通常情况下，为了检测指定的TCP端口是否存活，我们都是通过telnet指定的端口看是否有响应来确定，然而默认情况下win8以后的系统默认是不安装telnet的。设想一下如果你黑进了一个服务器，上面没装telnet，但是为了进一步渗透进内网，需要探测内部服务器特定端口是否打开，同时你还不愿意安装telnet，担心引起管理员注意。那么好吧，在这个情况下你需要我的这个脚本。由于它是原生态的PowerShell语句完成，木有telnet你也照样能检测TCP端口的情况了。
下面首先上代码，后面进行讲解:
Computername : pop.126.com
Port : 110
IsOpen : True
Response : +OK Welcome to coremail Mail Pop3 Server (126coms[75c606d72bf436dfbce6.....])
Description
-----------
Checks port 110 of an mail server and displays header response.
#>
[OutputType('Net.TCPResponse')]
[cmdletbinding()]
Param (
[parameter(ValueFromPipeline,ValueFromPipelineByPropertyName)]
[Alias('__Server','IPAddress','IP','domain')]
[string[]]$Computername = $env:Computername,
[int[]]$Port = 25,
[int]$TCPTimeout = 1000
)
Process {
ForEach ($Computer in $Computername) {
ForEach ($_port in $Port) {
$stringBuilder = New-Object Text.StringBuilder
$tcpClient = New-Object System.Net.Sockets.TCPClient
$connect = $tcpClient.BeginConnect($Computer,$_port,$null,$null)
$wait = $connect.AsyncWaitHandle.WaitOne($TCPtimeout,$false)
If (-NOT $wait) {
$object = [pscustomobject] @{
Computername = $Computer
Port = $_Port
IsOpen = $False
Response = $Null
}
} Else {
While ($True) {
#Let buffer
Start-Sleep -Milliseconds 1000
Write-Verbose "Bytes available: $($tcpClient.Available)"
If ([int64]$tcpClient.Available -gt 0) {
$stream = $TcpClient.GetStream()
$bindResponseBuffer = New-Object Byte[] -ArgumentList $tcpClient.Available
[Int]$response = $stream.Read($bindResponseBuffer, 0, $bindResponseBuffer.count)
$Null = $stringBuilder.Append(($bindResponseBuffer | ForEach {[char][int]$_}) -join '')
} Else {
Break
}
}
$object = [pscustomobject] @{
Computername = $Computer
Port = $_Port
IsOpen = $True
Response = $stringBuilder.Tostring()
}
}
$object.pstypenames.insert(0,'Net.TCPResponse')
Write-Output $object
If ($Stream) {
$stream.Close()
$stream.Dispose()
}
$tcpClient.Close()
$tcpClient.Dispose()
}
}
}
}
首先创建一个System.Net.Sockets.TCPClient对象,去连接指定的域名和端口，瞬间断开的那是服务器没开那个端口，直接被拒绝了，如果没拒绝，那就等着服务器端给你响应，然后读取字节流拼接起来进行解析。
最后需要强调的是需要对打开的流和TCP连接进行关闭，以便释放资源
调用方法如下:
再对比一下telnet的结果
结果是一样的，以后没有telnet也难不住大家了，have fun！^_^
