194,6667,6660-7000 - Pentesting IRC

Reading time: 3 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Basic Information

IRC, initially a plain text protocol, was assigned 194/TCP by IANA but is commonly run on 6667/TCP and similar ports to avoid needing root privileges for operation.

A nickname is all that's needed to connect to a server. Following connection, the server performs a reverse-DNS lookup on the user's IP.

Users are divided into operators, who need a username and password for more access, and regular users. Operators have varying levels of privileges, with administrators at the top.

Default ports: 194, 6667, 6660-7000

PORT STATE SERVICE 6667/tcp open irc

Enumeration

IRC can support TLS.

bash
nc -vn <IP> <PORT> openssl s_client -connect <IP>:<PORT> -quiet

Manual

Here you can see how to connect and access the IRC using some random nickname and then enumerate some interesting info. You can learn more commands of IRC here.

bash
#Connection with random nickname USER ran213eqdw123 0 * ran213eqdw123 NICK ran213eqdw123 #If a PING :<random> is responded you need to send #PONG :<received random> VERSION HELP INFO LINKS HELPOP USERCMDS HELPOP OPERCMDS OPERATOR CAPA ADMIN #Admin info USERS #Current number of users TIME #Server's time STATS a #Only operators should be able to run this NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro LIST #List channel names along with channel banner WHOIS <USERNAME> #WHOIS a username USERHOST <USERNAME> #If available, get hostname of a user USERIP <USERNAME> #If available, get ip of a user JOIN <CHANNEL_NAME> #Connect to a channel #Operator creds Brute-Force OPER <USERNAME> <PASSWORD>

You can, also, atttempt to login to the server with a password. The default password for ngIRCd is wealllikedebian.

bash
PASS wealllikedebian NICK patrick USER test1 test2 <IP> :test3

Find and scan IRC services

bash
nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 <ip>

Brute Force

Shodan

  • looking up your hostname

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks