PowerShell端口扫描之解析多格式输出与结果处理技巧

powershell .\Invoke-Portscan.ps1 -Hosts 192.168.1.0/24 -T 4 -ports '445,1433,8080,3389,80' -oA c:\windows\temp\res.txt

powershell .\Invoke-Portscan.ps1  # 调用PowerShell端口扫描脚本
-Hosts 192.168.1.0/24             # 扫描目标：整个C类网段（256个IP）
-T 4                              # 线程数：4个并发线程
-ports '445,1433,8080,3389,80'   # 目标端口：关键服务端口
-oA c:\windows\temp\res.txt       # 输出参数：指定输出格式和路径

<!-- res.txt.xml 示例片段 -->
<host starttime="1723123456" endtime="1723123567">
    <address addr="192.168.1.1" addrtype="ipv4"/>
    <ports>
        <port protocol="tcp" portid="80">
            <state state="open" reason="syn-ack" reason_ttl="64"/>
            <service name="http" method="table" conf="3"/>
        </port>
    </ports>
</host>

# res.txt.nmap 示例片段
Nmap scan report for 192.168.1.1
Host is up (0.045s latency).

PORT     STATE SERVICE
80/tcp   open  http
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

# res.txt.gnmap 示例片段
Host: 192.168.1.1 () Ports: 80/open/tcp//http///, 445/open/tcp//microsoft-ds///, 
3389/open/tcp//ms-wbt-server///

powershell .\Invoke-Portscan.ps1 -Hosts 192.168.1.0/24 -T 4 -ports '445,1433,8080,3389,80' -oN c:\windows\temp\res.txt

# 查看完整帮助信息
Get-Help .\Invoke-Portscan.ps1 -full

# 或使用脚本自身的帮助参数
.\Invoke-Portscan.ps1 -?
.\Invoke-Portscan.ps1 -Help

# 方法1：直接重命名nmap格式文件
Copy-Item "c:\windows\temp\res.txt.nmap" "c:\windows\temp\res.txt"

# 方法2：合并所有输出文件
Get-Content "c:\windows\temp\res.txt.*" | Set-Content "c:\windows\temp\combined_res.txt"

# 方法3：选择性提取关键信息
Select-String -Path "c:\windows\temp\res.txt.nmap" -Pattern "open" | 
    ForEach-Object { $_.Line } | 
    Set-Content "c:\windows\temp\open_ports.txt"

# 单IP多端口扫描函数
function Invoke-SimplePortScan {
    param(
        [string]$Target = "192.168.1.1",
        [array]$Ports = @(445, 1433, 8080, 3389, 80),
        [string]$OutputPath = "c:\windows\temp\res.txt"
    )
    
    # 清空或创建输出文件
    "" | Set-Content $OutputPath
    
    foreach ($port in $Ports) {
        Write-Host "扫描 $Target 端口 $port ..." -ForegroundColor Yellow
        $result = Test-NetConnection -ComputerName $Target -Port $port -WarningAction SilentlyContinue
        
        if ($result.TcpTestSucceeded) {
            $message = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $Target 端口 $port 开放"
            Write-Host $message -ForegroundColor Green
            $message | Add-Content $OutputPath
        }
    }
}

# 扫描整个网段
function Invoke-NetworkPortScan {
    param(
        [string]$Network = "192.168.1",
        [array]$Ports = @(445, 1433, 8080, 3389, 80),
        [string]$OutputPath = "c:\windows\temp\res.txt"
    )
    
    "开始网络端口扫描: $(Get-Date)" | Set-Content $OutputPath
    
    1..254 | ForEach-Object {
        $targetIP = "$Network.$_"
        foreach ($port in $Ports) {
            $result = Test-NetConnection -ComputerName $targetIP -Port $port -WarningAction SilentlyContinue
            if ($result.TcpTestSucceeded) {
                "$targetIP 端口 $port 开放" | Add-Content $OutputPath
            }
        }
    }
    
    "扫描完成: $(Get-Date)" | Add-Content $OutputPath
}

# 使用示例
Invoke-SimplePortScan -Target "192.168.1.1" -OutputPath "c:\windows\temp\single_scan.txt"

# 重定向标准输出到文件
.\Invoke-Portscan.ps1 -Hosts 192.168.1.0/24 -T 4 -ports '445,1433,8080,3389,80' > c:\windows\temp\res.txt

# 使用Tee-Object同时查看和保存输出
.\Invoke-Portscan.ps1 -Hosts 192.168.1.0/24 -T 4 -ports '445,1433,8080,3389,80' | Tee-Object -FilePath c:\windows\temp\res.txt

function Invoke-MyPortScan {
    param(
        [Parameter(Mandatory=$true)]
        [string]$Hosts,
        
        [int]$Threads = 4,
        
        [string]$Ports = "445,1433,8080,3389,80",
        
        [string]$OutputFile = "c:\windows\temp\scan_result.txt"
    )
    
    # 调用原始扫描脚本
    $result = .\Invoke-Portscan.ps1 -Hosts $Hosts -T $Threads -ports $Ports -oA $OutputFile
    
    # 将nmap格式转换为简单文本
    if (Test-Path "$OutputFile.nmap") {
        $content = Get-Content "$OutputFile.nmap"
        $simpleResult = $content | Where-Object { $_ -match "(open|filtered|closed)" }
        $simpleResult | Set-Content $OutputFile
    }
    
    return $result
}

# 优化的扫描参数
.\Invoke-Portscan.ps1 `
    -Hosts 192.168.1.0/24 `
    -T 8 `  # 根据系统资源调整线程数
    -ports '445,1433,8080,3389,80' `
    -Delay 100 `  # 添加延迟避免被检测
    -Timeout 3000 `  # 设置超时时间
    -oA c:\windows\temp\res.txt

# 统计开放端口数量
$openPorts = Get-Content "c:\windows\temp\res.txt.nmap" | Select-String "open"
Write-Host "发现 $($openPorts.Count) 个开放端口"

# 提取所有开放端口的IP地址
$ipAddresses = Get-Content "c:\windows\temp\res.txt.nmap" | 
    Select-String "Nmap scan report for" | 
    ForEach-Object { $_ -replace "Nmap scan report for ", "" }

# 生成简易报告
$report = @"
端口扫描结果报告
生成时间: $(Get-Date)
扫描范围: 192.168.1.0/24
目标端口: 445,1433,8080,3389,80

发现 $($openPorts.Count) 个开放端口
涉及 $($ipAddresses.Count) 台主机

详细结果请查看: c:\windows\temp\res.txt.nmap
"@

$report | Set-Content "c:\windows\temp\scan_report.txt"