Some notes other than what has already been said:

- Both IRC servers are currently down (connection refused).

- The C code is full of bugs, but they're probably only exploitable if you can get either a nick more than 1024 characters or a full line more than 4096 characters (in the latter case, aside from there being an off-by-one error, the data after 4096 characters will be treated as a command, so you could spoof a privmsg and cause the bot to execute a shell command).

Here are the commands for the bot:

NICK <nick> = Changes the nick of the client

SERVER <server> = Changes servers

KILL = Kills the client

GET <http address> <save as> = Downloads a file off the web and saves it onto the hd

HELP = Displays this

IRC <command> = send_msgs this command to the server

SH <command> = Executes a command

I'm a little light on IRC proxies right now - anyone care to test if you can kill all 2,164 bots in one easy peasy MIRC script?

This is a botnet being ran, at least in part, by hacking group HTP.

ryan is one of its lead members. Other evidence is the fact that "starfall.cu.cc" is one domain being used to grab this script: http://starfall.cu.cc/chips.txt

Starfall is another one of their members.

They're the people who breached Linode, MIT, nmap, and a few other places recently. See: http://www.exploit-db.com/papers/25306/

I'm surprised no one's thought of mass exploiting all those RoR servers months ago, unless those have all been there for months.

Looking at SpamHaus, that IP range is owned by a company that provides professional botnet hosting. Approach with caution.

This botnet has been attacking servers at my work for the last few days. I'm glad we upgraded within a month of the security patches.