PowerShell小技巧之获取TCP响应(类Telnet)
通常情况下,为了检测指定的TCP端口是否存活,我们都是通过telnet指定的端口看是否有响应来确定,然而默认情况下win8以后的系统默认是不安装telnet的。设想一下如果你黑进了一个服务器,上面没装telnet,但是为了进一步渗透进内网,需要探测内部服务器特定端口是否打开,同时你还不愿意安装telnet,担心引起管理员注意。那么好吧,在这个情况下你需要我的这个脚本。由于它是原生态的PowerShell语句完成,木有telnet你也照样能检测TCP端口的情况了。
下面首先上代码,后面进行讲解:
=====文件名:Get-TCPResponse.ps1=====
Function Get-TCPResponse {
<# Author:fuhj(powershell#live.cn ,http://fuhaijun.com)
.SYNOPSIS
Tests TCP port of remote or local system and returns a response header
if applicable
.DESCRIPTION
Tests TCP port of remote or local system and returns a response header
if applicable
If server has no default response, then Response property will be NULL
.PARAMETER Computername
Local or remote system to test connection
.PARAMETER Port
TCP Port to connect to
.PARAMETER TCPTimeout
Time until connection should abort
.EXAMPLE
Get-TCPResponse -Computername pop.126.com -Port 110Computername : pop.126.com
Port : 110
IsOpen : True
Response : +OK Welcome to coremail Mail Pop3 Server (126coms[75c606d72bf436dfbce6.....])Description
-----------
Checks port 110 of an mail server and displays header response.
#>
[OutputType('Net.TCPResponse')]
[cmdletbinding()]
Param (
[parameter(ValueFromPipeline,ValueFromPipelineByPropertyName)]
[Alias('__Server','IPAddress','IP','domain')]
[string[]]$Computername = $env:Computername,
[int[]]$Port = 25,
[int]$TCPTimeout = 1000
)
Process {
ForEach ($Computer in $Computername) {
ForEach ($_port in $Port) {
$stringBuilder = New-Object Text.StringBuilder
$tcpClient = New-Object System.Net.Sockets.TCPClient
$connect = $tcpClient.BeginConnect($Computer,$_port,$null,$null)
$wait = $connect.AsyncWaitHandle.WaitOne($TCPtimeout,$false)
If (-NOT $wait) {
$object = [pscustomobject] @{
Computername = $Computer
Port = $_Port
IsOpen = $False
Response = $Null
}
} Else {
While ($True) {
#Let buffer
Start-Sleep -Milliseconds 1000
Write-Verbose "Bytes available: $($tcpClient.Available)"
If ([int64]$tcpClient.Available -gt 0) {
$stream = $TcpClient.GetStream()
$bindResponseBuffer = New-Object Byte[] -ArgumentList $tcpClient.Available
[Int]$response = $stream.Read($bindResponseBuffer, 0, $bindResponseBuffer.count)
$Null = $stringBuilder.Append(($bindResponseBuffer | ForEach {[char][int]$_}) -join '')
} Else {
Break
}
}
$object = [pscustomobject] @{
Computername = $Computer
Port = $_Port
IsOpen = $True
Response = $stringBuilder.Tostring()
}
}
$object.pstypenames.insert(0,'Net.TCPResponse')
Write-Output $object
If ($Stream) {
$stream.Close()
$stream.Dispose()
}
$tcpClient.Close()
$tcpClient.Dispose()
}
}
}
}
首先创建一个System.Net.Sockets.TCPClient对象,去连接指定的域名和端口,瞬间断开的那是服务器没开那个端口,直接被拒绝了,如果没拒绝,那就等着服务器端给你响应,然后读取字节流拼接起来进行解析。
最后需要强调的是需要对打开的流和TCP连接进行关闭,以便释放资源
调用方法如下:
Get-TCPResponse -Computername pop.126.com -Port 110
再对比一下telnet的结果
结果是一样的,以后没有telnet也难不住大家了,have fun!^_^
您可能感兴趣的文章:
- 通过PowerShell获取TCP响应(类Telnet)
- 通过PowerShell获取TCP响应(类Telnet)
- 通过PowerShell获取TCP响应(类Telnet)
- 通过PowerShell获取TCP响应(类Telnet) 推荐
- Powershell小技巧之获取注册表值的类型
- zabbix自定义监控脚本——获取tcp状态之不同命令的响应时间
- Powershell小技巧之获取变量列表
- PowerShell小技巧之发送TCP请求
- Powershell小技巧之从文件获取系统日志
- Powershell小技巧之获取对象可变的特征
- PowerShell小技巧之获取域名whois信息
- Powershell小技巧之获取字符串的行数
- PowerShell获取当前进程PID的小技巧
- Powershell小技巧之获取当前的时间并转换为时辰
- PowerShell小技巧之查找获取注册表路径
- PowerShell小技巧之获取Windows系统密码Hash
- zabbix自定义监控脚本——获取tcp状态之不同命令的响应时间
- Powershell小技巧之获取MAC地址
- http(17):请求头响应头键值对含义、设置请求头数据,获取请求头数据,获取响应头数据
- PowerShell: 如何获取和修改文件或文件夹的访问权限