-
Notifications
You must be signed in to change notification settings - Fork 23
/
Copy path课时10 基本工具-NETCAT.txt
executable file
·183 lines (152 loc) · 4.81 KB
/
课时10 基本工具-NETCAT.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
课时10 基本工具-NETCAT（telnet/banner、传输文本信息）
常用工具
经常使用且功能强大
安全从业者必不可少的帮手
Nc / ncat
Wireshack
Tcpdump
NETCAT-----NC
网络工具中的瑞士军刀——小身材、大智慧
侦听模式/传输模式
telnet/获取banner信息
传输文本信息
传输文件目录
加密传输文件
远程控制/木马
加密所有流量
流媒体服务器
远程克隆硬盘
NC-----TELNET/banner
nc -nv 1.1.1.1 10
nc -nv 1.1.1.1 25
nc -nv 1.1.1.1 80
root:~# nc -h //它的基本用法
GNU netcat 0.7.0, a rewrite of the famous networking tool.
Basic usages:
connect to somewhere: nc [options] hostname port [port] ...
listen for inbound: nc -l -p port [options] [hostname] [port] ...
tunnel to somewhere: nc -L hostname:port -p port [options]
Mandatory arguments to long options are mandatory for short options
too.
Options:
-c, --close close connection on EOF from stdin
-e, --exec=PROGRAM program to exec after connect
-g, --gateway=LIST source-routing hop point[s], up to 8
-G, --pointer=NUM source-routing pointer: 4, 8, 12, ...
-h, --help display this help and exit
-i, --interval=SECS delay interval for lines sent, ports scanned
-l, --listen listen mode, for inbound connects
-L, --tunnel=ADDRESS:PORT forward local port to remote address
-n, --dont-resolve numeric-only IP addresses, no DNS
-o, --output=FILE output hexdump traffic to FILE (implies -x)
-p, --local-port=NUM local port number
-r, --randomize randomize local and remote ports
-s, --source=ADDRESS local source address (ip or hostname)
-t, --tcp TCP mode (default)
-T, --telnet answer using TELNET negotiation
-u, --udp UDP mode
-v, --verbose verbose (use twice to be more verbose)
-V, --version output version information and exit
-x, --hexdump hexdump incoming and outgoing traffic
-w, --wait=SECS timeout for connects and final net reads
-z, --zero zero-I/O mode (used for scanning)
Remote port number can also be specified as range. Example: '1-1024'
我用的是GNU的netcat,比起@stake公司的netcat多了-c 选项,不过这是很有用
的一个选项,后面我们会讲到.还有GNU的-L,-t ,-T选项和@stake的-L -t 用途
是不一样的,自己琢磨吧.
root:~# nc -v //端口扫描
root:~# mtr 200.106.0.20 //追踪一下路由
root:~# nc -vn //显示详细的终端信息，不会Dns解析
root:~# ping pop3. 163.com //连接ip邮箱
root:~# nc -vn 123.125.50.29 110
USER
USER 12asdfg
USER ZmfuZZhvbmcueXVhbkAxNjMuY29tCg==
root:~# base64
ZmfuZZhvbmcueXVhbkAxNjMuY29tCg==
root:~# ping smtp.163.com
root:~# nc -nv 123.125.20.138 25
220 163.com Anti-spam GT for Coremail System(163com[20141201])
ehlo
500 Errot: bad syntax
ehlo yuanfh
250-mail
250-PIPELINING
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-coremail 1uxr2xKj7G0xkI17xGrU710s8FY2U3Uj8Cz8x1UUUUU7Ic2IOY2Urz03NIUCa0xDrUUUUj
250-ARARTTLS
250 8BIMIME
AUTH LOGIN
344 dxNLcm5hbWU6
535 Error: authentication failed
root:~# nc -nv 123.125.20.138 25
220 163.com Anti-spam GT for Coremail System(163com[20141201])
ehlo
500 Errot: bad syntax
ehlo yuanfh
250-mail
250-PIPELINING
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-coremail 1uxr2xKj7G0xkI17xGrU710s8FY2U3Uj8Cz8x1UUUUU7Ic2IOY2Urz03NIUCa0xDrUUUUj
250-ARARTTLS
250 8BIMIME
AUTH LOGIN
344 dxNLcm5hbWU6
535 Error: authentication failed
root:~# nc -nv 10.1.1.11 80
(UNKNOWN) [10.1.1.11] 80 (http) open
head /
<html><head><titile>Metasploitable2 - Linux</title></head><body>
<pre>
warning: Never expose this VM to an untrusted network!
Contact: msfdev[at]metasploit.com
Login with msfadmin/msfadmin to get started
</pre>
<ul>
<li><a href="/twiki/">Twiki</a></li>
<li><a href="/phpMyAdmin/">phpMyAdmin</a></li>
<li><a href="/mutillidae/">Mutillidae</a></li>
<li><a href="/dvwa/">DVWA</a></li>
<li><a href="/dav/">wevDAV</a></li>
</ul>
</body>
</html>
NC-----传输文本信息
A: nc -l -p 4444
B: nc -nv 1.1.1.1 4444
远程电子取证信息收集
开启两台系统kalix64和kalix32
kali 32Bit
root@kali:~# nc -l -p 333 //打开端口333
root@kali:~# netstat -pantu | grep 333 //查看端口33是否打开
10.1.1.12
kali 64Bit
root:~# nc -nv 10.1.1.12 333
(UNKNOWN) [10.1.1.12] 333 (?) open
然后两台电脑实现聊天的功能！
远程电子取证
kali 32Bit
root@kali:~# nnc -l -p 333 //打开端口333
kali 64Bit
root:~# ls -l | nc -nv 10.1.1.12 333
(UNKNOWN) [10.1.1.12] 333 (?) open
root:~# ps aux //查看可疑的进程
kali 32Bit
root@kali:~# nc -l -p 333 > ps.txt 监听333端口有信息重定向到ps.txt文件里
kali 64Bit
root:~# ps aux | nc -nv 10.1.1.12 333 -q 1
(UNKNOWN) [10.1.1.12] 333 (?) open
kali 32Bit
root@kali:~# cat ps.txt //查看ps.txt文件
kali 32Bit
root@kali:~# nc -l -p 333 > lsof.txt
kali 64Bit
root:~# lsof | nc -nv 10.1.1.12 333 -q 1
(UNKNOWN) [10.1.1.12] 333 (?) open
kali 32Bit
root@kali:~# more lsof.txt //这个文件比较多，所以用more查看文件