Redis is injected with crackit, but I disabled the persistent storage function. how can I determine if my server is hacked?

Source: Internet
Author: User
Due to my negligence, I forgot to set a password for redis I installed two months ago and bound it to a public IP address. so I opened redis today and saw the crackit field injected, the value is an ssh-rsa, but it seems that my root password has not been changed during this period. does it mean that he only needs to note...

Due to my negligence, I forgot to set a password for redis I installed two months ago and bound it to a public IP address. so I opened redis today and saw the crackit field injected, the value is an ssh-rsa, but it seems that my root password has not been changed during this period. does it mean that he only injected the key, but it has not been replaced successfully?


After I installed redis, I commented out the three lines. In theory, I should have disabled the persistent storage function. if I disabled it, can I still use this method to hack my server?

I asked this question to confirm whether my server was hacked by him? Because I have important data on my server, thank you!

Reply content:

Due to my negligence, I forgot to set a password for redis I installed two months ago and bound it to a public IP address. so I opened redis today and saw the crackit field injected, the value is an ssh-rsa, but it seems that my root password has not been changed during this period. does it mean that he only injected the key, but it has not been replaced successfully?


After I installed redis, I commented out the three lines. In theory, I should have disabled the persistent storage function. if I disabled it, can I still use this method to hack my server?

I asked this question to confirm whether my server was hacked by him? Because I have important data on my server, thank you!

In this way, persistence is disabled.
Check whether authorized_keys under/root/. ssh is abnormal.
This vulnerability can only be used to write files through redis. it is mainly used to write ssh-rsa and then log on to it through ssh.
If the lua script is executed through redis, this will not work.
If it is hacked, other backdoors may also be left, and the record will be clearly cleared. In this way, you do not know that you have been hacked.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.