中国DOS联盟

I've been looking for over a month and haven't found the relevant tools and software, it's tragic.

The remote machine is in this state, you are on your machine, use a batch processing, the remote machine will log in, I really want to thank you very much, admire you

Originally posted by rs369007 at 2010-4-29 13:50:
Telnet can do it

Is there a detailed method? Can it be done with batch processing?

You can use Windows Remote Desktop (graphical telnet). The steps are as follows:

On the other party's host, set up as follows:

First step: Right-click on "My Computer" on the desktop and select "Properties".
Second step: In the pop-up System Properties window, select the "Remote" tab.
Third step: In the Remote tab, find "Remote Desktop", check the box before "Allow users to connect to this computer", and then click OK to complete the enabling of the remote desktop connection function under XP.

Then on your computer, perform the following steps:

Start-----All Programs------Accessories-------Remote Desktop Connection----Enter the remote IP address-----Enter the username and password as prompted (you should disconnect from the Internet in advance, otherwise the parsed path may be incorrect)

Last edited by rs369007 on 2010-4-29 at 14:20 ]

Batch processing doesn't seem to work (but I haven't tried it). The method above I've used, and it can completely realize your wish

Two Methods to Enable Remote Desktop Connection on a Local Area Network
15:33, vkill1, Implement with the wmic command (recommended)
The following are two examples of enabling. To disable, change the last 1 to 0.

#server 192.168.88.100
#user administrator
#pass 1234567
wmic /node:192.168.88.100 /user:administrator /password:1234567 PATH win32_terminalservicesetting WHERE (__Class!="") CALL SetAllowTSConnections 1

#server 192.168.88.100
#user administrator
#pass `empty password`
wmic /node:192.168.88.100 /user:administrator /password:"" PATH win32_terminalservicesetting WHERE (__Class!="") CALL SetAllowTSConnections 1


2. Implement by modifying the inf to modify the registry

@echo off :: 3389.cmd ::
more +4 "%~0" > 3389.inf & rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 .\3389.inf & del /q 3389.inf
exit /b
::::::::::::::::::::

Signature="$WINDOWS NT$"

Addreg=AddReg.

HKLM,"SYSTEM\CurrentControlSet\Control\Terminal Server",fDenyTSConnections,0x00010001,0
First save the above code as a 3389.cmd file, and then use the following example to enable.

#server 192.168.88.100
#user administrator
#pass 1234567
psexec \\192.168.88.100 -u administrator -p 1234567 -c 3389.cmd

Originally posted by rs369007 at 2010-4-29 14:22:
Batch processing doesn't seem to work (but I haven't tried it). The above method I have used can fully achieve your wish

It's okay, but the other party's machine is in a locked state, which is not good

Another drawback is that users cannot be specified separately,
for example: Connect with domain administrator rights, and log in as a normal user

Originally posted by rs369007 at 2010-4-29 14:18:
You can use Windows Remote Desktop (graphical telnet). The steps:

On the target host, set up as follows:

　　Step 1: Right-click "My Computer" on the desktop and select "Properties".
　　...

For the graphical interface, I know how to do it. There are many tools that can be used, such as Dameware, etc. I just want batch processing

Installing a backdoor and reverse connection would make it less troublesome. You can get a cmd shell of the other party's machine, the other party won't be locked, and you have almost all permissions. If you don't have a backdoor, it's more difficult.

Also, a nc.exe tool is used.

Last edited by rs369007 on 2010-4-29 at 14:59 ]

Installing a backdoor, reverse connection, would not be so troublesome. You can obtain a cmd shell of the other party's machine, the other party will not be locked, and you have almost all permissions. If you don't have a backdoor, this is relatively time-consuming...

It's easy to have a backdoor, I'm a domain administrator, what backdoor should I install?

It's very simple. What's needed is a backdoor that can obtain the shell of the other party's machine, that is, a backdoor that can interact with the cmd. Isn't that enough?

The commands input on the local machine are transmitted to the target host, and the target host receives them through the backdoor and hands them over to cmd for interpretation and execution

Remotely modify the registry to enable automatic login, then remotely log off or restart.

Originally posted by rs369007 at 2010-4-29 15:16:
The command entered on the local machine is transmitted to the target host, and the target host receives it through the backdoor and hands it over to cmd for interpretation and execution

The key is that there is no logged-in cmd

Install CopSSH or enable TELNET