| View previous topic :: View next topic |
| Author |
Message |
awyeah Revered One

Joined: 26 Apr 2004 Posts: 1580 Location: Switzerland
|
Posted: Sat May 22, 2004 6:04 pm Post subject: Problem with Mass Join Clone Kicker Script. |
|
|
Hello,
I have developed this script from algol's clonepro tcl
which is quite alike. He had sticky bans in it newchanban
which I didnt like, and I wanted to make normal user channel
bans.
The script executes fine, after changing the utimer variable
as mentioned by someone, because this script has a vulnerability
but it works excellent now.
The only problem I am facing is, that it doesn't kick out all the
clones. Here is the script.
| Code: |
# The channels you want this script active on
set cp_chans "#eleet"
# Number of *!*@host joins in how many seconds, joins:seconds
set cp_j_flood 2:5
# Number of *!*user@host join/part cycles in how many seconds, j/p_cycles:seconds
set cp_jp_flood 2:8
# Period in minutes to ban *!*@host for multiple joins or join/part floods
set clone_btime 10
##### DON'T edit anything below this line unless you know what you're doing #####
bind join - * clone_pro_join
bind part - * clone_pro_leave
bind sign - * clone_pro_leave
proc clone_pro_join {nick uhost hand chan} {
global cp_chans cp_j_flood cp_jp_flood cp_host_count cp_uh_count clone_btime
set uhost [string tolower $uhost]
set host [lindex [split $uhost @] 1]
set chan [string tolower $chan]
set file [open $::kickno r]
set tilnow "[gets $file]"
catch {close $file}
set totalkicks [expr $tilnow]
set cloneban "*!*@[lindex [split $uhost @] 1]"
if {[lsearch -exact $cp_chans $chan] == -1} {return 0}
if {![info exists cp_host_count($host:$chan)]} {
set cp_host_count($host:$chan) 1
} else {
incr cp_host_count($host:$chan)
}
utimer [lindex $cp_j_flood 1] [list cp_expire cp_host_count($host:$chan)]
if {$cp_host_count($host:$chan) > [lindex $cp_j_flood 0]} {
if {[botisop $chan]} {
putquick "MODE $chan +b $cloneban"
timer $clone_btime "pushmode $chan -b $cloneban"
set mask "*!*@[lindex [split $uhost @] 1]"
set list [list]
foreach user [chanlist $chan] {
if {[string equal -nocase $user $nick]} { continue }
if {[string match -nocase $mask "${nick}![getchanhost $user $chan]"]} { lappend list $user }
}
putserv "KICK $chan [join $list {,}] :0,1 Excessive Clone/Botnet Kick 12,0 - 12Detected 2*3 or more* 12clients with the 2host $cloneban 12joining in here, in 2less than 4 secs. 2Excessive Clones 12and 2Botnets 12are 2not allowed 12to 2enter this channel, 12if done so further more 2your host 12will be 2banned permanently.2 - (Kick #$totalkicks)"
}
}
if {![info exists cp_uh_count($uhost:$chan)]} {
set cp_uh_count($uhost:$chan) 1
} else {
incr cp_uh_count($uhost:$chan)
}
utimer [lindex $cp_jp_flood 1] [list cp_expire cp_uh_count($uhost:$chan)]
if {$cp_uh_count($uhost:$chan) >= [expr [lindex $cp_jp_flood 0]*2]} {
if {[botisop $chan]} {
putquick "MODE $chan +b $cloneban"
putquick "KICK $chan $nick :0,1 Mass Join/Part Flood Kick 12,0 - 12Detected 2multiple 12clients in here, with the 2host $cloneban 12performing2 *more than 3* join/part cycles,12 in less than2 10 secs. 2Mass Join/Part floods 12by 2botnets 12are 2prohibited in here, 12if done so further more 212you will be 2banned permanently 12from this 2network/channel.2 - (Kick #$totalkicks)"
timer $clone_btime "pushmode $chan -b $cloneban"
}
}
}
|
And here, is a some testing I did with it
| Code: |
* Joins: Woaaaaaah (goodguy@219.92.24.5)
* Joins: RocketScientist (goodguy@219.92.24.5)
* Joins: Shakeel- (goodguy@219.92.24.5)
* adapter sets mode: +b *!*@219.92.24.5
* Woaaaaaah was kicked by adapter ( Excessive Clone/Botnet Kick - Detected *3 or more* clients with the host *!*@219.92.24.5 joining in here, in less than 4 secs. Excessive Clones and Botnets are not allowed to enter this channel, if done so further more your host will be banned permanentl)
* RocketScientist was kicked by adapter ( Excessive Clone/Botnet Kick - Detected *3 or more* clients with the host *!*@219.92.24.5 joining in here, in less than 4 secs. Excessive Clones and Botnets are not allowed to enter this channel, if done so further more your host will be banned permanentl)
* awyeah sets mode: -b *!*@219.92.24.5
|
It didn't seem to kick the, third clone joining in, which was the nick "Woaaaaah".
I've tried many output combinations with the list, and the putkick commands, but it only kicks two people, not three, I dont understand.
I've also tried changining the timer settings, from the variables, in the setting options to flexibility in seconds as well, but still not yet. It doesnt seem to kick out all the clones of the host.
Please help me. _________________ ·awyeah·
==================================
Facebook: jawad@idsia.ch (Jay Dee)
PS: Guys, I don't accept script helps or requests personally anymore.
================================== |
|
| Back to top |
|
 |
greenbear Owner
Joined: 24 Sep 2001 Posts: 733 Location: Norway
|
Posted: Sun May 23, 2004 10:57 am Post subject: |
|
|
Try with a shorter kick msg, you might trigger some anti-flood setting with it being so long.
Set your bots +enforcebans
Hope this helps. |
|
| Back to top |
|
 |
awyeah Revered One

