Techzone/Batch Scripting (.bat / .cmd)

Batch Scripting (.bat / .cmd)

4 min readArticle

Batch scripting is Windows' legacy scripting language — .bat and .cmd files that CMD.exe interprets. Old, limited, but still everywhere. You'll encounter batch scripts in Windows environments constantly: startup scripts, scheduled tasks, deployment scripts, and malware. PowerShell has mostly replaced it for new scripts, but knowing batch is still necessary.

Basic Syntax

batch
@echo off
:: This is a comment (double colon)
REM This is also a comment

:: Variables
set TARGET=192.168.1.1
set /p USERINPUT=Enter target IP: 
echo Target is: %TARGET%

:: Newline to file
echo Done > output.txt
echo More >> output.txt

:: Pause for user input
pause

:: Clear screen
cls

Variables

batch
:: Set variable
set NAME=value

:: Use variable
echo %NAME%

:: Set from command output
for /f "tokens=*" %%a in ('ipconfig ^| findstr IPv4') do set MYIP=%%a
echo My IP: %MYIP%

:: Arithmetic
set /a RESULT=5+3
echo %RESULT%

:: Environmental variables
echo %USERNAME%       :: Current user
echo %COMPUTERNAME%   :: Machine name  
echo %USERDOMAIN%     :: Domain
echo %SYSTEMROOT%     :: Usually C:\Windows
echo %TEMP%           :: Temp directory
echo %PATH%           :: PATH variable
echo %DATE%           :: Current date
echo %TIME%           :: Current time

Control Flow

batch
:: If/else
if "%1"=="" (
    echo Usage: script.bat ^<target^>
    goto :eof
)

:: String comparison
if "%VAR%"=="value" (
    echo Match
) else (
    echo No match
)

:: Numeric comparison
if %COUNT% GTR 10 echo Count is greater than 10
:: Operators: EQU, NEQ, LSS, LEQ, GTR, GEQ

:: File/directory checks
if exist "C:\file.txt" echo File exists
if not exist "C:\folder\" mkdir C:\folder

Loops

batch
:: Loop with counter
for /l %%i in (1,1,254) do (
    ping -n 1 -w 100 192.168.1.%%i >nul && echo 192.168.1.%%i is up
)

:: Loop over files
for %%f in (*.txt) do (
    echo Processing: %%f
    type %%f
)

:: Loop over directory recursively
for /r "C:\Users" %%f in (*.doc) do echo %%f

:: Read from file line by line
for /f "delims=" %%l in (wordlist.txt) do (
    echo Trying: %%l
)

Functions / Labels

batch
@echo off

call :ScanHost 192.168.1.1
call :ScanHost 192.168.1.2
goto :eof

:ScanHost
    ping -n 1 -w 500 %1 >nul
    if %errorlevel%==0 (
        echo %1 is UP
    ) else (
        echo %1 is down
    )
    goto :eof

Networking Commands

batch
:: Show network config
ipconfig /all

:: Show routing table
route print

:: ARP table
arp -a

:: DNS lookup
nslookup google.com

:: Ping sweep (quick version)
for /l %%i in (1,1,254) do ping -n 1 -w 200 192.168.1.%%i | find "TTL"

:: Netstat - active connections
netstat -an
netstat -b    :: show process using each connection (admin)

:: Check if port is open (basic)
telnet 192.168.1.1 80

:: tracert (traceroute)
tracert 8.8.8.8

Useful System Commands

batch
:: System info
systeminfo

:: List processes
tasklist

:: Kill process
taskkill /IM notepad.exe /F
taskkill /PID 1234 /F

:: Services
net start
net stop ServiceName
sc query

:: Scheduled tasks
schtasks /query /fo table
schtasks /create /tn "MyTask" /tr "C:\script.bat" /sc daily /st 09:00

:: Registry
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg add HKCU\SOFTWARE\MyApp /v Setting /t REG_SZ /d Value

:: User management
net user
net user username /add
net localgroup administrators username /add

:: Share a folder
net share MyShare=C:\shared /grant:Everyone,Full

Batch for Security Enumeration

batch
@echo off
echo === System Enumeration Script ===
echo.

echo [*] Hostname and User:
hostname
whoami
echo.

echo [*] Network Configuration:
ipconfig /all
echo.

echo [*] Active Connections:
netstat -an
echo.

echo [*] Running Processes:
tasklist
echo.

echo [*] Installed Software:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr DisplayName
echo.

echo [*] Startup Items:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
echo.

echo Done.
pause

Execution

batch
:: Run batch file
C:\path\to\script.bat

:: Run with admin (right-click → Run as Administrator)

:: Run hidden (no window) — from Task Scheduler
cmd /c C:\script.bat

:: Run another batch from within batch
call C:\another_script.bat

Tips

  • Use @echo off at top to suppress command echo
  • >nul redirects output to nothing (suppress output)
  • 2>&1 redirects stderr to stdout
  • %errorlevel% = exit code of last command (0 = success)
  • Use PowerShell for anything complex — batch is limited

See Also

  • bash-scripting-guide — Linux equivalent
  • powershell-scripting-guide — Modern Windows scripting (use this instead for new scripts)
techzonesite.comUnlock Your IT Potential