PsExec

54 阅读 0 评论 36 点赞

我是靠谱客的博主落寞花生，最近开发中收集的这篇文章主要介绍PsExec，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

PsExec 可在 Windows Vista、NT 4.0、Win2K、Windows XP 和 Server 2003（包括 64 位版本的 Windows）上运行。

PsExec v1.94 - Execute processes remotely
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

PsExec executes a program on a remote system, where remotely executed console
applications execute interactively.

Usage: psexec [\computer[,computer2[,...] | @file][-u user [-p psswd]][-n s][-l
][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,...
] cmd [arguments]
    -a       Separate processors on which the application can run with
            commas where 1 is the lowest numbered CPU. For example,
            to run the application on CPU 2 and CPU 4, enter:
            "-a 2,4"
    -c       Copy the specified program to the remote system for
            execution. If you omit this option the application
            must be in the system path on the remote system.
    -d       Don't wait for process to terminate (non-interactive).
    -e       Does not load the specified account's profile.
    -f       Copy the specified program even if the file already
            exists on the remote system.
    -i       Run the program so that it interacts with the desktop of the
            specified session on the remote system. If no session is
            specified the process runs in the console session.
    -l       Run process as limited user (strips the Administrators group
            and allows only privileges assigned to the Users group).
            On Windows Vista the process runs with Low Integrity.
    -n       Specifies timeout in seconds connecting to remote computers.
    -p       Specifies optional password for user name. If you omit this
            you will be prompted to enter a hidden password.
    -s       Run the remote process in the System account.
    -u       Specifies optional user name for login to remote
            computer.
    -v       Copy the specified file only if it has a higher version number
            or is newer on than the one on the remote system.
    -w       Set the working directory of the process (relative to
            remote computer).
    -x       Display the UI on the Winlogon secure desktop (local system
            only).
    -priority   Specifies -low, -belownormal, -abovenormal, -high or
            -realtime to run the process at a different priority. Use
            -background to run at low memory and I/O priority on Vista.
    computer Direct PsExec to run the application on the remote
            computer or computers specified. If you omit the computer
            name PsExec runs the application on the local system,
            and if you specify a wildcard (\*), PsExec runs the
            command on all computers in the current domain.
    @file    PsExec will execute the command on each of the computers listed
            in the file.
    program Name of application to execute.
    arguments   Arguments to pass (note that file paths must be
            absolute paths on the target system).

You can enclose applications that have spaces in their name with
quotation marks e.g. psexec \marklap "c:long name app.exe".
Input is only passed to the remote system when you press the enter
key, and typing Ctrl-C terminates the remote process.

If you omit a user name the process will run in the context of your
account on the remote system, but will not have access to network
resources (because it is impersonating). Specify a valid user name
in the DomainUser syntax if the remote process requires access
to network resources or to run in a different account. Note that
the password is transmitted in clear text to the remote system.

Error codes returned by PsExec are specific to the applications you
execute, not PsExec.
中文释义
computer：指示 PsExec 在指定的一台或多台计算机上运行应用程序。如果省略计算机名称，则 PsExec 将在本地系统上运行应用程序；如果输入计算机名称“\*”，则 PsExec 将在当前域中的所有计算机上运行应用程序。

@file：指示 PsExec 在指定的文本文件中列出的每台计算机上运行命令。

-a：用逗号分隔可以运行应用程序的处理器，CPU 编号最小为 1。例如，要在 CPU 2 和 CPU 4 上运行应用程序，请输入：“-a 2,4”

-c：将指定的程序复制到远程系统以便执行。如果省略此选项，则应用程序必须位于远程系统上的系统路径中。

-d：不等待应用程序终止。请只对非交互式应用程序使用此选项。

-e：不加载指定帐户的配置文件。

-f：将指定的程序复制到远程系统，即使远程系统中已存在该文件。

-i：运行程序，以便它与远程系统中指定会话的桌面进行交互。如果未指定会话，则进程将在控制台会话中运行。

-l：以受限用户身份（去除 Administrators 组的权限，并且只允许使用分配给 Users 组的权限）运行进程。在 Windows Vista 上，此进程将以“低完整性”运行。

-n：指定与远程计算机连接的超时（秒）。

-p：指定用户名的密码（可选）。如果省略此选项，系统将提示您输入隐藏密码。

-s：在系统帐户中运行远程进程。

-u：指定用于登录远程计算机的可选用户名。

-v：仅在指定文件具有更高版本号或该文件比远程系统上的文件新时复制该文件。

-w：设置进程的工作目录（相对于远程计算机）。

-x：在 Winlogon 桌面上显示 UI（仅限于本地系统）。

-priority：指定 –low、-belownormal、-abovenormal、-high 或 -realtime 按不同优先级运行进程。

program：要执行的程序的名称。

arguments：要传递的参数（请注意，文件路径必须是目标系统中的绝对路径）

例子：

D:softwarePsTools>psexec \10.11.16.134 -u Administrator -p test -l -d "c:
program filesinternet exploreriexplore.exe"

PsExec v1.98 - Execute processes remotely
Copyright (C) 2001-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

http://www.liutilities.com/products/wintaskspro/processlibrary/pplinks/