Jupiter ♃

internet relay chat botnet for efnet

"let the battle of the +oooo -oooo commence"

Information

Jupiter will create a botnet by connecting a defined number of clones to every EFNet server. A single host could potentially create close to 100 clones without any suspicion. It is meant to monitor/jupe/hold nicks & be controlled to do just about anything.

For example, at the time of writing this, there are 12 active EFNet servers. With 3 clones per-server on IPv4 connections, plus another 3 clones per-server on IPv6 connections, thats 6 clones per-server, equating to 72 total clones...all from a single machine. Run this bot on multiple machines, you get the point.

Any server with SSL/TLS ports opened, will be connected using SSL/TLS. If using SSL/TLS to connect fails, it will fall back to a standard connection on port 6667 & will try an SSL/TLS again next time. When IPv6 is enabled, Servers with IPv6 support will be connected to with both IPv4 & IPv6 clones. Juping is handled using MONITOR to watch for nick changes or quits. The bots will also join a backup channel in-case the main channel gets killed & you need to find your bots. The backup channel is suffixed with random numbers & can be searched for from doing /LIST.

The bot is designed to be very minimal, secure, & trustless by nature. This means anyone can run a copy of your script on their server to help build your botnet.

It is highly recommended that you use a random spoofing ident protocol daemon

Commands

Command	Description
`5000 <chan>`	Emulates SuperNETs #5000 channel (Join #5000 on irc.supernets.org for help using this command)
`id`	Send bot identity
`raw [-d] <data>`	Send `<data>` to server, optionally delayed with -d argument
`relay <chan>`	Relay all data from `<chan>` into the bot channel (Can not use @all & must join channel via `raw` first)
`relay stop`	Stop the relay (Will not turn off from kicks, etc)
`monitor list`	Return MONITOR list
`monitor reset`	Reset MONITOR list
`monitor <+/-><nicks>`	Add (+) or Remove (-) `<nicks>` from MONITOR list. (Can be a single nick or comma seperated list)
`sync`	Sync the bot list (Handled automatically but good practice to sync occasionally)

Note: All commands must be prefixed with @all or the bots nick & will work in a channel or private message.

Raw data must be IRC RFC compliant data & any nicks in the MONITOR list will be juped as soon as they become available.

EFNet Network Map

This is an accurate map of the EFNet IRC network as of 05/19/2023:

Host	DNS
128.39.65.230	irc.underworld.no
130.226.213.194	efnet.deic.eu
130.243.52.250	irc.du.se
185.100.59.59	irc.efnet.nl
188.240.145.90	irc.swepipe.se
195.140.202.142	efnet.port80.se
195.159.90.90	irc.homelien.no
198.47.99.99	irc.mzima.net
198.252.144.2	irc.colosolutions.net
209.222.22.22	irc.choopa.net
66.225.225.225	irc.servercentral.net
67.218.118.62	irc.Prison.NET
2001:16d8:aaaa:2::1338	efnet.port80.se
2001:668:117::dead:beef:cafe	irc.mzima.net
~~2001:1838:1007::6667~~	unknown or offline (was in the irc.efnet.org roundrobin)
2001:19f0::dead:beef:cafe	irc.choopa.net
2001:6b0:78::90	irc.swepipe.se
2001:67c:12d8::6667	irc.efnet.nl
2001:700:3100:1::babe	irc.underworld.no
2001:840:0:1000:1::1	irc.homelien.no
2001:878:0:e000:82:e2:d5:c2	efnet.deic.eu
~~2001:948:7:7::139~~	unknown or offline (was in the irc.efnet.org roundrobin)

Note: Not every host is included in the irc.efnet.org roundrobin!

Todo

Ability to set admin/channel on the fly (requested by delorean)
Built in identd server with randomized spoofing responses
Improved protections (Remove bans placed on bots, retaliate on KICK & +b)
Invite clones to +i channels
Takeover attack features
Possibly use only one connection per-server & create clones on multiple command / destroy clones on destroy command. (No point in having clones when we arent doing anything with them)
Compile a list of common CTCP VERSION replies to improve the random CTCP VERSION responses
WHO channel and parse unique hosts to +eI usage

Mirrors

acid.vegas • GitHub • GitLab • SuperNETs

6.6 KiB Raw Blame History