////

I found another tcl that should stamp on users who send exploits in texts, installed it but it does not work

Code: Select all

bind ctcp -|- "DCC" satmd_botnet_antidccbug_ctcp

proc satmd_botnet_antidccbug_ctcp { nick uhost handle dest keyword text } {
global botnick
set dcc_type [string toupper [lindex $text 0]]
if { $dcc_type == "SEND" && ( [string length $text] > 200 || [satmd_botnet_antidccbug_count $text " "] > 20) } {
putloglev "cmdw1" "*" "mIRC DCC SEND exploit detected @ $nick!$uhost/$handle:$dest"
set banmask1 "$nick!*@*"
set banmask2 "*!*@[lindex [split $uhost @] 1]"
catch { satmd_gban_add $banmask1 $botnick "EXPLOIT: mIRC DCC SEND" }
catch { satmd_gban_add $banmask2 $botnick "EXPLOIT: mIRC DCC SEND" }
satmd_botnet_gban_add "$banmask1" "90d" "antidccbug@$botnick" "$botnick" "mIRC DCC exploit detected" 1
satmd_botnet_gban_add "$banmask2" "15d" "antidccbug@$botnick" "$botnick" "mIRC DCC exploit detected" 1
return 1
}
return 0
}

only I want that it detects the attack and stamps on the user but it attacks dcc xploits of texts

[Sedition]

final code

Code: Select all

## This tcl kicked that attack xploit via dcc your eggdrop ##
## my nicks in DALnet: [b]Arnold_X-P[/b] and [b]Sedition[/b] emial: urquizoandrade@hotmail.com
## my server  is /server matrix.2ip.us ##

## ban time in minutes ##
set banxploit "4"

## nick admin ##
set memosadmin "sedition"

bind raw - PRIVMSG raw:exploit

proc raw:exploit {from keyword args} {
global banxploit memosadmin
  set args [string trim $args "{}"]
  if {[regexp -nocase {(SEND|RESUME).*"(?:[^" ]*\s){32}.*$} $args]} {
  set banmask *!*@[lindex [split $from @] 1] 
  set nick [lindex [split $from "!"] 0]
  foreach chan [channels] { 
   newchanban $chan $banmask Exploit "You cannot attack me with its dirty Exploits, high place." $banxploit
   }
    putserv "ms send $memosadmin owner I was attacked by Xploits for 4$nick 7($from) in date of 1(4[strftime %d/%b/%Y@%H:%M]1)."    
    putlog "1\[4ALERTA1\] is detected Attack DCC SEND Xploit for $nick ($from) Proceeding to stamp."
	return 0 
 }
}

[caesar]

This subject has been discussed a long time ago, look at converting a regex from mirc to TCL