flare-fakenet-ng icon indicating copy to clipboard operation
flare-fakenet-ng copied to clipboard

Published 20 hours ago • verified publisher icon mandiant

Add support for WHOIS command on IRCListener

Open 3V3RYONE opened this issue 1 year ago • 6 comments

This PR fixes #35

Cause of Bug The reason of this unknown command bug is because there is no specific function in fakenet/listeners/IRCListener.py that deals with the WHOIS command. Therefore, whenever the WHOIS command is executed, the current code executes the irc_DEFAULT function in fakenet/listeners/IRCListener.py, that displays the unknown command message as output.

Fix I went ahead and defined a function with the name irc_WHOIS which deals with the WHOIS command. I analyzed the ideal output of WHOIS command (executed without fakenet running), and then added the respective fields in the irc_WHOIS function to replicate the same output.

idealWHOISOutput

Before 27/03/23 01:45:34 PM [ IRCServer] Client issued an unknown command WHOIS IEUser

After AfterChanges

Note While the output is working as expected, there is one side effect. The WHOIS command's output keeps on printing in a forever loop at the client side, even though it is executed once. While I am trying to work on this issue and fix it, I would love any help to proceed in the right direction. Thank you! :)

3V3RYONE avatar Mar 27 '23 14:03 3V3RYONE

@3V3RYONE Can you mention the client you were using to test? It seems like irssi from the screenshot.

tinajn avatar Mar 30 '23 14:03 tinajn

Hey @tinajn , yup I used irssi as the client!

3V3RYONE avatar Mar 30 '23 14:03 3V3RYONE

Could you also add a test for the WHOIS command to test.py?

tinajn avatar Apr 04 '23 21:04 tinajn

Surely, getting back to work on this issue latest by Monday! Will add the tests too :)

3V3RYONE avatar Apr 08 '23 14:04 3V3RYONE

Tested the WHOIS command, works well with the new changes :tada:

Note

  1. The testing was done by creating an IRC client in a python prompt alongside fakenet running.
  2. We could not test the changes with test.py, because as per the docs, IRC Listener test is known to fail in test.py in windows.
  3. We could not test the changes with the original irssi client, because IRSSI v1.2.2 (as used to report and replicate the bug) is no longer available to use via cygwin. Newer versions of IRSSI do not work with fakenet currently.

Before WHOIS

Client issued an unknown command WHOIS: dr_evil

WhatsApp Image 2023-05-29 at 5 13 55 PM

After WHOIS

Client has issued WHOIS command: dr_evil

WhatsApp Image 2023-05-29 at 5 13 55 PM (1)

3V3RYONE avatar May 29 '23 11:05 3V3RYONE

Thank you @3V3RYONE.

In the process of testing code with an IRC client. Will merge once I have tested.

tinajn avatar Jun 12 '23 17:06 tinajn