求助批处理怎样把字符串直接填到下个语句的需要的地方？

ghj7205

是某个工具，分两次执行，我嫌麻烦，准备一步到位，请教下：

echo sh.SendKeys "cat /var/tel_passwd | head -n 2 | tail -n 1 | cut -d : -f 2{ENTER}" >>telnet_tmp.vbs

这时得到"XXXXXXXX"字符串，怎样把这字符串直接填到下个语句的需要的地方？

1. arp -d
   
2. echo set sh=WScript.CreateObject("WScript.Shell") >telnet_tmp.vbs
   
3. echo WScript.Sleep 300 >>telnet_tmp.vbs
   
4. echo sh.SendKeys "open 192.168.1.1{ENTER}" >>telnet_tmp.vbs
   
5. echo WScript.Sleep 300 >>telnet_tmp.vbs
   
6. echo sh.SendKeys "useradmin{ENTER}" >>telnet_tmp.vbs
   
7. echo WScript.Sleep 1000 >>telnet_tmp.vbs
   
8. echo sh.SendKeys "useradmin{ENTER}" >>telnet_tmp.vbs
   
9. echo WScript.Sleep 300 >>telnet_tmp.vbs
   
10. echo sh.SendKeys "cat /var/tel_passwd | head -n 2 | tail -n 1 | cut -d : -f 2{ENTER}" >>telnet_tmp.vbs
    
11. echo WScript.Sleep 300 >>telnet_tmp.vbs
    
12. echo sh.SendKeys "root{ENTER}" >>telnet_tmp.vbs
    
13. echo WScript.Sleep 1000 >>telnet_tmp.vbs
    
14. echo sh.SendKeys "XXXXXXXX{ENTER}" >>telnet_tmp.vbs
    
15. echo WScript.Sleep 300 >>telnet_tmp.vbs
    

复制代码

ghj7205

感谢大家

czjt1234

得到"XXXXXXXX"字符串
哪里得到的？完全看不出来

ghj7205

得到"XXXXXXXX"字符串
哪里得到的？完全看不出来
czjt1234 发表于 2024-12-20 15:53

    运行第10句后会在CMD窗口显示运行结果，就是一个字符串，“root”后换行需要填写密码，这个字符串就是密码

ghj7205

得到"XXXXXXXX"字符串
哪里得到的？完全看不出来
czjt1234 发表于 2024-12-20 15:53

这是第一个运行BAT
arp -d
echo set sh=WScript.CreateObject("WScript.Shell") >telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
echo sh.SendKeys "open 192.168.1.1{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
echo sh.SendKeys "useradmin{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 1000 >>telnet_tmp.vbs
echo sh.SendKeys "abcd{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
echo sh.SendKeys "cat /var/tel_passwd | head -n 2 | tail -n 1 | cut -d : -f 2{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
start telnet
cscript //nologo telnet_tmp.vbs
del telnet_tmp.vbs

运行结果是zqg93dkych7x7


这是第二个BAT
arp -d
echo set sh=WScript.CreateObject("WScript.Shell") >telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
echo sh.SendKeys "open 192.168.1.1{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs
echo sh.SendKeys "root{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 1000 >>telnet_tmp.vbs
echo sh.SendKeys "zqg93dkych7x7{ENTER}" >>telnet_tmp.vbs
echo WScript.Sleep 300 >>telnet_tmp.vbs

aloha20200628

回复 1# ghj7205

   以下代码存为 test.bat 运行，其中改变了临时创建 *.vbs 脚本的方法，调用 sed.exe（与楼主vbs脚本中采用的 cat/cut/.. 同属gnu系列工具）直接分割当前批处脚本（自动匹配各段首尾标识行）即可...
   中间单独运行 cat ... cut ... 以便回收其密码生成值 %p%，并用 sed.exe 替换到第二段 vbs 脚本所需的*字段位置...

1. 
   
2. @echo off &setlocal
   
3. arp -d
   
4. sed.exe -n "/^'' telnet_tmp1.vbs/I,/'' end_1/I p" "%~f0">telnet_tmp1.vbs
   
5. start "" telnet
   
6. cscript //nologo telnet_tmp1.vbs
   
7. cat /var/tel_passwd | head -n 2 | tail -n 1 | cut -d : -f 2>telnet_tmp0.vbs
   
8. set/p "p="<telnet_tmp0.vbs
   
9. sed.exe -n "/^'' telnet_tmp2.vbs/I,/'' end_2/I p" "%~f0"|sed.exe -r "s/\*/%p%/">telnet_tmp2.vbs
   
10. arp -d
    
11. cscript //nologo telnet_tmp2.vbs
    
12. ::del /q "telnet_tmp?.vbs"
    
13. pause&exit/b
    
14. 
    
15. '' telnet_tmp1.vbs
    
16. set sh=WScript.CreateObject("WScript.Shell")
    
17. WScript.Sleep 300
    
18. sh.SendKeys "open 192.168.1.1{ENTER}"
    
19. WScript.Sleep 300
    
20. sh.SendKeys "useradmin{ENTER}"
    
21. WScript.Sleep 1000
    
22. sh.SendKeys "abcd{ENTER}"
    
23. WScript.Sleep 300
    
24. '' end_1
    
25. 
    
26. '' telnet_tmp2.vbs
    
27. set sh=WScript.CreateObject("WScript.Shell")
    
28. WScript.Sleep 300
    
29. sh.SendKeys "open 192.168.1.1{ENTER}"
    
30. WScript.Sleep 300
    
31. sh.SendKeys "root{ENTER}"
    
32. WScript.Sleep 1000
    
33. sh.SendKeys "*{ENTER}"
    
34. WScript.Sleep 300
    
35. '' end_2
    

复制代码

aloha20200628

回复 5# ghj7205

订正了6楼代码，改为用 sed.exe 自动匹配首尾标识行来切割当前批处脚本以分别生成两个 vbs 脚本...

ghj7205

好的，我明天试试看，谢谢指教&#129309;

ghj7205

回复  ghj7205

订正了6楼代码，改为用 sed.exe 自动匹配首尾标识行来切割当前批处脚本以分别生成两个 v ...
aloha20200628 发表于 2024-12-20 21:22

    运行不下去哦
窗口显示Microsotf Telnet>
就停止了

怎么图片发送不了，少于50k了啊？说不能保存

aloha20200628

回复 9# ghj7205

6楼代码已订正，已复查临时生成的两个vbs脚本与13-22，24-33区间行代码完全一致，注释了第11行代码从而保留了临时生成的三个*.vbs文件，以便楼主验证其中的vbs代码以及中间捕获的密码数据...