Linux-nc使用指南

简介

NetCat 是一款调试 TCP/UDP 网络连接的利器,被称作是网络调试的瑞士军刀,可见其功能强大。

NetCat 的基本功能如下:

  • telnet 获取系统 banner 信息
  • 传输文本信息
  • 传输文件和目录
  • 加密传输文件
  • 端口扫描
  • 远程控制

参数说明

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
% nc -h
usage: nc [-46AacCDdEFhklMnOortUuvz] [-K tc] [-b boundif] [-i interval] [-p source_port]
[-s source_ip_address] [-w timeout] [-X proxy_version]
[-x proxy_address[:port]] [hostname] [port[s]]
Command Summary:
-4 Use IPv4
-6 Use IPv6
-A Set SO_RECV_ANYIF on socket
-a Set SO_AWDL_UNRESTRICTED on socket
-b ifbound Bind socket to interface
-C Don't use cellular connection
-c Send CRLF as line-ending
-D Enable the debug socket option
-d Detach from stdin
-E Don't use expensive interfaces
-F Do not use flow advisory (flow adv enabled by default)
-G conntimo Connection timeout in seconds
-H keepidle Initial idle timeout in seconds
-h This help text
-I keepintvl Interval for repeating idle timeouts in seconds
-i secs Delay interval for lines sent, ports scanned
-J keepcnt Number of times to repeat idle timeout
-K tclass Specify traffic class
-k Keep inbound sockets open for multiple connects
-L num_probes Number of probes to send before generating a read timeout event
-l Listen mode, for inbound connects
-m Set SO_INTCOPROC_ALLOW on socket
-N num_probes Number of probes to send before generating a write timeout event
-o Issue socket options after connect/bind
-n Suppress name/port resolutions
-O Use old-style connect instead of connectx
-p port Specify local port for remote connects (cannot use with -l)
-r Randomize remote ports
-s addr Local source address
-t Answer TELNET negotiation
-U Use UNIX domain socket
-u UDP mode
-v Verbose
-w secs Timeout for connects and final net reads
-X proto Proxy protocol: "4", "5" (SOCKS) or "connect"
-x addr[:port] Specify proxy address and port
-z Zero-I/O mode [used for scanning]
Port numbers can be individual or ranges: lo-hi [inclusive]

示例

监听端口

持续监听 8888 端口。

1
2
3
4
5
% nc -lk 8888
GET /hello HTTP/1.1
Host: localhost:8888
User-Agent: curl/7.79.1
Accept: */*

端口扫描

扫描 IP192.168.0.1251-100 端口。

1
2
3
4
% nc -v -z -w1 192.168.0.125 1-100
nc: connectx to 192.168.0.125 port xx (tcp) failed: Connection refused
% nc -v -z -w1 192.168.0.125 80 # 扫描单个端口
nc: connectx to 192.168.0.125 port 80 (tcp) failed: Connection refused

传输文件

两台机器之间传输文件。

1
2
3
4
5
# 接收端(文件名可以自定义)
% nc -lp 8888 > tmp_receiver.tar.gz

# 发送端(`192.168.0.125` 为接收端的 `IP` 地址),接收端完成接收后自动退出
% nc -nv 192.168.0.125 8888 -i 1 < tmp_sender.tar.gz

远程控制

被控端主动设置端口和 bash 环境(如果有防火墙,需开放端口,否则会被拦截)。

1
2
3
4
5
# 被控端
% nc -lvnp 8888 -c bash

# 控制端
% nc 192.168.0.125 8888

总结

多使用,多总结,融会贯通。