194,6667,6660-7000 - Pentesting IRC

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Taarifa za Msingi

IRC, awali protokali ya maandiko rahisi, ilipewa 194/TCP na IANA lakini kawaida inakimbia kwenye 6667/TCP na bandari zinazofanana ili kuepuka hitaji la privileges za mzizi kwa ajili ya uendeshaji.

Jina la utani ndilo linahitajika kuungana na seva. Baada ya kuungana, seva inafanya utafutaji wa reverse-DNS kwenye IP ya mtumiaji.

Watumiaji wanagawanywa katika opereta, ambao wanahitaji jina la mtumiaji na nenosiri kwa ufikiaji zaidi, na watumiaji wa kawaida. Opereta wana viwango tofauti vya mamlaka, huku wasimamizi wakiwa juu kabisa.

Bandari za Kawaida: 194, 6667, 6660-7000

PORT     STATE SERVICE
6667/tcp open  irc

Enumeration

IRC inaweza kusaidia TLS.

bash
nc -vn <IP> <PORT>
openssl s_client -connect <IP>:<PORT> -quiet

Manual

Hapa unaweza kuona jinsi ya kuungana na kufikia IRC kwa kutumia jina la mtumiaji la nasibu na kisha kuhesabu taarifa za kuvutia. Unaweza kujifunza amri zaidi za IRC hapa.

bash
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING :<random> is responded you need to send
#PONG :<received random>

VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN      #Admin info
USERS      #Current number of users
TIME       #Server's time
STATS a    #Only operators should be able to run this
NAMES      #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST       #List channel names along with channel banner
WHOIS <USERNAME>      #WHOIS a username
USERHOST <USERNAME>   #If available, get hostname of a user
USERIP <USERNAME>     #If available, get ip of a user
JOIN <CHANNEL_NAME>   #Connect to a channel

#Operator creds Brute-Force
OPER <USERNAME> <PASSWORD>

Unaweza pia kujaribu kuingia kwenye seva kwa kutumia nenosiri. Nenosiri la kawaida la ngIRCd ni wealllikedebian.

bash
PASS wealllikedebian
NICK patrick
USER test1 test2 <IP> :test3

Pata na skana huduma za IRC

bash
nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 <ip>

Brute Force

Shodan

  • kuangalia jina lako la mwenyeji

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks