[系统相关] 求关闭445、135、137、138、139端口批处理

zb848

近期国内多所院校出现ONION勒索软件感染情况，求需要关闭445、135、137、138、139端口

求关闭445、135、137、138、139端口批处理。

注意： 必须适用于win7的系统。网上有的都是XP系统的

xinjinjie

回复 21# codegay

结合14楼分享的代码，要添加策略服务的启动，自己添加了一个，不知道对不对，还请大大指点一下

@echo off
sc config PolicyAgent start= auto
for /f "delims=" %%i in ('net start ^| findstr /i /c:"ipsec policy agent"') do (set aa=%%i)
if defined aa (goto :FI) else (net start "ipsec policy agent")
:FI
netsh ipsec static add policy name=deny_bitcoin
netsh ipsec static add filterlist name=fi_deny_bitcoin
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=135 protocol=TCP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=137 protocol=UDP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=138 protocol=UDP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=139 protocol=TCP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=445 protocol=TCP
netsh ipsec static add filteraction name=denyact action=block
netsh ipsec static add rule name=deny_bitcoin policy=deny_bitcoin filterlist=fi_deny_bitcoin filteraction=denyact
netsh ipsec static set policy name=deny_bitcoin assign=y
cls
echo 关闭端口成功，3秒后本窗口自动关闭
ping 127.0.0.1 >nul
复制代码

xinjinjie

回复 14# add0kakac


    正在找这个批处理，感谢分享，顺便请教一下，137和138端口为什么是UDP而不是TCP呢?

不知道是谁

我的环境也需要，下午编的，大家试试
add0kakac 发表于 2017-5-14 18:54

net start|findstr /i /c:"IPsec Policy Agent"&&goto FI
sc config PolicyAgent start= auto
net start PolicyAgent

这样更简单

ShowCode

回复 20# add0kakac


    这样不太严谨，万一还有其它策略，也给一竿子搞死了

add0kakac

回复 21# codegay
对的，忘了这茬了

codegay

回复 20# add0kakac


    你们需要加一句sc config PolicyAgent start= auto
来保证ip策略服务是自动启动的。如果服务不启动的话。是没用的。

add0kakac

回复 17# codegay
重新启用，直接删除所有策略：netsh ipsec static del all
或者停用策略：netsh ipsec static set policy name=deny_bitcoin assign=n
::deny_bitcoin是策略名

add0kakac

回复 15# zb848
我是在win7下测试的，135端口可以阻止的

dnvplj

回复 16# 九游九天
请问，XP和WIN7通用吗？

codegay

回复 14# add0kakac


    你再写一个重新开放的。万一有用呢。

九游九天

@echo off
title 创建IP安全策略，屏蔽135、139 . . . 等端口 (win7)
netsh ipsec static add policy name=Drop139
netsh ipsec static add filterlist name=Filter1
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=1443 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=1443 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=1444 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=1444 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=3389 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=3389 protocol=UDP
netsh ipsec static add filteraction name=FilteraAtion1 action=block
netsh ipsec static add rule name=Rule1 policy=Drop139 filterlist=Filter1 filteraction=FilteraAtion1
netsh ipsec static set policy name=Drop139 assign=y
exit

zb848

我的环境也需要，下午编的，大家试试
add0kakac 发表于 2017-5-14 18:54

    win7  135端口好像不行

add0kakac

@echo off
for /f "delims=" %%i in ('net start ^| findstr /i /c:"ipsec policy agent"') do (set aa=%%i)
if defined aa (goto :FI) else (net start "ipsec policy agent")
:FI
netsh ipsec static add policy name=deny_bitcoin
netsh ipsec static add filterlist name=fi_deny_bitcoin
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=135 protocol=TCP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=137 protocol=UDP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=138 protocol=UDP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=139 protocol=TCP
netsh ipsec static add filter filterlist=fi_deny_bitcoin srcaddr=any dstaddr=Me dstport=445 protocol=TCP
netsh ipsec static add filteraction name=denyact action=block
netsh ipsec static add rule name=deny_bitcoin policy=deny_bitcoin filterlist=fi_deny_bitcoin filteraction=denyact
netsh ipsec static set policy name=deny_bitcoin assign=y
cls
echo 关闭端口成功，3秒后本窗口自动关闭
ping 127.0.0.1 >nul
复制代码

我的环境也需要，下午编的，大家试试

dnvplj

支持LZ，本人也正需要此代码。