[Source] P2P Botnet

[Usr6]

STARTUP: Variable and runtime initialization

1. NODE STARTS

2. Local task management is started: if exe is running in a startup DIR then execute the real exe in the deployed directory, before terminating. If the process(exe) is running in the directory its supposed to be in (the deployed directory) then continue as below. If the EXE is in any other place then create the deploy directory, install, and create persistence, before terminating.

3. P2P Library is loaded and Initialised

4. Declare Time and date vars (for service init and also IRC room algorithm)

5. Declares IRC Vars (is_enabled, random room names and nicks, algorithm offset and multiplier)

6. P2P Vars initialized (array systems, global variables)

7. Node global vars (internet working and Port forward working) set as False.

8. nodenickname, group and Authentication loaded from files, or generated if first run.

9. Perform UpNP port forwarding.

10. Load Services from database into array (if any)

11. Attempt to get global IP from What Is My IP Address - Shows Your IP Address. If successful then set global var internet working to True and set global var Global IP.

12. Startup P2P Node services; Socket listening.

13. Register ADLIB to Check if a service is ready to execute at 5 second intervals. In other words, make the process check every 5 seconds to see if a service is scheduled to begin.

14. Register ADLIB to check and manage running services at 900ms intervals.

15. call on some website to test port forwarding and set Variable If appropriate.

16. Empty the working set to get memory usage for about 11mb down to 988kb.

17. ---------?Begin main loop.

MAIN Loop:

1. Check every 8 seconds (if Global internet working variable is False) if internet access is available, if so, set it to True and update peers and variables.

2. Wait 100ms

3. if an IRC Connection is established at the present time, then check and process any data on it?s socket.

4. Goto step 1.

If a new Peer connects to the node:

1. Send IP address, Network identifier, and groupname.

2. Find empty slot in peer array(table) and insert variables and IP, ID, and groupname.

3. Insert into DRT (Distributed routing table ? The routing system of the P2P network. Allows messages to transfer between nodes)

If a Peer connection to the node is lost:

1. Clear data from peer array.

2. Update DRT. (Peers are updated with the new DRT every 40 seconds)

When an internet connection is discovered for the first time in the execution:

1. Update peers (if any) with the correct IP address.

2. Synchronise time with US NIST servers using the DAYTIME protocol.

3. Generate a reference number based on the internet date and IRC variables. This number is used to lookup a table containing entries of IRC chatroom names. The end result is a name that all nodes will arrive at, which will be used to join an IRC chatroom, if IRC bootstrapping is enabled. This allows the IRC name to change every 24 hours, making it harder to detect and destroy the mechanism.

4. Schedule an attempted IRC connection in the near future (between 10 and 599 seconds)

If a request to announces comes through the P2P Network (botmaster or otherwise wants to get the info from all nodes, no authentication):

1. If the message ID of the announce message has been seen before, drop it.

1. Package node info (no services information) and send it to the ID of the botmaster through the P2P Network.

2. Flood broadcast the message to all peers excluding the sender.

If any other non-peer Request comes through the P2P Network:

1. Check to see if the authentication code matches that of the node. If not, send a ?servicebadauth:? message to the requester(botmaster or otherwise) through the P2P network and ignore the message.

2. Otherwise Interpret the message and call the corresponding function:

Get Services

New service

See Exec output

Edit service

Delete service

If Valid IRC data is retrieved:

1. If data is a 266 service ready message: tell the IRC server to connect to the chatroom and set mode to invisible.

2. If data is a ping request reply with a pong message.

3. If data is a PRIVMSG message saying ?I need a hand here? then:

a. If node Port forward worked:

b. And There are not an excessive number of peers THEN PRIVMSG the nodes IP in the expectation that a connection will result.

Periodically (15-90 minutes) at semi-random intervals if the node deems it does not have enough peers it will post the PRIVMSG ?I need a hand here? message to the IRC Bootstrap to gain Ip?s of nodes to connect to, thus robustifying the network.

http://i44.tinypic.com/214b1c2.jpg

http://i43.tinypic.com/155i32x.jpg

http://i39.tinypic.com/14vh82r.jpg

download

sursa

//

autoit

in arhiva sunt si niste fisiere binare, nu le-am verificat, nu descarcati/dati clickuri aiurea daca nu stiti ce faceti

Edited February 27, 2012 by Usr6

[Paul4games]

Astazi am vazut ca a fost postat pe opensc dar cand am vazut ca est escris in autoit mi-a cam pierit cheful sa ma uit peste el, oricum este o sursa buna de citit pentru a intelege mai bine conceptul de botnet p2p......eu as vrea sa vad sursa ultimei versiuni de zeus modificat sa fie cu totul p2p si sa foloseasca udp in loc de tcp:D

[UnuRo]

Eram curios sa vad ce e de el, de unde pot procura Scriptul ?

[nipicopo]

Hi i really like the idea, but the links are broken, could you please re upload them? thank you!