> For the complete documentation index, see [llms.txt](https://micro8.gitbook.io/micro8/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://micro8.gitbook.io/micro8/contents-1/21-30/21-ji-yu-icmp-fa-xian-nei-wang-cun-huo-zhu-ji.md).

# 第二十一课：基于ICMP发现内网存活主机

## ICMP简介：

它是TCP/IP协议族的一个子协议，用于在IP主机、路由器之间传递控制消息。控制消息是指网络通不通、主机是否可达、路由是否可用等网络本身的消息。这些控制消息虽然并不传输用户数据，但是对于用户数据的传递起着重要的作用。

## nmap扫描：

```bash
root@John:~# nmap ‐sP ‐PI 192.168.1.0/24 ‐T4
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXjML3_FcKKksF7yox%2F-LZJx5dv_wre5mrYcOr_%2F32074ff9a8a71e3f75239e68c5161b17.jpg?generation=1551066054692699\&alt=media)

```bash
root@John:~# nmap ‐sn ‐PE ‐T4 192.168.1.0/24
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXjML3_FcKKksF7yox%2F-LZJx5e-bCGGHfsaSSUo%2F0f2404547901a8c72cc03544c5961259.jpg?generation=1551066086291372\&alt=media)

## CMD下扫描：

```bash
for /L %P in (1,1,254) DO @ping ‐w 1 ‐n 1 192.168.1.%P | findstr "TTL ="
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXjML3_FcKKksF7yox%2F-LZJx5e4TyQE5C38EJPA%2Fab265501d9c11081cb0f63e3cb991d80.jpg?generation=1551066085403825\&alt=media)

## powershell扫描：

```
powershell.exe ‐exec bypass ‐Command "Import‐Module ./Invoke‐TSPingSweep.ps1
; Invoke‐TSPingSweep ‐StartAddress 192.168.1.1 ‐EndAddress 192.168.1.254 ‐Resolv
eHost ‐ScanPort ‐Port 445,135"
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXjML3_FcKKksF7yox%2F-LZJx5e86t2GTZ-_a9My%2F7feea7aca005154fdbef4180ed5a9aae.jpg?generation=1551066088075415\&alt=media)

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXjML3_FcKKksF7yox%2F-LZJx5eCh4IEjjOG-s4I%2F9c8dbccee70c90adc40f48e69c473df8.jpg?generation=1551066056879909\&alt=media)

```bash
D:\>tcping.exe ‐n 1 192.168.1.0 80
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXjML3_FcKKksF7yox%2F-LZJx5eIPuEpov6ILTDa%2F351e700a9da6780fb709932a7b0b56f7.jpg?generation=1551066049502082\&alt=media)

## 附录:

powershell 脚本与 tcping（来源互联网，后门自查）\
链接：<https://pan.baidu.com/s/1dEWUBNN>\
密码：9vge

> Micropoor