menu * { IRCop Tool:IRCopTool } alias IRCopTool { window $+(-,$iif(!$window(@Bot-Tracker),aen1,n1)) @Bot-Tracker dialog -md IRCopTool IRCopTool } dialog IRCopTool { title "IRCop Tool" size -1 -1 317 235 option dbu tab "Bot Finder",13,0 0 317 235 tab "Trace",14 tab "Help",40 text "Idents Added",1,79 66 50 15, tab 13 list 2, 54 73 100 100 vsbar hsbar, tab 13 text "Nicknames Added",3,184 66 50 15, tab 13 list 4, 164 73 100 100 vsbar hsbar, tab 13 button "Add Ident",5,54 168 50 20, tab 13 button "Del Ident",6,104 168 50 20, tab 13 button "Add Nickname",7,164 168 50 20, tab 13 button "Del Nickname",8,214 168 50 20, tab 13 edit "",9,54 188 80 10, tab 13 button "Add",10,134 188 20 10, tab 13 edit "",11,164 188 80 10, tab 13 button "Add",12,244 188 20 10, tab 13 edit "", 15, 59 24 111 10, autohs, tab 14 button "Trace", 16, 176 23 37 12, tab 14 text "Search Criteria:", 17, 16 25 41 8, tab 14 list 18, 15 49 84 113, group size extsel, tab 14 button "AKill", 19, 133 200 37 12, disable, tab 14 box "Search", 20, 6 15 304 155, tab 14 box "With Selected...", 21, 6 173 304 46, disable, tab 14 edit "", 22, 52 183 50 10, disable autohs, tab 14 text "Expire after:", 23, 14 184 35 8, disable, tab 14 text "(e.g 1d)", 24, 106 185 25 8, disable, tab 14 edit "", 25, 178 184 123 10, disable autohs, tab 14 text "Reason:", 26, 152 185 23 8, disable, tab 14 button "Cancel", 27, 262 222 37 9, ok cancel, tab 14 list 28, 99 49 117 113, group size extsel, tab 14 text "Nickname:", 29, 16 40 25 8, tab 14 list 30, 216 49 84 113, group size extsel vsbar, tab 14 text "Hostname:", 31, 101 40 27 8, tab 14 text "Realname:", 32, 220 40 27 8, tab 14 button "Clear", 33, 263 39 35 9, tab 14 edit "", 34, 28 222 140 10, read autohs, tab 14 text "Status:", 35, 6 223 20 8, tab 14 check "After Akill, delete entry/entries from list", 36, 14 195 107 10, disable, tab 14 button "Clonesxs Check",37,213 23 42 12, tab 14 button "I",38,255 23 10 12, tab 14 button "N",39,265 23 10 12, tab 14 edit "This script is designed to easily and quickly ban botnets without accidentally labeling SwiftSwitch users as bots.",41, 0 14 317 15, read multi, tab 40 edit "The Bot Finder tab allows you to add %, ?, and & in place of letters, numbers, and ^_}{[]`|, as well as regex to detect bots when they connect, switch nicks, and quit.",42, 0 29 317 20, read multi, tab 40 edit "The Trace tab uses the 'os trace' command to make finding and akilling bots more effective. The Clonesxs search will check for typical Clonesxs nicks and idents, or will check nicks and idents seperatly if you press and N or I buttons.",43, 0 49 317 20, multi read, tab 40 edit "This script will also detect when multiple nicks in the pattern *%%%%, such as 'bot1234' and 'bot4321', connect within 10 minutes from eachother from different hosts and notify you of it.",44,0 69 317 20, multi read, tab 40 edit "The aliases in this script are '/origsettings', which will reset the values in the Bot Finder tab to some common bot defaults. The '/exec nick' command will exempt a nick from being labeled as a bot if it matches a bot pattern.",45,0 89 317 20, multi read tab 40 } on *:notice:*:?:{ if ($nick == OperServ && $regex($1-,/Match: (.*) => .* (.*) on/) && $dialog(IRCopTool)) { tokenize 33 $regml(1) did -a IRCopTool 18 $1 did -a IRCopTool 28 $2 did -a IRCopTool 30 $remove($regml(2),$chr(40),$chr(41)) } } on *:dialog:IRCopTool:sclick:16,37,38,39:{ if ($did != 16) { if ($did == 37) { did -o $dname 15 1 $(nick ?%%%* ident ~?%%%%,0) } if ($did == 38) { did -o $dname 15 1 $(ident ~?%%%%,0) } if ($did == 39) { did -o $dname 15 1 $(nick ?