Awesome

IRC Bot Hunters

a collection of Metasploit PoC exploits I wrote for IRC Botnets that takes over the owner of a bot which then allows Remote Code Execution. Most IRC Botnets can be taken over by using their herders' usernames or by triggering a certain command which does shell execution. Almost all of the modules here have been accepted in the Metasploit repository. If you are looking for C&C exploit modules or pwning backdoors like r57 / c99 shell, I have also made some modules which I have pushed in the main msf repository.

Accepted Metasploit Modules

w3tw0rk / Pitbul IRC Bot Remote Code Execution - https://www.rapid7.com/db/modules/exploit/multi/misc/w3tw0rk_exec

Legend Perl IRC Bot Remote Code Execution - https://www.rapid7.com/db/modules/exploit/multi/misc/legend_bot_exec

Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution - https://www.rapid7.com/db/modules/exploit/multi/misc/xdh_x_exec

PHP IRC Bot pbot eval() Remote Code Execution (Credited Only) - https://www.rapid7.com/db/modules/exploit/multi/misc/pbot_exec

Some References

w3tw0rk / Pitbull Perl IRC Bot Remote Code Execution PoC Exploit - https://www.exploit-db.com/exploits/36652/

Legend Perl IRC Bot - Remote Code Execution - https://www.exploit-db.com/exploits/36836/

Inspiration

• MalwareMustDie!

Request for Metasploit Modules?

Want an IRC bot pwned or you have an exploit for an IRC bot that you want to be ported to msf? Contact me at shipcodez@gmail.com

I am always open for suggestions and new modules as long as you give me details and analysis of a new IRC bot in the wild. Save the world from cavities!!!