--==[  How to get ops and takeover a channel on IRC  ]==--

  _-_-_-_-_-_-_-_-_-_ \\ by St0rmer // _-_-_-_-_-_-_-_-_-_-_
  
                 E-mail: st0rmer@hotmail.com


8 . 6 . 98
----------


I've been spending a lot of time online lately reading all kinds of stupid 
text files on how to "Takeover Ops Boi!!!", "eLeEt WaYs To gEt OpS!!!", 
"HOW TO GET OPS ON SERVER SPLITS", etc. We all know none of these things 
work, at least not for me. They're either written by morons, or they were 
written like 10 years ago and don't work anymore. The method I'm presenting 
here DOES work, but it takes practice, patience, and careful reading.


Tools needed:
------------

An IRC script that can do mass deops quickly and easily (preferibly one that 
lets you press an F# (function) key to do mass deops, or one that automatically 
mass deops once you gain ops). You don't want to have to start going through 
popup menus since you have to do this quickly.

An IRC script that can do mass CTCP versioning. I'll explain later.

A wingate scanner. These aren't too hard to find. Check 
http://web.aurecvideo.fr/pixel/progs (this link worked as of 8/6/98).

A few 'war' programs to exploit irc clients, nuke, flood, etc. When I say flood, 
I don't mean like a ping flood in mIRC, I mean like a real ICMP flooder. Try to 
find Final Fortune, it's a program I made myself... very effective.

A lot of patience.

A brain.


Process:
-------

Find a channel you want to takeover. This method will NOT work on Dalnet or any 
other networks with anything like ChanServ. Also, this won't work if all of the 
ops in the channel are bots (unless they're VERY badly programmed). OK, so once 
you're in the channel, do a Version CTCP on all of the ops in there. Look for 
exploitable scripts (some versions of ircN, mIRC 5.3x, mIRC 5.4, etc.). Now, 
let's say you find someone with nick 'DumbOP' and he's using a script that you 
know you can exploit and disconnect him from IRC (but don't crash him yet!). 
/dns DumbOP to find his IP. Now take your handy wingate scanner. Plug in his 
IP and search for a similar one with the scanner. If you can't find one in the 
same Class C range, try Class B if you have to, but make sure it resolves to 
something close to DumbOP's IP.

Good, so now you have a wingate IP similar to DumbOP's. If you couldn't find an 
IP close to his, try this with another op with an exploitable script. Do 
a /whois DumbOP to find the IRC server he's on and his ident (the thing before 
the @ip). So now that you have the wingate IP, what do you do with it? I'll 
assume you never wingated before, and I'll explain how to do it with mIRC. For 
the example, let's say the wingate IP is 1.2.3.4, DumbOP's ident is 'opident', 
and DumbOP's irc server is 'irc.server.net'.

Open a new instance of mIRC, and in the status window, do the following:

/server 1.2.3.4 23

You'll see it say "WinGate>NICK (some nick)"
Right after you see this, type:

/quote irc.server.net 6667

You'll probably then see something like
"Connecting to host USER...Host name lookup for USER failedirc.server.net 6667
Connecting to host irc.server.net...connected"

You might see more than this, you might see less. The important thing to watch 
for is:

" -1.2.3.4- *** Looking up your hostname...
  -1.2.3.4- *** Checking Ident
  -1.2.3.4- *** Found your hostname
  -1.2.3.4- *** Got Ident response "

Once you see that, type:

/quote user opident opident opident opident
/quote nick DumbOP1

You don't have to use 'DumbOP1', just use any temporary nick you want. Also, 
you can use '/raw' instead of '/quote' if you wish.

If you did everything correctly, you'll see the MOTD for the irc server, and 
you'll be connected. If by chance 1.2.3.4 is k-lined from irc.server.net, 
you'll have to go through the whole process again with a different server. 
This makes your "spoofing" (it's not REALLY spoofing) attempt less realistic 
looking, but if you have to use a different server, then do it.

Once you're online, everything works like normal. Do a /whois DumbOP1 to see 
your info. It should be close to DumbOP's.

You're halfway there! The next thing to do (not necessary, but recommended) 
is to try to find out some info on DumbOP. I recommend trying 
"nbtstat -A <DumbOP's IP>" at the dos prompt, that might provide you with a 
name or two if you're lucky. This is just some useful information that might 
come in handy. Also, try searching ICQ for his nick and check his info, you 
might find good stuff in there.

The next step is to disconnect DumbOP from IRC. Either use an exploit, or 
nuke him (Click is sometimes useful (if you don't know what Click is, it's 
a program made by Rhad to have an IRC server 'nuke' a person... it sometimes 
works)), or ICMP flood him. Do anything you have to to disconnect him. By 
the way, you should have your original IRC session still open, with your 
wingated IRC session running as a different instance of mIRC (you should 
have 2 'versions' of mIRC running at the same time now, one with your 
original nick, info, etc., and the other with the DumbOP1 stuff). While 
you're attacking DumbOP, monitor the channel with your original session of 
mIRC and wait for DumbOP to disconnect. Immediately after you see that, 
rename DumbOP1 to DumbOP (/nick DumbOP) and join the channel! Don't say 
anything! If you're lucky, a stupid op will op you. Then mass deop. If 
nothing happens for about 5 or 6 minutes, mass message the ops, saying 
something like "what happened? why am I not opped?". You might get into 
a conversation. Remember to keep calm, and talk like an op. Don't freak 
out and demand for them to op you. The "useful information" might come in 
handy now. Often the ops will tell you to get ops from the bots. Just say 
something like you're desynched from the bots because of your ping timeout.

If your impersonation is good enough, 9/10 times they'll op you. Like I 
said before, IMMEDIATELY do a mass deop. If possible, bring AT LEAST two 
bots (real bots, not just simple clones) into the channel to hold it and 
protect it.

If you followed all these steps thoroughly, you should be able to takeover 
most channels as long as there are at least 2 human ops (1 of which you'll 
be 'spoofing', the other you'll be messaging to op you).

Good luck and have fun!

If you have any questions/comments/whatever, e-mail St0rmer at 
st0rmer@hotmail.com and/or message me on Efnet (nick St0rmer).