%%%* !ident *ss*,0) } } if ($did(15)) { msg OperServ trace print $did(15) did -ar $dname 34 Search $qt($did(15)) initiated. } else { did -ar $dname 34 Search not intiated - Must enter search string! } } on *:dialog:IRCopTool:sclick:33:{ did -r $dname 18,28,30 did -b $dname 21-26,22,19,36 did -ar $dname 34 List Cleared. } on *:dialog:IRCopTool:sclick:18,28,30:{ var %x = 1 while (%x <= $did($did,0).sel) { did -c $+ $iif($did($did,0).sel > 1,k) $dname $replace($remtok(18.28.30,$did,1,46),$chr(46),$chr(44)) $did($did,%x).sel inc %x } did -e $dname 21-26,22,19,36 } on *:dialog:IRCopTool:sclick:19:{ var %x = $did(28,0).sel var %y = 1 while (%x > 0) { msg OperServ akill add $iif($did(22),$+($iif($left($did(22),1) != +,+),$did(22)),+7d) $+(*@,$gettok($did(28,$did(28,%x).sel).text,$numtok($did(28,$did(28,%x).sel).text,64),64)) $iif($did(25),$did(25),Abuse) if ($did(36).state == 1) { did -d $dname 18,28,30 $did(28,%x).sel } dec %x inc %y } if ($did(22).state == 1) { did -b $dname 21-26,22,19,36 } did -ar $dname 34 $calc(%y - 1) users AKilled for reason: $iif($did(25),$ifmatch,Abuse) } on *:dialog:IRCopTool:sclick:36:{ if ($did($did).state == 1) { set %akill.pref1 $did($did).state } else { unset %akill.pref1 } } On *:Dialog:IRCopTool:close:0:{ remini bots.ini Settings remini bots.ini coresidents remini bots.ini coresnicks } on *:Dialog:IRCopTool:init:0:{ if (%akill.pref1) { did -c $dname 36 } var %x = 1 var %y = $ini(bots.ini,Idents,0) var %z = 0 while (%x <= %y) { if ($ini(bots.ini,Idents,%x) >= %z) { var %z = $ini(bots.ini,Idents,%x) } inc %x } var %a = 1 var %b = $ini(bots.ini,Nicks,0) var %c = 0 while (%a <= %b) { if ($ini(bots.ini,Nicks,%a) >= %c) { var %c = $ini(bots.ini,Idents,%a) } inc %a } writeini bots.ini Settings botidentnum $calc(%z +1) writeini bots.ini Settings botnicknum $calc(%c +1) loadidents loadnicks } On *:Dialog:IRCopTool:sclick:5,6,7,8,10,12:{ if ($did == 5) { addident $$?="Enter the ident ban you wish to add." loadidents } elseif ($did == 6) { if ($did(IRCopTool,2).sel) { remini bots.ini Idents $readini(bots.ini,n,coresidents,$v1) remini bots.ini coresidents $v1 loadidents } } elseif ($did == 7) { addnick $$?="Enter the nick ban you wish to add." loadnicks } elseif ($did == 8) { if ($did(IRCopTool,4).sel) { remini bots.ini Nicks $readini(bots.ini,n,coresnicks,$v1) remini bots.ini coresnicks $v1 loadnicks } } elseif ($did == 10) { if ($did(IRCopTool,9).text) { addident $v1 loadidents did -r IRCopTool 9 } } else { if ($did(IRCopTool,11).text) { addnick $v1 loadnicks did -r IRCopTool 11 } } } alias loadidents { remini bots.ini coresidents did -r IRCopTool 2 var %x = $ini(bots.ini,Idents,0) var %y = 1 while (%y <= %x) { did -a IRCopTool 2 $readini(bots.ini,n,Idents,$ini(bots.ini,Idents,%y)) writeini bots.ini coresidents %y $ini(bots.ini,Idents,%y) inc %y } did -c IRCopTool 2 1 } alias loadnicks { remini bots.ini coresnicks did -r IRCopTool 4 var %x = $ini(bots.ini,Nicks,0) var %y = 1 while (%y <= %x) { did -a IRCopTool 4 $readini(bots.ini,n,Nicks,$ini(bots.ini,Nicks,%y)) writeini bots.ini coresnicks %y $ini(bots.ini,Nicks,%y) inc %y } did -c IRCopTool 4 1 } alias addnick { writeini bots.ini Nicks $readini(bots.ini,Settings,botnicknum) $1 writeini bots.ini Settings botnicknum $calc($readini(bots.ini,Settings,botnicknum)) +1) } alias addident { writeini bots.ini Idents $readini(bots.ini,Settings,botidentnum) $1 writeini bots.ini Settings botidentnum $calc($readini(bots.ini,Settings,botidentnum)) +1) } alias checknick { var %x = $ini(bots.ini,nicks,0) var %y = 1 while (%y <= %x) { if ($regex($1,^ $+ $replace($readini(bots.ini,n,Nicks,$ini(bots.ini,Nicks,%y)),?,[a-zA-Z],%,[0-9],&,[\]\[\-\^{}\\_`\|]) $+ $)) { return $true } inc %y } } alias checkident { var %x = $ini(bots.ini,idents,0) var %y = 1 while (%y <= %x) { if ($regex($1,^ $+ $replace($readini(bots.ini,n,Idents,$ini(bots.ini,Idents,%y)),?,[a-zA-Z],%,[0-9],&,[\]\[\-\^{}\\_`\|]) $+ $)) { return $true } inc %y } } on *:connect:{ if ($network == SwiftIRC) { window -aen1 @Bot-Tracker } } on *:snotice:*Client connecting*:{ if ($network == SwiftIRC) { if (. isin $7) { var %nick = $8 var %host = $9 } else { var %nick = $9 var %host = $10 } checkbot %nick %host var %ident = $remove($left(%host,$pos(%host,@,1)),$chr(40),$chr(64)) if (($regex($left(%ident,3),^(~)?s{2})) || ($execcheck(%nick))) { halt } if ($checkident(%ident)) { $iif(!