[其他] 求一个IIS安全策略c-port 超过10000以上的自动封禁脚本！

@echo off
psec static add policy name=XBLUE
netsh ipsec static add filterlist name=denyip
for /f "eol=# tokens=3,4" %%a in (a.txt) do (
  if %%b gtr 10000 if not defined _%%a (
    netsh ipsec static add filter filterlist=denyip srcaddr=%%a dstaddr=Me dstport=80 protocol=TCP
    set "_%%a=1"
  )
)
netsh ipsec static add filteraction name=denyact action=block
netsh ipsec static add rule name=kill3389 policy=XBLUE filterlist=denyip filteraction=denyact
netsh ipsec static set policy name=XBLUE assign=y
pause
复制代码

@echo off
netstat -n -p tcp |find ":80">>Log.log
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (Log.log) do (
set var=%%i
set "var=!var::= !"
set "var=!var: = !"
set "var=!var:  = !"
set "var=!var:   = !"
set "var=!var:    = !"
set "var=!var:     = !"
echo !var!>>ccLog.log
)
netsh ipsec static add policy name=XBLUE
netsh ipsec static add filterlist name=denyip
for /f "eol=# tokens=4,5" %%a in (ccLog.log) do (
  if %%b gtr 10000 if not defined _%%a (
    netsh ipsec static add filter filterlist=denyip srcaddr=%%a dstaddr=Me dstport=80 protocol=TCP
    set "_%%a=1"
  )
)
netsh ipsec static add filteraction name=denyact action=block
netsh ipsec static add rule name=kill3389 policy=XBLUE filterlist=denyip filteraction=denyact
netsh ipsec static set policy name=XBLUE assign=y
gpupdate /force
del log.log /f/s/q/a
del cclog.log /f/s/q/a
exit
复制代码