# IRC

> IRC is a chat protocol. Attackers enumerate channels and users, exploit server flaws, use it as a C2 channel, exfiltrate data, and establish persistence via bots or backdoors

- **URL:** https://hackindex.io/services/irc
- **Type:** Service
- **Default ports:** 6667, 6697
- **Tags:** irc, network, chat, protocol, tcp, reconnaissance
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

IRC (Internet Relay Chat) is a text-based communication protocol used for real-time group and private messaging. It runs on **TCP port 6667** for plaintext and **TCP port 6697** for TLS-encrypted connections. Nmap identifies the service as `irc`. Common IRC server software includes UnrealIRCd, InspIRCd, and ngIRCd.

IRC servers have historically been used as command-and-control (C2) channels for botnets, making their presence on a network worth investigating. From a pentesting perspective, IRC services can expose user information, internal channel conversations, and server configuration details. Backdoored versions of IRC servers (notably UnrealIRCd 3.2.8.1 with a hardcoded backdoor) have provided trivial remote code execution. Weak or missing authentication on operator accounts and services (NickServ, ChanServ) are common findings.

Enumeration starts with connecting to the server and gathering version info via the `VERSION` command. Channel listing (`LIST`) reveals active channels and their topics. Nmap's `irc-info` script extracts server details, user count, and channel information. Testing for known backdoors, operator credential brute-forcing, and checking for information leakage in channel topics and MOTD messages are standard assessment steps.

## Phases

- [Enumeration](https://hackindex.io/services/irc/enumeration.md): Enumerate IRC ports, identify versions, list channels, harvest creds (1 guides)
- [Exploitation](https://hackindex.io/services/irc/exploitation.md): Exploit UnrealIRCd 3.2.8.1 backdoor for reverse shell access (1 guides)