比CMD更強大的指令行WMIC

先決條件：

a. 啟動Windows Management Instrumentation服務，開放TCP135端口。

b. 本地安全政策的“網絡通路: 本地帳戶的共享和安全模式”應設為“經典-本地使用者以自己的身份驗證”。

1. wmic /node:"192.168.1.20" /user:"domain\administrator" /password:"123456"

2.【硬體管理】：

擷取磁盤資料：

wmic DISKDRIVE get deviceid,Caption,size,InterfaceType

擷取分區資料：

wmic LOGICALDISK get name,Description,filesystem,size,freespace

擷取CPU資料:

wmic cpu get name,addresswidth,processorid

擷取主機闆資料:

wmic BaseBoard get Manufacturer,Product,Version,SerialNumber

擷取記憶體數:

wmic memlogical get totalphysicalmemory

獲得品牌機的序列号:

wmic csproduct get IdentifyingNumber

擷取聲霸卡資料:

wmic SOUNDDEV get ProductName

擷取螢幕分辨率

wmic DESKTOPMONITOR where Status='ok' get ScreenHeight,ScreenWidth

3. PROCESS【程序管理】：

列出程序

wmic process list brief

(Full顯示所有、Brief顯示摘要、Instance顯示執行個體、Status顯示狀态)

wmic 擷取程序路徑:

wmic process where name="jqs.exe" get executablepath

wmic 建立新程序

wmic process call create notepad

wmic process call create "C:\Program Files\Tencent\QQ\QQ.exe"

wmic process call create "shutdown.exe -r -f -t 20"

wmic 删除指定程序:

wmic process where name="qq.exe" call terminate

wmic process where processid="2345" delete

wmic process 2345 call terminate

wmic 删除可疑程序

wmic process where "name='explorer.exe' and executablepath<>'%SystemDrive%\\windows\\explorer.exe'" delete

wmic process where "name='svchost.exe' and ExecutablePath<>'C:\\WINDOWS\\system32\\svchost.exe'" call Terminate

3. USERACCOUNT【賬号管理】：

更改目前使用者名

WMIC USERACCOUNT where "name='%UserName%'" call rename newUserName

WMIC USERACCOUNT create /?

4. SHARE【共享管理】：

建立共享

WMIC SHARE CALL Create "","test","3","TestShareName","","c:\test",0

(可使用 WMIC SHARE CALL Create /? 檢視create後的參數類型)

删除共享

WMIC SHARE where name="C$" call delete

WMIC SHARE where path='c:\\test' delete

5. SERVICE【服務管理】：

更改telnet服務啟動類型[Auto|Disabled|Manual]

wmic SERVICE where name="tlntsvr" set startmode="Auto"

運作telnet服務

wmic SERVICE where name="tlntsvr" call startservice

停止ICS服務

wmic SERVICE where name="ShardAccess" call stopservice

删除test服務

wmic SERVICE where name="test" call delete

6. FSDIR【目錄管理】

列出c盤下名為test的目錄

wmic FSDIR where "drive='c:' and filename='test'" list

删除c:\good檔案夾

wmic fsdir "c:\\test" call delete

重命名c:\test檔案夾為abc

wmic fsdir "c:\\test" rename "c:\abc"

wmic fsdir where (name='c:\\test') rename "c:\abc"

複制檔案夾

wmic fsdir where name='d:\\test' call copy "c:\\test"

7.datafile【檔案管理】

重命名

wmic datafile "c:\\test.txt" call rename c:\abc.txt

8.【任務計劃】：

wmic job call create "notepad.exe",0,0,true,false,********154800.000000+480

wmic job call create "explorer.exe",0,0,1,0,********154600.000000+480