Home > Database > Redis > How to write a python3 Redis unauthorized detection script

How to write a python3 Redis unauthorized detection script

WBOY
Release: 2023-05-29 23:55:04
forward
1574 people have browsed it

import sys
import getopt
import socket


def get_target():

    opts, args = getopt.getopt(sys.argv[1:], '-i:-p:-h')
    # print(opts)
    for opt_name, opt_value in opts:
        if opt_name == '-h':
            print('[*]This is help information            [*]n'
                  '[*]-i + vulnerable-ip                  [*]n'
                  '[*]-p + vulnerable-port                [*]n'
                  '[*]Example:python3 -i 127.0.0.1 -p 6379[*]n')

        if opt_name in ('-i', ):
            ip = opt_value

        if opt_name in ('-p', ):
            port = opt_value

    return ip, port

def passwd_dict():
    passwd = ['redis@123', 'Redis@123', 'Passw0rd', '123456']
    return passwd

def main(ip, port, passwd):
    print("[*]Redis Unauthorized and Weak Password Detection  [*]n"
          "[*]By: Zh1z3ven                                    [*]n"
          "[*]Blog: https://www.cnblogs.com/Zh1z3ven/         [*]n")
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, int(port)))
    send_data = 'INFOrn'
    s.send(send_data.encode())
    res = s.recv(1024)
    response = bytes.decode(res)
    # print(response)
    if 'redis_version' in response:
        result = '[!]Vulnerable {0}:{1} 存在未授权访问  [!]'.format(ip, port)
        print(result)
        return result

    elif 'NOAUTH' in response:
        for item in passwd:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((ip, int(port)))
            send_data = 'AUTH {0}rn'.format(item)
            s.send(send_data.encode())
            res = s.recv(1024)
            response = bytes.decode(res)
            # print(response)

            if '+OK' in response:
                result = '[!]Vulnerable: {0}:{1} 存在弱口令{2} [!]'.format(ip, port, item)
                print(result)
                return result
            else:
                result = '[*] 不存在未授权及弱口令 [*]'
                print(result)
                return result


if __name__ == '__main__':

    ip, port = get_target()
    passwd = passwd_dict()
    main(ip, port, passwd)
Copy after login

The above is the detailed content of How to write a python3 Redis unauthorized detection script. For more information, please follow other related articles on the PHP Chinese website!

Related labels:
source:yisu.com
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template