IRC Bot Hunters
a collection of Metasploit PoC exploits for IRC Botnets that takes over the owner of a bot which then allows Remote Code Execution. Most IRC Botnets can be taken over by using their herders’ usernames or by triggering a certain command which does shell execution. Almost all of the modules here have been accepted in the Metasploit repository. If you are looking for C&C exploit modules or pwning backdoors like r57 / c99 shell, I have also made some modules which I have pushed in the main msf repository.
Accepted Metasploit Modules:
w3tw0rk / Pitbul IRC Bot Remote Code Execution – https://www.rapid7.com/db/modules/exploit/multi/misc/w3tw0rk_exec
Legend Perl IRC Bot Remote Code Execution – https://www.rapid7.com/db/modules/exploit/multi/misc/legend_bot_exec
Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution – https://www.rapid7.com/db/modules/exploit/multi/misc/xdh_x_exec
PHP IRC Bot pbot eval() Remote Code Execution (Credited Only) – https://www.rapid7.com/db/modules/exploit/multi/misc/pbot_exec
References:
w3tw0rk / Pitbull Perl IRC Bot Remote Code Execution PoC Exploit – https://www.exploit-db.com/exploits/36652/
Legend Perl IRC Bot – Remote Code Execution – https://www.exploit-db.com/exploits/36836/
Want an IRC bot pwned or you have an exploit for an IRC bot that you want to be ported to msf? Contact Jay Turla at [email protected]