Joined: 26 Apr 2004 Posts: 1580 Location: Switzerland
|
Posted: Sun May 23, 2004 11:05 am Post subject: |
|
|
Actually I don't want enforce bans on.
The bot monitors a channel exceeding
200-300 users and it can cause a chaos
using enforce bans. Like most people
are on from cafe's with static Ip's as well.
But anyway, OK I will try a smaller kick
message just to test it out. But the script
is okay right, It cound'nt have been better
especially the $list and the lappend list $user
section.
How if I do this,
| Code: |
..............
..............
channel set $chan +enforcebans
putquick "MODE $chan +b $cloneban"
timer $clone_btime "pushmode $chan -b $cloneban"
channel set $chan -enforcebans
..............
..............
|
What do you think, would this kick out all the clones that joined in fast succession, in that period of time? _________________ ·awyeah·
==================================
Facebook: jawad@idsia.ch (Jay Dee)
PS: Guys, I don't accept script helps or requests personally anymore.
================================== |
|
| Back to top |
|
 |
Nucleus Voice
Joined: 09 Jul 2004 Posts: 34
|
Posted: Thu Apr 21, 2005 2:06 am Post subject: |
|
|
| awyeah, did you find the solution to the problem? I would like to use this script. |
|
| Back to top |
|
 |
Sir_Fz Revered One

Joined: 27 Apr 2003 Posts: 3793 Location: Lebanon
|
Posted: Thu Apr 21, 2005 9:03 am Post subject: |
|
|
lappend the nicks in an array (i.e. clones($host:$chan)) then foreach nick of the array, kick them.
PS: It was me who posted this script for check if there's a volnurability in it, and user found it  _________________ Follow me on GitHub
- Opposing
Public Tcl scripts |
|
| Back to top |
|
 |
awyeah Revered One

Joined: 26 Apr 2004 Posts: 1580 Location: Switzerland
|
Posted: Thu Apr 21, 2005 10:00 am Post subject: |
|
|
Nucleus:
Not really much, there are 2-3 ways of detecting clones. One if anyone joins scan the chan userlist for and if more than your defined number of people match that mask kick all of them out -- fairly easy I say.
The other one is, mass joins if particular number of hosts join within or less than the time peroid in seconds you have defined. I have reduced kick messages, my bot is mostly slow, since I have lots of other tcls in progress also with it. The script pasted above does catch on join flooders.
However these bots do join fast, my recommendation the smaller and well written the code is, the more efficient and faster it will execute, try to ban all ips first then kick them out delayed or later if you don't want the bot to get excess flood, and try to lock the chan immediately after you detect, then ban and kick etc.
Also try to get a shell provider with high uplink speed, for faster connectivity, so your bot reacts fast.
Sir_Fz:
Well it works quite good, lappend is really not needed since, we are detecting similar hosts here. Like the repeat one you did a while ago on the forum from different hosts, that one would have lappend in handy. But even if you scan the chan for the mass joining host you can easily catch all I guess, you dont really need to save all of the mass joining nicks into a list. _________________ ·awyeah·
==================================
Facebook: jawad@idsia.ch (Jay Dee)
PS: Guys, I don't accept script helps or requests personally anymore.
================================== |
|
| Back to top |
|
 |
sKy Op

Joined: 14 Apr 2005 Posts: 194 Location: Germany
|
Posted: Thu Apr 21, 2005 11:50 am Post subject: |
|
|
Please tell me exact what the script should do.
You want to remove clones on channel which just sitting on (and join slow before). ? I think no.
You want to ban a user which join in short time some clones from his ip in your channel?
Example:
| Quote: |
cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
....
|
Or you want ban flooders which join with some hosts from same subnet?
Example:
| Quote: |
cYpwOo_ (~chatzilla@13.104.99-84.rev.gaoland.net) has joined #channel
cYpwOo1 (~chatzilla@13.104.99-85.rev.gaoland.net) has joined #channel
cYpwOo2 (~chatzilla@13.104.99-86.rev.gaoland.net) has joined #channel
|
Or for join/part/quit flood?
I can`t fix the bug (because i code in another style) but i will try to make a new script. |
|
| Back to top |
|
 |
Sir_Fz Revered One

Joined: 27 Apr 2003 Posts: 3793 Location: Lebanon
|
Posted: Thu Apr 21, 2005 5:58 pm Post subject: |
|
|
If you just use putquick "kick ...." then ofcourse the bot will only kick the last joining nick since the code triggered on him (clone count became > than it should be). Thus, if you lappend the nicks to an array ($host:$chan) as the counter's, you can simply kick all the nicks in this array when the offence is reached. _________________ Follow me on GitHub
- Opposing
Public Tcl scripts |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|