記錄每次進(jìn)入3389遠(yuǎn)程桌面IP的批處理bat

2020-06-09 14:18:49

字體：大中小

供稿：網(wǎng)友

下面的代碼復(fù)制一下存成一個(gè)批處理文件后雙擊即可!
復(fù)制代碼代碼如下:

MD C:/WINDOWS/PDPLOG
echo date /t ^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
echo time /t ^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
echo netstat -n -p tcp ^| find ":3389"^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
echo start Explorer >>C:/WINDOWS/PDPLOG/PdPLOG.CMD

:: 添加用戶(hù)每次進(jìn)入遠(yuǎn)程桌面時(shí)自動(dòng)記錄下來(lái)所用IP，可用來(lái)發(fā)現(xiàn)黑客蹤跡！
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Terminal Server/WinStations/RDP-Tcp" /v fInheritInitialProgram /t REG_DWORD /d "00000000" /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Terminal Server/WinStations/RDP-Tcp" /v WorkDirectory /t REG_SZ /d C:/WINDOWS/PDPLOG/ /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Terminal Server/WinStations/RDP-Tcp" /v InitialProgram /t REG_SZ /d "C:/WINDOWS/PDPLOG/PdPLOG.CMD" /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp" /v fInheritInitialProgram /t REG_DWORD /d "00000000" /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp" /v WorkDirectory /t REG_SZ /d C:/WINDOWS/PDPLOG/ /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp" /v InitialProgram /t REG_SZ /d "C:/WINDOWS/PDPLOG/PdPLOG.CMD" /f

Echo 記錄遠(yuǎn)程桌面IP策略添加完畢! 請(qǐng)按任意鍵退出!
PAUSE >nul

echo netstat -n -p tcp ^| find ":3389"^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
上面一句中有個(gè)3389數(shù)字，這個(gè)是遠(yuǎn)程桌面的默認(rèn)端口。
如果更改遠(yuǎn)程桌面的朋友，需要將3389替換為你更改的端口。

查看記錄的地方在C:/WINDOWS/PDPLOG/RDPlog.txt