服务器配置不当包括三个部分:
1.Redis服务使用ROOT账号启动
2.Redis服务无密码认证或者使用的是弱口令进行认证
3.服务器开放了SSH服务，而且允许使用密钥登录
简单的写下过程
测试环境
victim server CentOS6.6 192.168.1.11
attack server CentOS6.6+redis2.4 192.168.1.12
|
1
2
3
4
5
6
7
8
9
10
|
6379
192.168.1.11...
192.168.1.11.
.
21
!
quit
OK
.
|
表明了Redis是正常工作的，而且不需要进行身份认证。
先在attack server生成一个公钥
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
.
id_rsa
:
:
.
.
:
.io
:
+
|
|
|
|
|
|
|
|
|
+
|
这样有了一个公钥，但是需要把这个公钥复制到目标机器
|
1
|
.txt
|
Now foo.txt is just our public key but with newlines. We can write this string inside the memory of Redis using redis-cli:
|
1
|
flushall
|
|
1
|
crackit
|
Looks good. How to dump our memory content into the authorized_keys file? That’s
kinda trivial.
|
1
2
3
4
5
6
7
8
9
10
|
192.168.1.11
/
OK
dir
OK
save
OK
|
At this point the target authorized keys file should be full of garbage, but should also include our public key. The string does not have simple patterns so it’s unlikely that it was compressed inside the RDB file. Will ssh be so naive to parse a totally corrupted file without issues, and accept the only sane entry inside?
|
1
2
3
4
5
|
192.168.1.11
:
192.168.1.10
hostname
.local
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
###测试环境
`
.133
.132
`
server生成一个公钥
`
.txt
`
然后执行
`
flushall
pwn
`
.133
`
.ssh/
save
exit
`
然后就可以使用ssh的公钥登录了
`
.133
`
|
参考:
http://antirez.com/news/96
http://v2ex.com/t/234520#reply25