先來看下它的基本用法:python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
root@10.1.1.43:~
# nc -h
[v1.10-38]
connect to somewhere:
nc
[-options]
hostname
port[s] [ports] ...
listen
for
inbound:
nc
-l -p port [-options] [
hostname
] [port]
options:
-c shell commands as `-e'; use
/bin/sh
to
exec
[dangerous!!]
-e filename program to
exec
after connect [dangerous!!]
-b allow broadcasts
-g gateway
source
-routing hop point[s], up to 8 設置路由器躍程通訊網關,最高可設置8個。
-G num
source
-routing pointer: 4, 8, 12, ... 設置來源路由指向器,其數值爲4的倍數。
-h this cruft
-i secs delay interval
for
lines sent, ports sca 延時的間隔
-k
set
keepalive option on socket
-l listen mode,
for
inbound connects 監聽模式,入站鏈接
-n numeric-only IP addresses, no DNS 直接使用ip地址,而不用域名服務器
-o
file
hex dump of traffic 指定文件名稱,把往來傳輸的數據以16進制字碼傾倒成該文件保存。
-p port
local
port number 本地端口
-r randomize
local
and remote ports 隨機本地和遠程端口
-q secs quit after EOF on stdin and delay of secs
-s addr
local
source
address
-T tos
set
Type Of Service
-t answer TELNET negotiation
-u UDP mode udp 模式
-
v
verbose [use twice to be
more
verbose] 顯示過程,vv 更多
-w secs timeout
for
connects and final net reads 等待鏈接超時
-z zero-I
/O
mode [used
for
scanning] 使用輸入/輸出模式,只在掃描通訊端口時使用。
|
1.監聽本地端口linux
1
2
3
|
root@10.1.1.43:~
# nc -l -p 1234
root@10.1.1.43:~
# netstat -tunlp | grep 1234
tcp 0 0 0.0.0.0:1234 0.0.0.0:* LISTEN 15543
/nc
|
2.端口掃描web
1
2
3
4
5
6
|
root@
10.1
.
1.43
:~
# nc -v -w 10 10.1.1.180 80
(UNKNOWN) [
10.1
.
1.180
]
80
(www)
open
root@
10.1
.
1.43
:~
# nc -v -w 10 10.1.1.180 -z 80-30000
(UNKNOWN) [
10.1
.
1.180
]
22000
(?)
open
(UNKNOWN) [
10.1
.
1.180
]
80
(www)
open
|
3.文件傳出shell
源10.1.1.43 text.txt 服務器
目的 10.1.1.180dom
1
2
3
4
5
6
|
root@10:~
# nc -l -p 1234 > test.txt #開10.1.1.180:1234端口監聽,並將socket傳輸過來的數據重定向到test.txt文件 test 43 nc
root@10.1.1.43:~
#cat test.txt
root@10.1.1.43:~
# nc 10.1.1.180 1234 < test.txt #鏈接遠程的10.1.1.180,從test.txt的路徑從定向到socket,從而將文件傳輸到遠方。
root@10:~
# cat test.txt
test
43
nc
|
4.目錄傳輸ssh
源10.1.1.43 python_programsocket
目的 10.1.1.180tcp
1
2
3
4
5
6
7
|
root@10:~
# nc -l -p 1234 | tar xzvf -
root@10.1.1.43:~
# tar czvf - python_program | nc 10.1.1.180 1234
python_program/
python_program
/1
.py
python_program
/4
.py
python_program
/3
.py
|
5.測試UDP端口測試
1
2
3
4
5
6
7
8
9
|
root@
172.16
.
211.34
:web
# netstat -tunlp
Active Internet connections (only servers)
Proto Recv
-
Q Send
-
Q Local Address Foreign Address State PID
/
Program name
tcp
0
0
0.0
.
0.0
:
22
0.0
.
0.0
:
*
LISTEN
1111
/
sshd
udp
0
0
0.0
.
0.0
:
68
0.0
.
0.0
:
*
887
/
dhclient
root@
172.16
.
211.35
:~
# nc -vuz 172.16.211.34 68
Connection to
172.16
.
211.34
68
port [udp
/
bootpc] succeeded!
|
參考:
NetCat 官方地址:http://netcat.sourceforge.net/