$window(@Bot-Tracker),window -aen1 @Bot-Tracker) aline -ahp 7 @Bot-Tracker $timestamp SUSPICOUS Identd: Nick: %nick %host } if ($checknick(%nick)) { $iif(!$window(@Bot-Tracker),window -aen1 @Bot-Tracker) aline -ahp 7 @Bot-Tracker $timestamp SUSPICOUS NICK: %nick %host } } } On *:Exit:{ unset %bot.* } alias checkbot { var %nick = $1 var %host = $2 tokenize 64 %host var %hostname = $left($2,-1) if (($right(%nick,4) isnum) && ($len(%nick) >= 6) && ($left($right(%nick,5),1) !isnum) && (Guest isin %nick) && (SwiftIRC isin %nick) && (Unknown isin %nick) && (!$regex($left($1,3),^(~)?s{2}))) { var %y = 1 while ($var($+(%,bot.,%y))) { tokenize 32 $($var($+(%,bot.,%y),1),2) if ($left($1,-4) == $left(%nick,-4)) { if ((%hostname != $2) || (%nick != $1)) { $iif(!$window(@Bot-Tracker),window -aen1 @Bot-Tracker) aline -ahp 10 @Bot-Tracker $timestamp Possible bot detection (check $+($left(%nick,-4),$str(%,4)) $+ ): $+(%nick,%host) } var %z = 1 } inc %y } if (!%z) { var %x = 1 while ($var($+(%,bot.,%x))) { inc %x } set -u600 $+(%,bot.,%x) %nick %hostname } } } on *:snotice:*has changed his/her nickname*:{ if ($network == SwiftIRC) { var %nick1 = $4 var %host = $5 var %nick2 = $11 checkbot %nick2 %host var %ident = $remove($left(%host,$pos(%host,@,1)),$chr(40),$chr(64)) if (($regex($left(%ident,3),^(~)?s{2})) || ($execcheck(%nick1)) || ($execheck(%nick2))) { halt } if (($checkident(%ident)) || ($checknick(%nick1)) || ($checknick(%nick2))) { $iif(!$window(@Bot-Tracker),window -aen1 @Bot-Tracker) aline -ahp 9 @Bot-Tracker $timestamp Ch:: From: %nick1 to: %nick2 %host } } } on *:snotice:*Client exiting*:{ if ($network == SwiftIRC) { if ($6 == at) { var %ident = $remove($right($left($8,$pos($8,@,1)),$calc($pos($8,@,1) - $pos($8,!,1))),$chr(40),$chr(64)) var %nick = $remove($left($8,$pos($8,!,1)),$chr(33),$chr(40)) if (($regex($left(%ident,3),^(~)?s{2})) || ($execcheck(%nick))) { halt } if (($checkident(%ident)) || ($checknick(%nick))) { $iif(!$window(@Bot-Tracker),window -aen1 @Bot-Tracker) aline -ahp 5 @Bot-Tracker $timestamp $8 disconnected } } else { var %ident = $remove($left($7,$pos($7,@,1)),$chr(40),$chr(64)) if (($regex($left(%ident,3),^(~)?s{2})) || ($execcheck($nick))) { halt } if (($checkident(%ident)) || ($checknick($6))) { $iif(!$window(@Bot-Tracker),window -aen1 @Bot-Tracker) aline -ahp 5 @Bot-Tracker $timestamp $6 $7 disconnected } } } } alias origsettings { $iif($dialog(IRCopTool),dialog -x IRCopTool) remini bots.ini settings remini bots.ini nicks remini bots.ini idents writeini bots.ini Nicks 1 ?%%%% writeini bots.ini Nicks 2 ?%%% writeini bots.ini Nicks 3 lemming%%* writeini bots.ini Nicks 4 smurf%%* writeini bots.ini Idents 1 ?%%%% writeini bots.ini Idents 2 ?%%% writeini bots.ini Idents 3 lemming%%* writeini bots.ini Idents 4 smurf%%* writeini bots.ini settings botidentnum 5 writeini bots.ini settings botnicknum 5 } alias execcheck { var %x = $ini(bots.ini,Exceptions,0) var %y = 1 while (%y <= %x) { if ($1 == $readini(bots.ini,Exceptions,$ini(bots.ini,Exceptions,%y))) { return $true } inc %y } } alias nickexc { var %x = 1 var %y = $ini(bots.ini,Exceptions,0) var %z = 0 while (%x <= %y) { if ($ini(bots.ini,Exceptions,%x) >= %z) { var %z = $ini(bots.ini,Exceptions,%x) } inc %x } writeini bots.ini Exceptions $calc(%z +1) $1 }