egghelp.org community

awyeah

I was wondering what binding will be used to check if someone is sending the bot a file? via DCC. I'm looking for file extensions, that I will use regexp later, to find for DCC exploit. Currently I only have this.

Sir_Fz · Posted: Thu May 31, 2007 5:45 pm Post subject:

When someone sends the bot a file, the bot receives a notice containing:

nml375 · Revered One Joined: 04 Aug 2006 Posts: 2857

A notice is not mandatory, and will not work reliably with some clients..
As for raw vs. ctcp bindings, ctcp would probably be easier, as you won't have to extract all the bits and pieces to figure out it's a ctcp-message, or that the keyword is "DCC". Both bindings do allow you to prevent further processing using returncodes.

As for the format of the actual transfer negotiation, it's a ctcp with keyword "DCC" and parameters "SEND <filename> <ipaddress> <port> <filesize>". IP and port are expected to be unsigned integers (aka "longip").

http://www.kvirc.de/docu/doc_dcc_connection.html provides some further info on the dcc subprotocol
_________________
NML_375, idling at #eggdrop@IrcNET

Sir_Fz · Posted: Thu May 31, 2007 8:11 pm Post subject:

Yes indeed, I forgot to mention. So you can do something like:

awyeah · Posted: Sat Jun 02, 2007 3:57 am Post subject:

DALnet is a bit different, dealing with DCC sends on the bahamut IRCd. I tried bind ctcp with DCC as the keyword, got no response when I sent a file to the bot via DCC.

The only response was from Notice. So there are two options either use bind raw with the keyword NOTICE or just simply bind notc. Hence for simplicity I used bind notc.

These were the responses on bind notc when I send a file to the bot.

nml375 · Revered One Joined: 04 Aug 2006 Posts: 2857

Once again, however, I must stress that this notice is mainly a feature of mIRC (and a few other clients). This will most likely not prevent any more advanced viruses utilizing irc to spread itself.

As for using ctcp-binding, It works just fine for me. Which network you are using really should'nt matter at all, as any and all ircd's should simply forward PRIVMSG's from client to client, without interfering or altering the message. Also, not even mIRC will try to recieve a dcc transfer if you simply send the notice (especially since it lacks information on which port to connect to).
_________________
NML_375, idling at #eggdrop@IrcNET

Sir_Fz · Posted: Sat Jun 02, 2007 9:49 am Post subject:

Actually, I tested it on my Eggdrop on DALnet and the ctcp worked just fine. This is what a user receives when a DCC send is requested (raw):

nml375 · Revered One Joined: 04 Aug 2006 Posts: 2857

Oh, also forgot, I doubt this is what you actually intended:

nml375 · Revered One Joined: 04 Aug 2006 Posts: 2857

Ohh, also, when you tried the ctcp-approach, did you make sure you used "DCC" as keyword and nothing else (such as "DCC Send")?
_________________
NML_375, idling at #eggdrop@IrcNET

r0t3n · Owner Joined: 31 May 2005 Posts: 507 Location: UK

Who say's that the file being sent/sender is infected? Maybe it's just a normal user sending a file.....
_________________
r0t3n @ #r0t3n @ Quakenet

awyeah · Posted: Mon Jun 04, 2007 1:54 am Post subject:

awyeah · Posted: Mon Jun 04, 2007 1:56 am Post subject:

awyeah · Posted: Mon Jun 04, 2007 2:05 am Post subject:

awyeah · Posted: Mon Jun 04, 2007 2:14 am Post subject:

This should be the final code:

nml375 · Revered One Joined: 04 Aug 2006 Posts: 2857

Still, $text is not a list, so can't use llength, lindex or lrange here without split.

Never heard of opnotice, but then again I do not use services such as chanserv... However, this being a service, means that it will not trigger notc-bindings, virtually making the @#-matching useless...

I still don't see the point in counting number of dots, as "valid" files seldom would have 4 or more dots, and for someone malicious it'd be merely a matter of adding another dot in the filename.

Finally, would'nt it just be simpler matching something like this?: