5.6 KiB
194,6667,6660-7000 - Pentesting IRC
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
Other ways to support HackTricks:
- If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
- Get the official PEASS & HackTricks swag
- Discover The PEASS Family, our collection of exclusive NFTs
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
- Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
WhiteIntel
WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.
Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.
You can check their website and try their engine for free at:
{% embed url="https://whiteintel.io" %}
Basic Information
IRC, initially a plain text protocol, was assigned 194/TCP by IANA but is commonly run on 6667/TCP and similar ports to avoid needing root privileges for operation.
A nickname is all that's needed to connect to a server. Following connection, the server performs a reverse-DNS lookup on the user's IP.
Users are divided into operators, who need a username and password for more access, and regular users. Operators have varying levels of privileges, with administrators at the top.
Default ports: 194, 6667, 6660-7000
PORT STATE SERVICE
6667/tcp open irc
Enumeration
Banner
IRC can support TLS.
nc -vn <IP> <PORT>
openssl s_client -connect <IP>:<PORT> -quiet
Manual
Here you can see how to connect and access the IRC using some random nickname and then enumerate some interesting info. You can learn more commands of IRC here.
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING :<random> is responded you need to send
#PONG :<received random>
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS <USERNAME> #WHOIS a username
USERHOST <USERNAME> #If available, get hostname of a user
USERIP <USERNAME> #If available, get ip of a user
JOIN <CHANNEL_NAME> #Connect to a channel
#Operator creds Brute-Force
OPER <USERNAME> <PASSWORD>
You can, also, atttempt to login to the server with a password. The default password for ngIRCd is wealllikedebian.
PASS wealllikedebian
NICK patrick
USER test1 test2 <IP> :test3
Find and scan IRC services
nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 <ip>
Brute Force
Shodan
looking up your hostname
WhiteIntel
WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.
Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.
You can check their website and try their engine for free at:
{% embed url="https://whiteintel.io" %}
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
Other ways to support HackTricks:
- If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
- Get the official PEASS & HackTricks swag
- Discover The PEASS Family, our collection of exclusive NFTs
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
- Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.