I used to do that for fun. It was a lot easier back when SDBot and AgoBot was the shit.

The trick I used was to go on some xdcc network, change nickname to one similar to the bots and just wait. Sooner or later one of the botnet owners tried to authenticate and soon after I would exit with a ping-timeout.

Then you could just log into one of them, get a list of processes and download the one with a random name. It was pretty easy and you could get your hands on a few thousand bots in a weekend.

Oh the joy of running "!uninstall" while the owners was in the chatroom...