Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-irc.md
Translator workflow a21a0e7217 Translated to Chinese
2023-08-03 19:12:22 +00:00

7 KiB
Raw Blame History

194,6667,6660-7000 - Pentesting IRC

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

基本信息

IRC最初是一个纯文本协议（尽管后来扩展了功能），在请求后被分配了IANA的194/TCP端口。然而，事实上的标准一直是在6667/TCP和附近的端口号上运行IRC（例如TCP端口6660-6669、7000），以避免必须以root权限运行IRCd软件。

连接到服务器只需要一个昵称。一旦连接建立，服务器首先会对你的IP进行反向DNS查询：

总体上看，有两种类型的用户：操作员和普通用户。要登录为操作员，需要一个用户名和一个密码（在许多情况下还需要特定的主机名、IP甚至特定的主机掩码）。在操作员中，有不同的特权级别，其中管理员拥有最高特权。

**默认端口：**194、6667、6660-7000

PORT     STATE SERVICE
6667/tcp open  irc

枚举

横幅

IRC可以支持TLS。

nc -vn <IP> <PORT>
openssl s_client -connect <IP>:<PORT> -quiet

手动

在这里，您可以看到如何使用一些随机昵称连接和访问IRC，然后枚举一些有趣的信息。您可以在这里了解更多IRC命令。

#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING :<random> is responded you need to send
#PONG :<received random>

VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN      #Admin info
USERS      #Current number of users
TIME       #Server's time
STATS a    #Only operators should be able to run this
NAMES      #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST       #List channel names along with channel banner
WHOIS <USERNAME>      #WHOIS a username
USERHOST <USERNAME>   #If available, get hostname of a user
USERIP <USERNAME>     #If available, get ip of a user
JOIN <CHANNEL_NAME>   #Connect to a channel

#Operator creds Brute-Force
OPER <USERNAME> <PASSWORD>

你也可以尝试使用密码登录服务器。ngIRCd的默认密码是'wealllikedebian'。

PASS wealllikedebian
NICK patrick
USER test1 test2 <IP> :test3

查找和扫描IRC服务

To find and scan IRC services, you can use various tools and techniques. Here are some steps you can follow:

  1. Port scanning: Use a port scanning tool like Nmap to identify open ports on the target system. IRC services typically use port 6667 or 6697 for SSL/TLS connections.

  2. Banner grabbing: Once you have identified the open ports, you can use tools like Telnet or Netcat to connect to the IRC service and retrieve the banner. The banner often contains information about the IRC server and its version.

  3. Enumeration: Use IRC enumeration tools like IRCSniff or IRCSpy to gather information about the IRC channels, users, and server configuration. These tools can help you identify potential vulnerabilities or misconfigurations.

  4. Brute-forcing: If you have valid usernames or nicknames, you can use tools like Hydra or Medusa to perform brute-force attacks and attempt to guess passwords for IRC accounts.

  5. Exploitation: Once you have gathered enough information, you can search for known vulnerabilities in the IRC server software or plugins. Exploiting these vulnerabilities can give you unauthorized access to the IRC server or compromise user accounts.

Remember to always obtain proper authorization before performing any scanning or testing activities. Unauthorized access to IRC services or any other system is illegal and unethical.

nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 <ip>

暴力破解

Shodan

  • 查找你的主机名
☁️ HackTricks 云 ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