Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Is it possible to write a batch script that can download some code from the web and infect a computer? Can you explain it briefly?

share|improve this question
I don't think we want to be giving exploit code here, so I have removed that part of your question. – Rory Alsop♦ Jul 30 '12 at 20:45
Oh I agree about the exploit code. Even thou the payload would be the downloaded file. The purpose was to give a brief example, IF it were possible by showing a "non" malicious file. – Digital Fire Jul 30 '12 at 20:49
1  
In that case this may be more suited to SU - the question becomes can a batch file download a file. No security angle required. – Rory Alsop♦ Jul 30 '12 at 20:52
You can write "serverfault.com/questions/29707/…; vbs file using batch script.Then download your file – messi fan Jul 31 '12 at 3:25

2 Answers

up vote 1 down vote accepted

There's no mechanism within Windows batch file scripting to download files. You could use VBScript instead, though.

An alternative is to set up a network share on the same network as the target and copy a file across from there. This is a technique often used in penetration tests to gain further access to a network you've already got basic access to.

As Hendrik mentioned in the comments, it's possible to use in-built executables such as ftp.exe, vscript, WSH files and rundll32.exe to download files, though it may not be reliable across all systems.

share|improve this answer
4  
I am worried that your first sentence may be misunderstood: While there is no built in mechanisms, there are various ways, batch files can trigger file downloads by starting other applications with command line parameters or input redirection (such as ftp.exe, vbscript, WSH files, rundll, ...). – Hendrik Brummermann♦ Jul 30 '12 at 20:15
Very true. I'll edit to include that. – Polynomial Jul 30 '12 at 20:37
up vote 1 down vote

Ultimately, a batch file can write another file and execute it. Batch files can write ASCII characters fine, but other byte values can be more tricky. There are ways to do it, e.g. that which is shown in this answer. On this page a much more thorough bootstrapping method is explained. On recent Windows, it would be simpler to produce a VBScript file and run it; or, even better, a PowerShell script.

An arbitrary executable file can then do anything, including downloading and uploading files, modifying other files in arbitrary ways, and, generally speaking, taking control of the whole machine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.