Botnet for academic purposes

I want to make a botnet, maybe with virtual machines or something. I've heard that some botnets are IRC-based. Any ideas about where to start for making a botnet? I am less concerned with the getting-people-to-install-shit angle, and more interested in the concepts of stealth, steganography, command & control, and distributed systems stuff.

>>32
You make it sound like 0-days are super rare. Look at all the CVEs out there -- those are known and reported vulnerabilities. Now imagine all the vulnerabilities people find and don't report.

Besides, you don't always need 0-days for VMs. People might be using old versions of hypervisors, or just didn't set things up correctly.

you can run bindiff to see differences between versions of software so you can figure out what was insecure in the old version (by looking at the differences between the old and new versions)