Batch Scripting (.bat / .cmd)
4 min readArticle
Batch scripting is Windows' legacy scripting language — .bat and .cmd files that CMD.exe interprets. Old, limited, but still everywhere. You'll encounter batch scripts in Windows environments constantly: startup scripts, scheduled tasks, deployment scripts, and malware. PowerShell has mostly replaced it for new scripts, but knowing batch is still necessary.
Basic Syntax
batch
@echo off
:: This is a comment (double colon)
REM This is also a comment
:: Variables
set TARGET=192.168.1.1
set /p USERINPUT=Enter target IP:
echo Target is: %TARGET%
:: Newline to file
echo Done > output.txt
echo More >> output.txt
:: Pause for user input
pause
:: Clear screen
cls
Variables
batch
:: Set variable
set NAME=value
:: Use variable
echo %NAME%
:: Set from command output
for /f "tokens=*" %%a in ('ipconfig ^| findstr IPv4') do set MYIP=%%a
echo My IP: %MYIP%
:: Arithmetic
set /a RESULT=5+3
echo %RESULT%
:: Environmental variables
echo %USERNAME% :: Current user
echo %COMPUTERNAME% :: Machine name
echo %USERDOMAIN% :: Domain
echo %SYSTEMROOT% :: Usually C:\Windows
echo %TEMP% :: Temp directory
echo %PATH% :: PATH variable
echo %DATE% :: Current date
echo %TIME% :: Current time
Control Flow
batch
:: If/else
if "%1"=="" (
echo Usage: script.bat ^<target^>
goto :eof
)
:: String comparison
if "%VAR%"=="value" (
echo Match
) else (
echo No match
)
:: Numeric comparison
if %COUNT% GTR 10 echo Count is greater than 10
:: Operators: EQU, NEQ, LSS, LEQ, GTR, GEQ
:: File/directory checks
if exist "C:\file.txt" echo File exists
if not exist "C:\folder\" mkdir C:\folder
Loops
batch
:: Loop with counter
for /l %%i in (1,1,254) do (
ping -n 1 -w 100 192.168.1.%%i >nul && echo 192.168.1.%%i is up
)
:: Loop over files
for %%f in (*.txt) do (
echo Processing: %%f
type %%f
)
:: Loop over directory recursively
for /r "C:\Users" %%f in (*.doc) do echo %%f
:: Read from file line by line
for /f "delims=" %%l in (wordlist.txt) do (
echo Trying: %%l
)
Functions / Labels
batch
@echo off
call :ScanHost 192.168.1.1
call :ScanHost 192.168.1.2
goto :eof
:ScanHost
ping -n 1 -w 500 %1 >nul
if %errorlevel%==0 (
echo %1 is UP
) else (
echo %1 is down
)
goto :eof
Networking Commands
batch
:: Show network config
ipconfig /all
:: Show routing table
route print
:: ARP table
arp -a
:: DNS lookup
nslookup google.com
:: Ping sweep (quick version)
for /l %%i in (1,1,254) do ping -n 1 -w 200 192.168.1.%%i | find "TTL"
:: Netstat - active connections
netstat -an
netstat -b :: show process using each connection (admin)
:: Check if port is open (basic)
telnet 192.168.1.1 80
:: tracert (traceroute)
tracert 8.8.8.8
Useful System Commands
batch
:: System info
systeminfo
:: List processes
tasklist
:: Kill process
taskkill /IM notepad.exe /F
taskkill /PID 1234 /F
:: Services
net start
net stop ServiceName
sc query
:: Scheduled tasks
schtasks /query /fo table
schtasks /create /tn "MyTask" /tr "C:\script.bat" /sc daily /st 09:00
:: Registry
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg add HKCU\SOFTWARE\MyApp /v Setting /t REG_SZ /d Value
:: User management
net user
net user username /add
net localgroup administrators username /add
:: Share a folder
net share MyShare=C:\shared /grant:Everyone,Full
Batch for Security Enumeration
batch
@echo off
echo === System Enumeration Script ===
echo.
echo [*] Hostname and User:
hostname
whoami
echo.
echo [*] Network Configuration:
ipconfig /all
echo.
echo [*] Active Connections:
netstat -an
echo.
echo [*] Running Processes:
tasklist
echo.
echo [*] Installed Software:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr DisplayName
echo.
echo [*] Startup Items:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
echo.
echo Done.
pause
Execution
batch
:: Run batch file
C:\path\to\script.bat
:: Run with admin (right-click → Run as Administrator)
:: Run hidden (no window) — from Task Scheduler
cmd /c C:\script.bat
:: Run another batch from within batch
call C:\another_script.bat
Tips
- Use
@echo offat top to suppress command echo >nulredirects output to nothing (suppress output)2>&1redirects stderr to stdout%errorlevel%= exit code of last command (0 = success)- Use PowerShell for anything complex — batch is limited
See Also
- bash-scripting-guide — Linux equivalent
- powershell-scripting-guide — Modern Windows scripting (use this instead for new scripts)
techzonesite.comUnlock Your IT Potential